Merge pull request 'chore: Trigger CI' (#1) from dev into master

Reviewed-on: #1

.gitattributes

@@ -9,3 +9,4 @@
 *.conf      text eol=lf
 # Vendor JS pinned LF — avoids CRLF churn on Windows checkout
 DeepDrftShared.Client/wwwroot/js/parallax/parallax.js  text eol=lf
+DeepDrftShared.Client/wwwroot/js/knob/knob.js          text eol=lf

.gitignore

@@ -317,4 +317,7 @@ Database/Vaults/*
 !DeepDrftPublic.Client/wwwroot/js/*.js
 # RCL compiled JS must be committed — MapStaticAssets serves from build-time manifest;
 # gitignored TS output is absent when manifest is generated, so absent from publish output.
-!DeepDrftShared.Client/wwwroot/js/parallax/
+# Re-include the whole RCL js/ tree so every compiled module (parallax, knob, theme, and
+# any added later) ships, rather than maintaining a per-module allowlist.
+!DeepDrftShared.Client/wwwroot/js/
+!DeepDrftShared.Client/wwwroot/js/**

CLAUDE.md

@@ -8,12 +8,12 @@ DeepDrftHome is a **net10.0** solution consisting of ten projects implementing a
 
 ### Core Projects
 
-- **DeepDrftPublic**: ASP.NET Core host. Blazor Web App with Server + WASM render modes. Owns browser-facing proxy controller for `api/track/*` (metadata listing and audio streaming), MudBlazor theme prerender, and TypeScript→JS audio interop. Public-facing site for listeners.
-- **DeepDrftPublic.Client**: Blazor WebAssembly assembly. All interactive UI (pages, player stack, dark-mode plumbing, HTTP clients for both backends). Consumed by the public site.
-- **DeepDrftManager**: ASP.NET Core host. Blazor Web App with server-rendered `InteractiveServer` render mode. Hosts all CMS Razor components and pages under `Components/Pages/Cms/`, `Components/Pages/Tracks/`, `Components/Layout/CmsLayout.razor`, and `Components/Shared/` (all inlined from the former `DeepDrftCms` RCL). Gated by AuthBlocks login and hierarchical `Admin` role authorization. All track operations (upload, metadata read/write, delete) are HTTP proxies via `ICmsTrackService` / `CmsTrackService` injected directly into Blazor components; no in-process data layer.
+- **DeepDrftPublic**: ASP.NET Core host. Blazor Web App with Server + WASM render modes. Owns browser-facing proxy controller for `api/track/*` (metadata listing and audio streaming), crawl-directive endpoints (`GET /robots.txt` and `GET /sitemap.xml`, environment-gated via `IWebHostEnvironment.IsProduction()` directly — server-side only, no PersistentState bridge — served by `CrawlDirectiveController` with pure builders in `Seo/RobotsTxt.cs` and `Seo/SitemapXml.cs`), MudBlazor theme prerender, and TypeScript→JS audio interop. Public-facing site for listeners.
+- **DeepDrftPublic.Client**: Blazor WebAssembly assembly. All interactive UI (pages, player stack, dark-mode plumbing, HTTP clients for both backends). Pages include the public `/about` editorial page (`Pages/About.razor` — three-movement **"Liner Notes"** editorial treatment: numbered left-rail (oversized Bodoni numerals + vertical hairline spine + mono marginalia captions), asymmetric content column, pull-quotes breaking into the margin, hand-authored SVG waveform movement dividers (self-contained motif, not the live `WaveformVisualizer`), and stacked editorial definition list for CUTS/SESSIONS/MIXES; active-movement highlight via `about-rail.ts` IntersectionObserver interop; registered in `Layout/Pages.cs`). Home hero stat row (`NowPlayingStats.razor`) is live-data-backed via `IStatsDataService` / `StatsClient` (named `"DeepDrft.API"` client) with a `PersistentComponentState` prerender bridge; `RuntimeFormat` helper converts mix runtime seconds to `hh:mm`. **SEO component** (`Controls/SeoHead.razor` + `Common/SeoModel`, `SeoJsonLd`, `SeoOptions`, `SeoUrls`, `SeoEnvironment`): `SeoHead` is a presentational `<HeadContent>` emitter (one line per page, no fetch); `SeoModel` named factories (`ForRelease`/`ForHome`/`ForAbout`/`ForBrowse`/`ForNotFound`) encode the medium→schema.org mapping in one place; `SeoJsonLd` builds typed JSON-LD (MusicGroup / MusicAlbum+LiveAlbum / MusicRecording / CollectionPage) with inline-safe escaping; `SeoOptions` holds site-wide config (`BaseUrl https://deepdrft.com`, title suffix, default OG image seam, IG `sameAs`) registered via the static `Startup` seam; `SeoEnvironment` is a scoped `[PersistentState]` bridge (mirrors `DarkModeSettings`) seeded in `DeepDrftPublic/Components/App.razor` from `IWebHostEnvironment.IsProduction()` — robots defaults to `index,follow` only in Production, `noindex,nofollow` everywhere else (fail-safe is noindex); per-page `SeoModel.Robots` overrides the default. Tags are present in prerendered HTML (rides the existing `PersistentComponentState` bridge; no new fetch). Canonical/OG origins come from `SeoOptions.BaseUrl` (config), not `window.location` — no `window` at server prerender and the origin cannot be derived behind the nginx proxy. Consumed by the public site.
+- **DeepDrftManager**: ASP.NET Core host. Blazor Web App with server-rendered `InteractiveServer` render mode. **Always uncrawlable**: a static `wwwroot/robots.txt` (`Disallow: /`, no env gate) plus a blanket `<meta name="robots" content="noindex,nofollow">` in `Components/App.razor` — defense in depth so the CMS is never indexed regardless of how it is discovered. Hosts all CMS Razor components and pages under `Components/Pages/Cms/`, `Components/Pages/Tracks/`, `Components/Layout/CmsLayout.razor`, and `Components/Shared/` (all inlined from the former `DeepDrftCms` RCL). Public entry point: `Components/Pages/Home.razor` (`@page "/"`, no `[Authorize]`, uses lean `CmsHomeLayout`) — unauthenticated visitors see a DeepDrft-branded splash with a Login CTA; authenticated admins are redirected to `/catalogue` via `RedirectToCatalogue`. `Routes.razor` resolves `DefaultLayout` from the cascaded `Task<AuthenticationState>`: unauthenticated → `CmsHomeLayout`, authenticated → `CmsLayout`; this means the AuthBlocks `Login`/`Register` pages (which declare no `@layout`) render in the lean layout for unauthenticated visitors. `CmsLayout` carries a left `MudDrawer` (app-bar hamburger toggle) holding the CMS destinations (Catalogue `/catalogue`, Releases `/releases`, Upload `/tracks/upload`), the AuthBlocks `UserAdminMenu` fragment (self-gates to `UserAdmin`+, links Users/Registrations/Permissions), and a "Provision User" link to `/useradmin/users/new` wrapped in a `HierarchicalRoleAuthorizeView` (`UserAdmin`-gated) — making the AuthBlocks user-administration surface reachable from the CMS UI. The catalogue dashboard (`Components/Pages/Index.razor`) lives at `@page "/catalogue"` and remains `[Authorize]`-gated with `CmsLayout`; its cards are **CUTS / SESSIONS / MIXES**, each deep-linking to `/releases?medium=<medium>` with the matching tab pre-selected. The consolidated browse surface is `Components/Pages/Tracks/Releases.razor` (`@page "/releases"`): bulk-action buttons (Generate All Profiles / Backfill High-res) → medium tab strip (ALL / CUTS / SESSIONS / MIXES) → the active tab's grid; waveform columns (Profile / High-res) — each showing a status icon when a datum is present and an always-visible generate/regenerate button — and per-track info tooltip live in `CmsAlbumBrowser`'s expanded child-row track table. Old list routes `/tracks`, `/tracks/albums`, `/tracks/archive` are kept as aliases on `Releases.razor` so bookmarks don't 404; operational sub-routes (`/tracks/upload`, edit routes, etc.) remain at `/tracks/*`. Gated by AuthBlocks login and hierarchical `Admin` role authorization. All track operations (upload, metadata read/write, delete, replace audio) are HTTP proxies via `ICmsTrackService` / `CmsTrackService` injected directly into Blazor components; no in-process data layer. The per-track "Replace audio" affordance in `BatchEdit` / `BatchTrackList` / `BatchTrackDetail` swaps the vault bytes, regenerates both waveform datums server-side, and re-derives `DurationSeconds` from the new audio; the track id, `EntryKey`, release membership, position, and all other metadata are preserved. The remove control on a persisted track is hidden when it is the release's sole remaining persisted track — a release can reach zero live tracks only via replace or release-level delete, not per-track removal. Two named HttpClients: `DeepDrft.Content.Cms` (bounded 100 s default, for all non-upload calls) and `DeepDrft.Content.Cms.Upload` (`InfiniteTimeSpan`, for large WAV uploads). Upload progress and idle/heartbeat timeout are driven by a single `ProgressStreamContent` wrapper (`Services/ProgressStreamContent.cs`); `CmsTrackService.UploadTrackAsync` adds a two-phase cancellation (idle window resets per progress tick; separate response-wait budget arms when the body completes). The upload form is create-only: `BatchUpload.razor` calls `GET api/track/release/exists` as a pre-flight before transferring bytes and blocks the submit with a visible message if a (title, artist) match already exists; the server also rejects duplicates with 409. The authenticated user's id (`NameIdentifier` claim) is captured once into `_createdByUserId` at component initialization (`OnInitializedAsync`) — not re-read at submit — so a mid-session token expiry cannot discard a long-composed release; the page is `[Authorize]`-gated and runs `prerender: false`, so the auth state is fully available at init and only one init pass occurs. Within-batch multi-track Cuts still work by passing the release id from row 1 as `releaseId` on rows 2..N (the ATTACH path), while `BatchEdit.razor` uses the same ATTACH path for its legitimate adds-to-existing-release.
 - **DeepDrftShared.Client**: Razor Class Library. Shared Blazor components consumed by both `DeepDrftPublic` and `DeepDrftManager` for consistency across public and admin surfaces.
 - **DeepDrftData**: Class library. EF Core domain logic: `DeepDrftContext`, `TrackConfiguration`, `Migrations`, `TrackRepository`, `TrackService`, `TrackManager`. Consumed by `DeepDrftAPI` and tests.
-- **DeepDrftAPI**: ASP.NET Core host. Dual-database authority (SQL metadata + FileDatabase binary). AuthBlocks API host (owns registration, migration/seed, JWT endpoints). Track endpoints: streaming, vault write, upload+persist, delete+cleanup, paged list with filters, single metadata (ApiKey-gated operations), metadata update, waveform profiles, release-track join operations. Release endpoints: paged list with medium filter, single read, mix waveform compute, session hero-image upload (all unauthenticated reads; authenticated writes via ApiKey). Image endpoints: authenticated upload, unauthenticated streaming.
+- **DeepDrftAPI**: ASP.NET Core host. Dual-database authority (SQL metadata + FileDatabase binary). AuthBlocks API host (owns registration, migration/seed, JWT endpoints). Track endpoints: streaming, vault write, upload+persist, delete+cleanup, paged list with filters, single metadata (ApiKey-gated operations), metadata update, waveform profiles (512-bucket seeker + per-track high-res visualizer datum in the `track-waveforms` vault), release-track join operations, `POST api/track/duration/backfill` (ApiKey-gated one-time backfill of `DurationSeconds` for existing rows from vault audio). Stats endpoints: `GET api/stats/home` (unauthenticated; returns `HomeStatsDto` with cut track count, per-`ReleaseType` cut release counts, mix release count, and total mix runtime seconds). Release endpoints: paged list with medium filter, single read, session hero-image upload (all unauthenticated reads; authenticated writes via ApiKey). Image endpoints: authenticated upload, unauthenticated streaming.
 - **DeepDrftContent**: Class library. The FileDatabase implementation in full (Models, Services, Utils, Abstractions, Constants), `AudioProcessor`, content-side `TrackService`. Consumed by hosts and tests.
 - **DeepDrftModels**: Shared contracts. `TrackEntity`, `TrackDto`, `PagingParameters<T>`, `PagedResult<T>`. Every project references this.
 - **DeepDrftTests**: NUnit test suite. Comprehensive FileDatabase tests (vault creation, media storage, indexing, factory patterns, utilities). Integration-focused with temp-directory test isolation.
@@ -34,7 +34,7 @@ Server-side (SSR): Both clients point directly at DeepDrftAPI (server-to-server,
 
 1. **SQL Database (PostgreSQL)**: Metadata and track info via Entity Framework
    - Connection string: Read from `environment/connections.json` via `CredentialTools.ResolvePathOrThrow("connections")` with key `ConnectionStrings:DefaultConnection`.
-   - Entity: `TrackEntity` with `Id`, `EntryKey`, `TrackName`, `Artist`, `Album?`, `Genre?`, `ReleaseDate?`, `ImagePath?`
+   - Entity: `TrackEntity` with `Id`, `EntryKey`, `TrackName`, `Artist`, `Album?`, `Genre?`, `ReleaseDate?`, `ImagePath?`, `DurationSeconds?`
    - Context: `DeepDrftContext` in `DeepDrftData`
 
 2. **FileDatabase**: Custom file-based binary storage system
@@ -76,15 +76,20 @@ Keep this seam clean — it is the most architecturally load-bearing part of the
 
 ### Theming and dark mode
 
-- MudBlazor is the UI framework. Light and dark palettes (bespoke "Charleston in the Day" / "Lowcountry Summer Nights") defined inline in `MainLayout.razor`.
+- MudBlazor is the UI framework. Light and dark palettes (bespoke "Charleston in the Day" / "Lowcountry Summer Nights") defined in `DeepDrftShared.Client/Common/DeepDrftPalettes.cs`. `MainLayout.razor` mounts `<MudThemeProvider Theme="@DeepDrftPalettes.Default" IsDarkMode="_isDarkMode" />` — the palettes are not inline in the layout.
 - Dark mode toggles via cookie (`darkMode`, 365 days). Client-side via JS interop.
 - During server prerender, `DarkModeService` (in `DeepDrftPublic`) reads the cookie and seeds `DarkModeSettings.IsDarkMode`, which carries into WASM render via `PersistentComponentState`. Avoids "wrong theme flash" on initial paint.
 - `DarkModeSettings` lives in `DeepDrftPublic.Client.Common` (consumed by both server prerender and client components).
-- Typography: Google Fonts (Bodoni Moda, Cormorant, DM Sans). Hand-rolled gas-lamp icon (lit/unlit) lives in `DDIcons.cs`.
+- **Theme-aware token layer:** `DeepDrftShared.Client/wwwroot/styles/deepdrft-tokens.css` defines two kinds of CSS custom properties. *Source tokens* (`--deepdrft-navy`, `--deepdrft-white`, `--deepdrft-green-accent`, etc.) are brand constants — identical in `:root` and `.deepdrft-theme-dark`. *Theme-aware aliases* are defined in both blocks and flip when the theme wrapper class changes. Component and page CSS must bind the **alias**, not the source token, so neutral surfaces invert for free. Current alias families: `--deepdrft-page-surface`/`-text`/`-text-muted` (neutral page backgrounds and text), `--deepdrft-play-chip`/`-glyph`/`-chip-soft` (play-state icon chip and glyph), `--deepdrft-popover-surface` (default MudBlazor popover background — light: `color-mix(navy 4%, white)`, a near-page-background surface; dark: references source token `--deepdrft-popover-surface-dark`, a `color-mix(navy-mid 80%, green-accent 20%)` bluer navy defined once in `:root` and referenced by both the `.deepdrft-theme-dark` wrapper block and `body.deepdrft-theme-dark` so portaled popovers are reached). The bespoke glass panels (visualizer/queue/privacy) now bind their own theme-aware `--deepdrft-panel-surface`/`-text`/`-text-muted`/`-border`/`-row-hover` family: dark-glass charcoal (sourced from the `--deepdrft-panel-ground` constant) with light text in dark theme, and a light translucent glass with dark text in light theme. These tokens are re-declared in `body.deepdrft-theme-dark` because the panels are MudOverlay panels that portal to `<body>` (same portal scope as popovers); the `--deepdrft-panel-ground` source token is now consumed only via the dark `--deepdrft-panel-surface` value.
+- **Portaled-popover body-class bridge:** MudBlazor popovers portal to `<body>`, outside the `.deepdrft-theme-dark` wrapper `<div>`, so the dark popover token never reached them. Fix: `MainLayout.razor` stamps `deepdrft-theme-dark` on `<body>` via the `setBodyThemeClass(isDark)` helper in `DeepDrftShared.Client/Interop/theme/theme.ts` (lazy-imported as `_content/DeepDrftShared.Client/js/theme/theme.js`). The call fires only on first render or when `_isDarkMode` actually changes (gated by `_lastAppliedDarkMode` comparison) to avoid redundant JS calls on unrelated re-renders. The `body.deepdrft-theme-dark` selector in `deepdrft-tokens.css` resolves `--deepdrft-popover-surface` from `--deepdrft-popover-surface-dark` for these portaled elements.
+- **Interactive-accent icon treatment (`.dd-accent-icon` / `.dd-accent-fill`):** one reusable rule in `DeepDrftPublic/wwwroot/styles/deepdrft-styles.css` for green-accent interactive icon affordances (Play / Share / Add-to-Queue / lava-lamp trigger), replacing the former pile of per-site dark overrides. Wrap the affordance container in `.dd-accent-icon` to colour its glyphs green-accent in both themes; add `.dd-accent-fill` when the container also holds a `Color.Secondary` filled button that must go green-accent in dark. It is a CSS class (not a palette `Color`) because no MudBlazor `Color` enum is green in both themes, and it targets `.dd-accent-icon .mud-icon-button .mud-icon-root` (0,3,0) `!important` to beat MudBlazor's standalone `.mud-secondary-text` (0,1,0) `!important` on the glyph svg — specificity wins; source order is not load-bearing for the glyph clause. The Session/Mix release-detail hero Share/Play glyphs use this class too (already green-accent in light via `Color.Secondary`, so folding them in keeps light pixel-identical and fixes dark). The gas-lamp toggle (`GasLampLit`) is self-colored in its SVG (`fill="#2A5C4F"` on the frame) — no dark-only CSS rule is needed; `GasLamp` (unlit, light mode) continues to use `currentColor` and inherits nav text colour. New green-accent icons use this class, not a new override. (Convention detail in `DeepDrftPublic.Client/CLAUDE.md`.)
+- Typography: Google Fonts (Bodoni Moda, Cormorant, DM Sans). Hand-rolled gas-lamp icon (lit/unlit) lives in `DeepDrftShared.Client/Common/DDIcons.cs`.
 
 ### TypeScript interop, not raw JS
 
-Audio interop authored in TypeScript under `DeepDrftPublic/Interop/audio/`, compiled to `wwwroot/js/audio/` via `Microsoft.TypeScript.MSBuild`. One module per responsibility (AudioContextManager, StreamDecoder, PlaybackScheduler, SpectrumAnalyzer, AudioPlayer), plus `index.ts` exposing `window.DeepDrftAudio`. `tsconfig.json` is **not** copied to output. In dev, raw `.ts` served from `/Interop/` for source-map debugging.
+Audio interop authored in TypeScript under `DeepDrftPublic/Interop/audio/`, compiled to `wwwroot/js/audio/` via `Microsoft.TypeScript.MSBuild`. One module per responsibility (AudioContextManager, StreamDecoder, PlaybackScheduler, SpectrumAnalyzer, AudioPlayer), plus `index.ts` exposing `window.DeepDrftAudio`. `tsconfig.json` is **not** copied to output. In dev, raw `.ts` served from `/Interop/` for source-map debugging. A second interop module lives at `DeepDrftPublic/Interop/about/about-rail.ts` (IntersectionObserver for the About page active-movement rail highlight; compiled output gitignored).
+
+**`DeepDrftShared.Client` also hosts TypeScript interop.** Its `tsconfig.json` maps `rootDir: "Interop"` → `outDir: "wwwroot/js"`, compiled by the same `Microsoft.TypeScript.MSBuild` package. Current modules: `Interop/parallax/parallax.ts` (parallax scroll for `ParallaxImage`), `Interop/knob/knob.ts` (`capturePointer`/`releasePointer` for `RadialKnob`), and `Interop/theme/theme.ts` (`setBodyThemeClass(isDark)` — stamps/removes `deepdrft-theme-dark` on `<body>` so portaled MudBlazor elements inherit the dark popover token; consumed by `MainLayout.razor`). Consumers lazy-import via the static-asset path `_content/DeepDrftShared.Client/js/<module>/<file>.js`.
 
 ## Development Commands
 
@@ -112,10 +117,10 @@ dotnet run --project DeepDrftAPI
 ### Entity Framework (SQL Database)
 ```bash
 # Add migration (from solution root)
-dotnet ef migrations add MigrationName --project DeepDrftData --startup-project DeepDrftPublic
+dotnet ef migrations add MigrationName --project DeepDrftData --startup-project DeepDrftAPI
 
 # Update database
-dotnet ef database update --project DeepDrftData --startup-project DeepDrftPublic
+dotnet ef database update --project DeepDrftData --startup-project DeepDrftAPI
 ```
 
 ## Key Configuration Files
@@ -123,8 +128,8 @@ dotnet ef database update --project DeepDrftData --startup-project DeepDrftPubli
 All projects load secrets via `CredentialTools.ResolvePathOrThrow()` from gitignored `environment/` files:
 
 - `DeepDrftPublic/appsettings.json`: Logging and URL config. Secrets loaded from `environment/api.json` (DeepDrftAPI base URL via `Api:ContentApiUrl`).
-- `DeepDrftManager/appsettings.json`: Logging and URL config. Secrets loaded from `environment/api.json` (DeepDrftAPI base URL via `Api:ContentApiUrl` and API key via `Api:ContentApiKey`).
-- `DeepDrftAPI/appsettings.json`: Logging and hosting config. Secrets loaded from `environment/filedatabase.json` (FileDatabase vault path), `environment/apikey.json` (API key), `environment/connections.json` (SQL and Auth connection strings), `environment/authblocks.json` (AuthBlocks JWT/email/admin creds).
+- `DeepDrftManager/appsettings.json`: Logging and URL config. Secrets loaded from `environment/api.json` (DeepDrftAPI base URL via `Api:ContentApiUrl` and API key via `Api:ContentApiKey`). Non-secret upload tunables (in `appsettings.json` itself, not `environment/`): `Upload:IdleTimeoutSeconds` (default 90 — aborts a stalled body-streaming phase) and `Upload:ResponseTimeoutSeconds` (default 1200 — budget for server-side persist after the body is fully sent).
+- `DeepDrftAPI/appsettings.json`: Logging and hosting config. Non-secret upload tunable: `Upload:StagingPath` (default empty → a `staging` subdirectory under the FileDatabase vault path) — the data-disk directory where large audio bodies are staged during upload/replace-audio, kept off the system temp mount (`/tmp` is a small tmpfs on the Linux host); `Startup` also points the framework's multipart buffer here via `ASPNETCORE_TEMP`. Secrets loaded from `environment/filedatabase.json` (FileDatabase vault path), `environment/apikey.json` (API key), `environment/connections.json` (SQL and Auth connection strings), `environment/authblocks.json` (AuthBlocks JWT/email/admin creds).
 
 ## Folder-Level Guidance
 

CMS-PLAN.md

@@ -40,7 +40,7 @@ The CMS is now inlined as the primary content of `DeepDrftManager`, a dedicated
 - A `[HierarchicalRoleAuthorize("Admin")]` attribute (from `AuthBlocksWeb.HierarchicalAuthorize`) on every CMS page component, so `Admin` and any descendant role are admitted by the bundled hierarchical role handler.
 - Controllers and minimal-API endpoints for CMS operations (`POST api/cms/track`, `DELETE api/cms/track/{id}`, `PUT api/cms/track/{id}`). Controllers are host-owned per the existing convention. Protected by `[Authorize(Roles = "Admin")]` — the JWT bearer middleware AuthBlocks installs validates the access token on each request.
 - The `AddAuthBlocks(...)` call in `Program.cs` and the matching `await app.Services.UseAuthBlocksStartupAsync()` post-build hook. This installs JWT bearer middleware, the hierarchical role authorization handler, the `AuthDbContext`, the EF migrations, and seeds system roles plus the configured admin user on first boot.
-- The `app.MapAuthBlocks()` call that registers `/api/auth/*`, `/api/users/*`, `/api/roles/*`, `/api/user-roles/*`, and `/api/pending-registrations/*` minimal-API endpoints. The CMS UI uses `/api/auth/login`, `/api/auth/logout`, `/api/auth/refresh`, and `/api/auth/me`; the rest are available if Wave 3 account-management ever lands.
+- The `app.MapAuthBlocks()` call that registers `/api/auth/*`, `/api/users/*`, `/api/roles/*`, `/api/user-roles/*`, and `/api/pendingregistration/*` minimal-API endpoints. The CMS UI uses `/api/auth/login`, `/api/auth/logout`, `/api/auth/refresh`, and `/api/auth/me`; the rest are available if Wave 3 account-management ever lands.
 
 **Render mode:** `InteractiveServer` for all CMS pages and routes. AuthBlocks's bundled UI (`AuthBlocksWeb` pages) is server-rendered MudBlazor with `JwtAuthenticationStateProvider` reading tokens from browser `localStorage` via JS interop. `InteractiveServer` is the right fit because: (a) it matches what the bundled login UI uses, (b) `InputFile` uploads are natively server-side, (c) CMS endpoints live in the `DeepDrftManager` process with direct access to services.
 
@@ -79,7 +79,7 @@ Concretely, from reading the library source:
 
 - Real per-user accounts (`ApplicationUser` table). No shared password.
 - One seeded admin on first boot via `AdminUserSettings`. Username, email, password come from `DeepDrftManager/environment/authblocks.json` (gitignored, same pattern as `apikey.json`).
-- No public signup in Wave 1. The `/account/register` page that AuthBlocks bundles requires a registration code (generated by an admin via `/api/pending-registrations`). We do not surface `/account/register` in any nav until Wave 3 account management lands; the route exists but is uninteresting until then.
+- No public signup in Wave 1. The `/account/register` page that AuthBlocks bundles requires a registration code (generated by an admin via `/api/pendingregistration`). We do not surface `/account/register` in any nav until Wave 3 account management lands; the route exists but is uninteresting until then.
 - **Mutation attribution.** `TrackEntity` gains a nullable `CreatedByUserId : long?` column in the W1.2 migration. Populated on every CMS-originated mutation; null for historical CLI-added rows and for any pre-CMS data. Captures attribution from day one even though Wave 1 has exactly one user (`feedback_design_for_adaptability`).
 - **Role gate.** Every CMS page and every `api/cms/*` endpoint requires the `Admin` system role. We use `Admin` rather than introducing a new `CmsAdmin` role because the collective is small and the existing hierarchy already covers the case; if Wave 3 ever needs finer grain (e.g. a `ContentEditor` role that can edit but not delete), that is a `SystemRole.cs` edit upstream, not a redesign here.
 

COMPLETED.md

@@ -6,6 +6,371 @@ Newest entries at the top. Group by phase/wave header (mirroring `PLAN.md` / `CM
 
 ---
 
+## Phase 23 — SEO Crawl Directives (landed 2026-06-23)
+
+**Landed:** 2026-06-23 on dev.
+
+- **What:** Server-side crawl-directive endpoints for `DeepDrftPublic` (`GET /robots.txt` and `GET /sitemap.xml`) plus a defense-in-depth noindex layer for `DeepDrftManager`. The endpoint/file-shaped follow-on to Phase 22's per-page `SeoHead` component. Phase 22 is the *content* of discoverability; Phase 23 is the *directives* layer above it — telling crawlers **which** pages exist and **whether** to crawl at all. No new `DeepDrftAPI` endpoint, no schema change.
+
+- **Why:** Without robots.txt a crawler has no machine-readable signal about which routes to include or exclude (e.g. `/FramePlayer`, `/api/*`). Without sitemap.xml Google/Bing must discover release detail pages by link-following alone. Without noindex/robots protection the CMS could be inadvertently crawled if an admin link ever appeared on a public page.
+
+- **Shape:**
+  - **`DeepDrftPublic/Controllers/CrawlDirectiveController.cs`** (new): thin controller serving both endpoints. Reads `IWebHostEnvironment.IsProduction()` **directly** — no `SeoEnvironment` PersistentState bridge needed because these are server-side only (nothing crosses the server→WASM seam). Env gate is fail-safe closed: non-production robots.txt emits `Disallow: /` and the sitemap returns 404.
+  - **`DeepDrftPublic/Seo/RobotsTxt.cs`** (new): pure builder for the robots.txt body. Production: `Allow: /` + `Disallow: /FramePlayer` + `Disallow: /api/` + `Sitemap:` pointer. Non-production: `Disallow: /`.
+  - **`DeepDrftPublic/Seo/SitemapXml.cs`** (new): pure builder for the sitemap XML body. Walks `GET api/release` (server-to-server via the existing `"DeepDrft.API"` named client, paged) and emits a sitemaps.org `urlset`. Six explicit static roots (`/`, `/about`, `/cuts`, `/sessions`, `/mixes`, `/archive`) plus one `<url>` per release — `<loc>` = `SeoOptions.BaseUrl` + `ReleaseRoutes.DetailHref`, equal to the page's `SeoHead` canonical by construction; `<lastmod>` from `ReleaseDate`. Resilient: a partial/failed release read yields a well-formed roots-only document, never a 500.
+  - **`DeepDrftManager/wwwroot/robots.txt`** (new static file): `Disallow: /` with no environment gate — the CMS is always uncrawlable, including in production.
+  - **`DeepDrftManager/Components/App.razor`** (updated): blanket `<meta name="robots" content="noindex,nofollow">` in the CMS host `<head>` — defense in depth against de-indexing URLs discovered via external links, complementing the robots.txt directive.
+
+- **Design memo:** `product-notes/phase-23-seo-crawl-directives.md`.
+
+---
+
+## Phase 22 — SEO Metadata Component (landed 2026-06-23)
+
+**Landed:** 2026-06-23 on dev.
+
+- **What:** A parameterized, reusable SEO head component (`SeoHead.razor`) that emits the full modern-SEO head surface — standard meta, canonical, robots, Open Graph, Twitter Card, and schema.org JSON-LD — for every public page in one line of markup. **Public listener site only** (`DeepDrftPublic` host + `DeepDrftPublic.Client`); the CMS is explicitly out of scope. No data-model/schema change, no new API endpoint.
+
+- **Why:** `App.razor` had a static `<head>` with no description, canonical, OG, Twitter Card, or JSON-LD anywhere; pages set only an ad-hoc `<PageTitle>` with an inconsistent suffix. A shared `/mixes/{key}` link unfurled as a bare title + URL. Crawlers and social unfurlers saw nothing useful.
+
+- **Shape:**
+  - **`Controls/SeoHead.razor`** (new): purely presentational `<HeadContent>` + `<PageTitle>` emitter. Accepts a single `SeoModel` parameter; owns no data fetch. Each page wires it in one line.
+  - **`Common/SeoModel.cs`** (new): typed per-page input with named factories — `ForRelease(release, baseUrl, options)` (medium-dispatched), `ForHome`, `ForAbout`, `ForBrowse`, `ForNotFound`. Factories encode the medium→schema mapping in one place. Explicit `SeoModel.Robots` override available; default is environment-gated (see `SeoEnvironment`).
+  - **`Common/SeoJsonLd.cs`** (new): typed schema.org JSON-LD builders. Cut → `MusicAlbum` with ordered `MusicRecording` track list; Session → `MusicAlbum`/`LiveAlbum`; Mix → single `MusicRecording` with ISO-8601 duration; Home/About → `MusicGroup` (with `sameAs: ["https://instagram.com/deepdrft.music"]`); Browse → `CollectionPage`. `byArtist` wired per-release. JSON-LD body is inline-safe-escaped (`<`/`>`/`&` → `\uXXXX`) to prevent script-breakout from CMS-authored text.
+  - **`Common/SeoOptions.cs`** (new): site-wide config — `BaseUrl` (`https://deepdrft.com`), title suffix (`Deep DRFT`, middot separator), default OG image seam (uses `ImageProxyController` route), IG handle in `sameAs`, no Twitter handle. Registered via the static `Startup` seam (runs in both server and WASM `Program.cs`).
+  - **`Common/SeoUrls.cs`** (new): URL helpers for canonical and `og:image` construction from `SeoOptions.BaseUrl` (config, not `window.location` — no `window` at server prerender and the origin can't be derived behind the nginx proxy).
+  - **`Common/SeoEnvironment.cs`** (new): scoped `[PersistentState]` bridge seeded in `DeepDrftPublic/Components/App.razor` from `IWebHostEnvironment.IsProduction()` — mirrors the `DarkModeSettings` bridge. Default robots is `index,follow` only in Production; `noindex,nofollow` in every non-production environment so the beta/staging site stays uncrawled. Explicit per-page `SeoModel.Robots` overrides this default. Fail-safe default is `noindex`.
+  - **Wired into:** Home, About, Cut/Session/Mix detail pages (incl. their not-found branches → `noindex`), the browse views (Albums/Sessions/Mixes/Archive), and the 404 NotFound page.
+  - **Render-mode correctness:** `SeoHead` rides the existing `PersistentComponentState` bridge (the same `ReleaseDto` the detail pages already bridge) — no new fetch. The `InteractiveAuto` double-render produces identical head content across prerender and WASM passes (fed from bridged state, guarded on id/key equality).
+
+- **Design memo:** `product-notes/phase-22-seo-metadata-component.md`.
+
+---
+
+## Phase 20 — Theater Mode (landed 2026-06-20)
+
+**Landed:** 2026-06-20 on dev. Pending: final manual browser/GPU smoke-test on dev.
+
+- **What:** A presentation-only Theater Mode toggle on the three public Release Detail views (`CutDetail.razor`, `MixDetail.razor`, `SessionDetail.razor`). Toggling ON hides the release page content via `@if` so the lava-lamp + waveform visualizer fills the surface unobstructed; the player bar grows to surface the playing release's cover art, release title (linked), and a release-mode `SharePopover`. Toggling OFF restores the page byte-for-byte. The top action row (back link, lava-lamp popover, Theater toggle) stays visible in both states. Behavior is identical across all three mediums. Persists across SPA navigation within a session; resets to OFF on fresh page load.
+
+- **Why:** The visualizer is the site's most distinctive feature (Phases 10/12/15). Theater Mode makes it the *whole* thing on demand — a "lean back and watch the lamp" experience — and relocates the minimum release identity to the one piece of chrome that stays (the player bar), so nothing essential is lost.
+
+- **Shape:**
+  - **`Controls/TheaterModeToggle.razor`** (new): shared toggle button placed immediately left of the lava-lamp `WaveformVisualizerControlPopover` on all three detail pages inside a `.dd-detail-top-actions` cluster. Material `Theaters` glyph; `.dd-accent-icon` for green-accent in both themes. Visible only when `LavaEnabled || WaveformEnabled`; disabled until interactive. Flips `WaveformVisualizerControlState.TheaterMode` and calls `NotifyChanged()`. Subscribes to `State.Changed` for its own active-state re-render; disposes cleanly.
+  - **`Controls/AudioPlayerBar/NowShowingPanel.razor`** (new): presentational "now showing" band rendered by `AudioPlayerBar` only when `TheaterMode && CurrentTrack?.Release is not null`. Shows cover art (`deepdrft-track-detail-cover-art` / `deepdrft-gradient-soft-secondary` placeholder), release title link (`ReleaseRoutes.DetailHref`), and release-mode `SharePopover` in `.dd-accent-icon`. Layout CSS in `AudioPlayerBar.razor.css` (`.now-showing-*`); surface/text bind `--deepdrft-page-*` aliases — no new dark overrides.
+  - **`Services/WaveformVisualizerControlState.cs`** (widened): gained `TheaterMode` bool + `DefaultTheaterMode = false` const, and `CoerceTheaterMode()` — enforces the invariant that Theater Mode cannot remain on when both subsystems are off. Called from `WaveformVisualizerControls.ToggleLava`/`ToggleWaveform` before `NotifyChanged()` so all observers see a consistent coerced state in the same `Changed` cycle.
+  - **`Controls/AudioPlayerBar/AudioPlayerBar.razor` + `.razor.cs` + `.razor.css`**: subscribes to `WaveformVisualizerControlState.Changed`; mounts `<NowShowingPanel>` above transport controls when Theater is on and a release is playing.
+  - **Three detail pages** (`CutDetail.razor`, `MixDetail.razor`, `SessionDetail.razor`): page-level `@if (!VisualizerControlState.TheaterMode)` gates content regions on each page individually (not in `ReleaseDetailScaffold`, so Session — which does not use the scaffold — is covered identically). Each page's top action cluster hosts `<TheaterModeToggle />` in a `.dd-detail-top-actions` flex wrapper.
+  - **`deepdrft-styles.css`**: new `.dd-detail-top-actions` layout-only class (`display:flex; align-items:center; gap:0.25rem`) — no colour; shared by all three pages.
+  - **`DeepDrftTests/WaveformVisualizerControlStateTests.cs`** (new): unit tests for the `CoerceTheaterMode()` auto-exit invariant.
+
+- **Design memo:** `product-notes/phase-20-theater-mode.md`.
+
+### Phase 20 — Wave 2 — Theater Mode refinements (landed 2026-06-21)
+
+**Landed:** 2026-06-21 on dev.
+
+- **What:** Three refinements to the base Phase 20 feature. (1) **Full-screen detail body:** each detail page's foreground container gained `.dd-detail-fill` (`min-height: calc(100vh - var(--deepdrft-nav-height, 88px))`), so the visualizer reads as full-screen and the footer is pushed below the fold regardless of Theater Mode. (2) **Eased collapse (no pop):** the hard `@if` content-hide on the three detail pages was replaced by a `.dd-theater-collapsible` / `.dd-theater-collapsible-inner` wrapper pair that receives `.dd-theater-collapsed` when `IsContentHidden` is true — animates `grid-template-rows: 1fr → 0fr`, `opacity`, and `visibility` (deferred via `transition-behavior: allow-discrete`) so Theater ON/OFF eases rather than pops; `prefers-reduced-motion` collapses instantly. The same wrapper pattern drives the player-bar `NowShowingPanel`, which is now kept mounted whenever a release is playing and collapsed (not `@if`-removed) when Theater is OFF — enabling the ease-in when Theater turns ON (resolves OQ2 design intent for a mounted-but-dormant panel). (3) **Playing-release scoping:** Theater Mode now only applies to the currently-playing release. `ReleaseDetailBase` and `CutDetailBase` each gained a cascaded `IStreamingPlayerService PlayerService`, a reference-guarded `StateChanged` subscription (disposed in `Dispose`), and three predicates: `IsThisReleasePlaying` (`CurrentTrack?.Release?.EntryKey == EntryKey`), `IsContentHidden` (`TheaterMode && IsThisReleasePlaying`), `ShowTheaterToggle` (`(LavaEnabled || WaveformEnabled) && IsThisReleasePlaying`). `TheaterModeToggle.razor` gained an `Available` parameter (default `true`) folded into its render gate; all three pages pass `Available="ShowTheaterToggle"`. A detail page whose release is not playing shows no toggle and ignores the global `TheaterMode` flag.
+
+---
+
+## Phase 18 — Theme / Dark-Mode Remediation (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev (Wave 1 + Wave 2 + Wave 3).
+
+- **What:** A DRY token pass resolving six theming symptoms (five in dark mode, one in light) that all traced to three root causes: neutral page surfaces bound to constant brand tokens, the play chip bound to a constant light-grey, and no theme-aware popover-surface token. Resolved as one coherent pass via a shared token layer rather than per-component patches.
+
+- **Why:** Symptom consolidation and root-cause analysis showed all six symptoms shared the same underlying structure — component CSS bypassing the theme-aware alias layer and binding constant source tokens directly. A single additive token pass in `deepdrft-tokens.css` plus targeted re-pointing of consumers fixes all six without scattering dark-mode rules.
+
+- **Shape:**
+  - **Token foundation (`deepdrft-tokens.css`):** Three new theme-aware token families added to `DeepDrftShared.Client/wwwroot/styles/deepdrft-tokens.css`, each defined in both `:root` (light) and `.deepdrft-theme-dark` (dark):
+    - `--deepdrft-page-surface` / `--deepdrft-page-text` / `--deepdrft-page-text-muted` — neutral page surface family. Light: `--deepdrft-white` / `--deepdrft-navy` / `--deepdrft-muted`. Dark: `var(--mud-palette-background)` (#0D1B2A, the true page ground) / `--deepdrft-white` / `color-mix(muted 70%, white)` — neutral sections dissolve into the site background as one continuous dark field rather than reading as raised panels.
+    - `--deepdrft-play-chip` / `--deepdrft-play-glyph` / `--deepdrft-play-chip-soft` — play-chip family. Light: soft-grey chip (matching prior `--deepdrft-soft`). Dark: `--deepdrft-green-accent` chip + `--deepdrft-navy` glyph (navy-on-green for solid chips); `--deepdrft-play-chip-soft` is `color-mix(green-accent 30%, transparent)` (the player-bar translucent override).
+    - `--deepdrft-popover-surface` — popover surface. Light: `color-mix(navy 8%, white)` soft desaturated-navy wash. Dark: `#162437` (pixel-identical to `DeepDrftPalettes.Dark.Surface` — dark popovers unchanged, only light is retoned).
+  - **Neutral-surface inversion (T2):** `Home.razor.css`, `About.razor.css`, `DeepDrftFooter.razor.css` re-pointed from constant `--deepdrft-white`/`--deepdrft-navy` to `--deepdrft-page-surface`/`--deepdrft-page-text`. Decorative navy/green sections (`.section-dark`, `.split-left`, `.cta-banner`, hero overlays) untouched — classification encoded in which token each section binds.
+  - **Play-chip theming (T3):** `PlayStateIcon.razor.css` `.icon-container` re-pointed to `--deepdrft-play-chip`; glyph to `--deepdrft-play-glyph`. Player-bar context overrides chip to `--deepdrft-play-chip-soft` (translucent green wash). Light-mode parity and connect-option hover also corrected.
+  - **Popover surface (T4):** `deepdrft-styles.css` binds `--deepdrft-popover-surface` to the MudBlazor default popover surface. Bespoke dark-glass panels (`--deepdrft-panel-ground`) untouched.
+  - **Wave 2 refinements (on top of T1–T4):** App bar background moved to navy (`#112338`) from near-black (`#0D1B2A`). Neutral page surfaces re-pointed to `var(--mud-palette-background)` (`#0D1B2A`) as the true dark ground — sections dissolve into the body background rather than reading as navy-mid raised panels (resolves Wave 1's open question in favour of ground). Dark-mode hero legibility (superseded in Wave 3 — see below). Play-glyph settled on navy-on-green (solid chips) and green-on-green (player bar, via `--deepdrft-play-chip-soft`).
+  - **Wave 3 — hero dark-mode legibility fix:** `DeepDrftHero.razor.css` hero text re-worked to bind theme-aware tokens directly in the base rules rather than via `:global(.deepdrft-theme-dark)` overrides (matching the About page's proven pattern). `.hero-title` and `.hero-desc` now bind `--deepdrft-page-text` directly; `.hero-subtitle` (previously bound to the constant `--deepdrft-muted`) now binds `--deepdrft-page-text-muted`, making it theme-aware for the first time. Only `.hero-title em` retains an explicit dark override (`:global(.deepdrft-theme-dark) .hero-title em` → `--deepdrft-green-accent`, lifting the low-contrast `--deepdrft-green` on the dark ground). Global hero-button dark treatment added to `deepdrft-styles.css`: `.deepdrft-theme-dark .btn-primary` → `--deepdrft-green-accent` fill + `--deepdrft-navy` text (hover: `--deepdrft-green-interactive`); `.deepdrft-theme-dark .btn-ghost` → `--deepdrft-page-text` color + `--deepdrft-border-light` border.
+  - **Open questions resolved:** Dark neutral surface = ground (continuous field, `--mud-palette-background`) — not elevated navy-mid. Popover target: `color-mix(navy 8%, white)` in light; dark binds `#162437` (MudBlazor dark Surface) unchanged.
+
+- **Design memo:** `product-notes/theme-dark-mode-remediation.md`.
+
+### Phase 18 — Wave 4 — Popover-surface retune + portaled-popover body-class bridge (landed 2026-06-20)
+
+**Landed:** 2026-06-20 on dev.
+
+- **What:** Follow-on retune of `--deepdrft-popover-surface` values and a root-cause fix for portaled MudBlazor popovers that were never reaching the dark token.
+
+- **Why:** Wave 1–3 shipped `--deepdrft-popover-surface` light at `color-mix(navy 8%, white)` (too saturated — read as a grey slab) and dark at flat `#162437`. More importantly, MudBlazor popovers portal to `<body>`, outside the `.deepdrft-theme-dark` wrapper `<div>`, so the dark token never applied to them at all. Both needed fixing as a pair.
+
+- **Shape:**
+  - **Token retune (`deepdrft-tokens.css`):** Light value changed from 8% → 4% navy mix (near-page-background, clearly light). Dark value changed from `#162437` to `color-mix(in srgb, var(--deepdrft-navy-mid) 80%, var(--deepdrft-green-accent) 20%)` — a bluer navy with a slight green accent. Dark value hoisted into a new source token `--deepdrft-popover-surface-dark` (defined once in `:root`), referenced by both the `.deepdrft-theme-dark` wrapper block and a new `body.deepdrft-theme-dark` block so portaled content is reached from either selector.
+  - **Portaled-popover body-class bridge (`MainLayout.razor` + new TS module):** `MainLayout.razor` now stamps/removes `deepdrft-theme-dark` on `<body>` after each render via a new `DeepDrftShared.Client/Interop/theme/theme.ts` module exporting `setBodyThemeClass(isDark: boolean)`. Lazy-imported as `_content/DeepDrftShared.Client/js/theme/theme.js`. Call is gated to fire only on first render or when `_isDarkMode` changes (`_lastAppliedDarkMode` comparison) — no redundant JS calls on unrelated re-renders. `IJSObjectReference _themeModule` is disposed in `DisposeAsync` to clean up the module reference when the circuit tears down.
+
+### Phase 18 — Wave 5 — Glass-panel theme-aware token family (landed 2026-06-20)
+
+**Landed:** 2026-06-20 on dev.
+
+- **What:** The three `MudOverlay`-based glass panels — the queue panel (`.deepdrft-queue-modal`), the waveform visualizer control deck, and the privacy modal — now render as a light translucent glass with legible dark text in light theme, while remaining the existing dark-glass charcoal in dark theme. Dark mode is visually unchanged; a latent white-on-light bug in the inline embed queue row was incidentally fixed by the token flip.
+
+- **Why:** Prior to this wave, all three panels were bound to the constant `--deepdrft-panel-ground` token, exempting them from the theme-aware alias layer established in Waves 1–3. In light theme this produced white text on a near-white glass surface — unreadable. The panels needed their own theme-aware family (separate from `--deepdrft-popover-surface`, which targets MudBlazor default popovers) and the same `body.deepdrft-theme-dark` portal-scope treatment introduced for popovers in Wave 4.
+
+- **Shape:**
+  - **New token family (`deepdrft-tokens.css`):** `--deepdrft-panel-surface` / `--deepdrft-panel-text` / `--deepdrft-panel-text-muted` / `--deepdrft-panel-border` / `--deepdrft-panel-row-hover` — each defined in `:root` (light values: translucent glass with dark text), `.deepdrft-theme-dark` (dark-glass charcoal with light text, sourced from the existing `--deepdrft-panel-ground` constant), and `body.deepdrft-theme-dark` (same dark values re-declared so the tokens resolve correctly when the panels portal to `<body>` via `MudOverlay`).
+  - **Consumer re-pointing:** The three panels and their descendants (queue rows, visualizer deck, privacy modal) previously bound `--deepdrft-panel-ground` directly; they are now re-pointed to the appropriate `--deepdrft-panel-surface`/`-text`/`-text-muted`/`-border`/`-row-hover` aliases.
+  - **Exemption lifted:** This deliberately removes the previously-documented exemption of these panels from the theme-aware layer. `--deepdrft-panel-ground` is now consumed only as the dark-theme value of `--deepdrft-panel-surface`, not directly by any component CSS.
+
+---
+
+## Phase 17 — Player-Bar Queue View: Wave 17.3 — Fixed embed panel + iframe resize (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The Fixed (embed) mode queue panel and the OQ1 Option-A iframe resize handshake. Release embeds now render an always-shown, read-only queue panel below the player-bar controls; the Queue button collapses/expands that panel and posts the iframe's new height to the host page so the outer `<iframe>` element resizes to match. Single-track embeds (TrackEntryKey mode) have no queue, no panel, and no Queue button — unchanged compact behaviour. Phase 17 is now complete (all four waves landed).
+
+- **Why:** Phase 11 wave 11.F armed release embeds with a queue (skip navigation, auto-advance), but the viewer had no way to see or jump within the queue. Wave 17.3 surfaces it in Fixed mode — read-only because a shared embed is not an editable playlist — and resolves OQ1 (Option A confirmed feasible: `postMessage` resize degrades gracefully if the host strips the script).
+
+- **Shape:**
+  - **Fixed embed queue panel** (`AudioPlayerBar.razor`): rendered conditionally on `ShowFixedPanel && _fixedPanelOpen` inside `.deepdrft-queue-embed-panel`; hosts `<QueueList Items="QueueItems" CurrentIndex="QueueCurrentIndex" Editable="false" OnJump="@OnQueueJump" />`. Read-only: no drag handles, no remove buttons. Row-jump (OQ2) calls `PlayRelease(Items, index)` — coherent from the armed-but-not-started state (`PlayRelease` already clears `IsArmed` and materializes a defensive copy).
+  - **Queue button in Fixed mode** (`PlayerTransportZone`): toggles `_fixedPanelOpen`; triggers a height post after the panel renders. Gated on `ShowFixedPanel` so single-track embeds see no button.
+  - **`EmbedSnippetBuilder.cs`** (`DeepDrftPublic.Client/Helpers/EmbedSnippetBuilder.cs`): `ForRelease` now mints a per-snippet random token (8 hex chars from `Guid.NewGuid().ToString("N")[..8]`). Token is used as the iframe id (`deepdrft-embed-{token}`) and threaded into the iframe src as `&EmbedId={token}`. Taller iframe height (release: 384 px vs. track: 196 px). Carries a host-side `<script>` listener that matches incoming `{type:"deepdrft-embed-resize", embedId}` messages against the snippet's own token and sets `iframe.style.height` — multiple release embeds on one host page resize independently (no cross-talk). Degrades to Option B if the host strips the script (panel still works inside the iframe at expanded height). `ForTrack` is unchanged (compact height 196 px, no script, no id token).
+  - **`embed-frame.ts`** (`DeepDrftPublic/Interop/embed/embed-frame.ts`; compiled output gitignored): new TypeScript interop module. Reads `EmbedId` from `window.location.search` once at module load; exports `postHeight(element: HTMLElement)` — measures the player element's rendered height (`Math.ceil(getBoundingClientRect().height) + 2`), builds `{type:"deepdrft-embed-resize", height, embedId?}` payload (omits `embedId` when absent for backward-compatible degradation), and calls `window.parent.postMessage(payload, "*")`. No-ops when not framed (`window.parent === window`) or the element is unmeasurable.
+  - **CSS** (`DeepDrftPublic/wwwroot/styles/deepdrft-styles.css`): new `deepdrft-queue-embed-panel` and related `deepdrft-` embed-panel classes for the fixed queue panel chrome.
+  - **Tests** (`EmbedSnippetBuilderTests`): height divergence (ForRelease taller than ForTrack), ForTrack-unchanged (height 196, no script), id uniqueness (two ForRelease calls yield distinct ids), id/script-token consistency (iframe id matches token in script), EmbedId-in-src (token appears as `EmbedId=` in the iframe src).
+
+---
+
+## Phase 17 — Player-Bar Queue View: Wave 17.4 — Add-to-Queue affordance (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The append-only Add-to-Queue affordance on detail pages — a new shared `AddToQueueButton.razor` control wired at every detail-page play site, enabling listeners to add a release or individual track to the queue without interrupting the current track. `ReleaseGallery` browse-grid cards are intentionally excluded (OQ10, deferred).
+
+- **Why:** Phase 11 wave 11.F built the `Enqueue`/`EnqueueRange` append path in the queue engine but gave it no UI entry point. Wave 17.4 lights that dormant path, completing the Add-to-Queue capability Daniel stated as commitment 4 of Phase 17. It was split from 17.2 because it depends only on the existing engine append members (not on 17.1's new `Move`/`RemoveAt`), allowing it to land in parallel.
+
+- **Shape:**
+  - **`AddToQueueButton.razor`** (`DeepDrftPublic.Client/Controls/AddToQueueButton.razor`): shared append-only button with two modes: track mode (`Enqueue` — called with a single `TrackDto`) and release mode (`EnqueueRange` — called with an ordered `IReadOnlyList<TrackDto>`). Material `PlaylistAdd` glyph; tooltip reads "Add to queue" (track mode) or "Add release to queue" (release mode). Reads the cascaded `IQueueService`; disabled until interactive / when the cascade is absent; append-only — does not play, does not navigate.
+  - **`CutDetail.razor`** (header): release-mode `AddToQueueButton` beside the header play affordance, passing the `TrackNumber`-ordered track list.
+  - **`CutDetail.razor`** (track rows): track-mode `AddToQueueButton` beside the per-row play affordance.
+  - **`SessionDetail.razor`** (hero play): track-mode `AddToQueueButton` beside the Session hero play button.
+  - **`MixDetail.razor`** (hero play): track-mode `AddToQueueButton` beside the Mix hero play button.
+  - **Excluded sites:** `StreamNowButton` (no fixed track to resolve — OQ9) and `ReleaseGallery` cards (no play button today — OQ10, deferred to `TODO.md`).
+
+---
+
+## Phase 17 — Player-Bar Queue View: Wave 17.2 — Docked queue overlay (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The editable docked-player queue overlay — a Queue toggle button in the non-Fixed (docked) player bar and a new `QueueOverlay.razor` modal that hosts the shared `QueueList` in editable mode. Listeners can now see, reorder, remove from, and jump within the queue while a release is playing. Also fixed a pre-existing `QueueChanged` unsubscribe leak in `AudioPlayerBar.DisposeAsync`, hardened `PlayRelease` with a defensive copy, and styled the global `deepdrft-queue-*` CSS classes for the first time (first styling for the `QueueList` classes that 17.1 shipped unstyled).
+
+- **Why:** Phase 11 built the queue engine and Phase 17 wave 17.1 built the shared `QueueList` component, but neither surfaced the queue visually in the docked player. Wave 17.2 delivers Daniel's commitment 2 — a visible, editable queue panel in the non-Fixed player bar.
+
+- **Shape:**
+  - **Queue toggle button** (`AudioPlayerBar` / `PlayerTransportZone`): shown only when `!Fixed && Items.Count > 0`, placed below the transport-button row and left of the timestamp. Material `QueueMusic` glyph; renders in an active/highlighted state when the overlay is open.
+  - **`QueueOverlay.razor`** (`DeepDrftPublic.Client/Controls/QueueOverlay.razor`): screen-centered tinted modal borrowing the `WaveformVisualizerControlPopover` `MudOverlay` idiom (`DarkBackground="true"`, `Modal="true"`). Panel stops click propagation; scrim-click closes the overlay (drag-safe: capture div sits above the scrim during a drag so releasing outside the panel never fires the close handler). Auto-closes if a removal empties the queue. Hosts `QueueList` in `Editable="true"` mode.
+  - **`AudioPlayerBar` wiring**: reorder → `Move(fromIndex, toIndex)`; remove → `RemoveAt(index)` (auto-closes overlay when queue empties); row-jump → `PlayRelease(Items, index)`; Clear header action → new `ClearUpcoming()`. Fixed pre-existing `QueueChanged` unsubscribe leak in `DisposeAsync`.
+  - **`QueueList.razor` — current-row remove suppression**: the remove (×) control is now hidden on the currently-playing row (`Editable && !isCurrent`), enforcing OQ3's "the current track cannot be removed" rule in the UI. Reorder of the current row is still permitted.
+  - **Engine — `ClearUpcoming()`** (`IQueueService` / `QueueService`): new additive member. Removes all queued items except the currently-playing one, leaving it as the sole item at `CurrentIndex == 0`; re-emits `QueueChanged`; touches no playback. Satisfies OQ5's requirement that Clear does not stop or remove the current track.
+  - **Engine — `PlayRelease` defensive copy**: `PlayRelease` now always materializes a defensive copy of its input list (`tracks.ToList()`) so it can never alias the caller's `Items` list — fixes a row-jump bug where jumping via `PlayRelease(Items, index)` could mutate the live `Items` reference mid-operation.
+  - **CSS — `deepdrft-queue-*` classes** (`DeepDrftPublic/wwwroot/styles/deepdrft-styles.css`): overlay/list chrome classes added to the global stylesheet (portaled overlay content cannot use scoped CSS). This is also the first styling pass for the `QueueList` classes 17.1 introduced without accompanying styles.
+
+---
+
+## Phase 17 — Player-Bar Queue View: Wave 17.1 — Engine additions + shared QueueList (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The queue-engine additions and the shared presentational list component that waves 17.2 and 17.3 will consume. No player-bar wiring, overlay, embed, or Add-to-Queue affordance landed — those remain in waves 17.2 and 17.3.
+
+- **Why:** Wave 17.1 is the cold-start prerequisite for the full Phase 17 queue-view surface. The engine additions are interop-free state mutations that land without any UI decision being made; `QueueList` is the single presentational "view" both the docked overlay and the embedded panel will share (one source, multiple views), so it is cleanest to build and test it before the hosting contexts exist.
+
+- **Shape:**
+  - **Engine — `Move(int fromIndex, int toIndex)`** (`IQueueService` / `QueueService`): reorders `Items` in-place, adjusts `CurrentIndex` so the same track stays current across the move, re-emits `QueueChanged`. Never re-streams or interrupts the playing track. No-op (no `QueueChanged`) when either index is out of range or the indices are equal. Interop-free; safe during prerender.
+  - **Engine — `RemoveAt(int index)`** (`IQueueService` / `QueueService`): removes the item at `index`, adjusts `CurrentIndex` (a track before current decrements the index; a track after current leaves it unchanged; removing the current track does not stop playback — the track runs to natural end while `CurrentIndex` resolves to the new slot occupant; removing the last remaining item leaves the queue empty and dormant with `CurrentIndex == -1`). Re-emits `QueueChanged`. No-op when `index` is out of range. Interop-free; safe during prerender.
+  - **Engine — dormant-`Enqueue` coherence (OQ8):** `Enqueue` and `EnqueueRange` into an empty/dormant queue (`CurrentIndex == -1`) now set `CurrentIndex` to 0 so a subsequent play/skip is correct. Does **not** auto-play — add is not play. `PlayCurrent` is never called from these paths; the methods remain interop-free.
+  - **`QueueList.razor`** (`DeepDrftPublic.Client/Controls/QueueList.razor`): purely presentational component. Renders `Items` as an ordered list with the current track marked (position number + `GraphicEq` now-playing icon on the current row). `Editable` flag gates drag-reorder handles and per-row remove controls: when `true`, wraps rows in a `MudDropContainer`/`MudDropZone` for reorder; when `false`, renders a plain `<div>` (read-only; the embed's fixed-order shared queue). Reorder, remove, and row-jump are surfaced to the parent as `EventCallback<(int FromIndex, int ToIndex)> OnReorder`, `EventCallback<int> OnRemove`, and `EventCallback<int> OnJump` respectively — the component calls no `IQueueService` method itself. Owns no data fetch or player wiring. Runs during prerender without JS interop (drag work is client-only and inert when no drag occurs).
+  - **`QueueServiceTests`**: T1–T10 added, covering `Move` (in-range, out-of-range, same-index no-ops; current-track identity preserved across reorders) and `RemoveAt` (before/after/at current; last-item dormant; out-of-range no-op; playback not stopped).
+
+---
+
+## Phase 16 — Anonymous Play & Share Tracking: Wave 16.5 — Home Plays-card capstone (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The capstone wave — the live home hero Plays card and the `HomeStatsDto` extension that powers it. `NowPlayingStats.razor`'s third card, previously a static "XXX / Plays (Coming Soon)" odometer placeholder, now renders the live `TotalPlays` figure in the existing odometer treatment with a secondary "N listeners" line (`UniqueListeners`). No new fetch path, no new client service, no migration — the card consumes the same `HomeStatsDto` round-trip the other two cards already use. Privacy footer line (`DeepDrftFooter.razor`, `.deepdrft-footer-privacy`) also landed as part of the same merge: a quiet fine-print disclosure of the anonymous `anonId` token, using the Variant 1 approved copy from `product-notes/phase-16-privacy-note.md`.
+
+- **Why:** The Plays card was deliberately held as the final wave (sequenced bottom-up per Daniel's directive) so the substrate (16.1 capture + rollup, 16.2 bucket/channel, 16.3 anonId + distinct-listener aggregation) would be solid before any read surface appeared. Wave 16.4 (per-target / CMS stats views) was speculative and skipped; the event log supports it later if wanted. With 16.5 landing, Phase 16 is complete.
+
+- **Shape:**
+  - **`HomeStatsDto` extended** (`DeepDrftModels/DTOs/HomeStatsDto.cs`): two new fields — `TotalPlays` (`long`; site-wide sum of every `play_counter` row's `PartialCount + SampledCount + CompleteCount`, all-time; zero until the telemetry migration is applied — expected, not an error) and `UniqueListeners` (`int`; distinct non-null `anon_id` across all play events, all-time; over-counts by design, honestly labelled "listeners"). No other DTO changes.
+  - **`StatsController` composition** (`DeepDrftAPI/Controllers/StatsController.cs`): now injects `ITrackService` (existing) **and** `IEventService` (Phase 16 event domain). `GetHome` assembles `HomeStatsDto` in two sequential best-effort reads: track-domain aggregation via `ITrackService.GetHomeStats` (existing; failure returns 500 as before); play/listener figures via `IEventService.GetTotalPlayCount` and `IEventService.GetDistinctListenerCount` (Phase 16; a telemetry failure or not-yet-applied migration leaves them at 0 rather than 500-ing the whole endpoint). Neither domain reaches into the other's tables; the controller is the composition seam only.
+  - **`IEventService` additions** (`DeepDrftData/IEventService.cs`): `GetTotalPlayCount(ct)` → `ResultContainer<long>` and `GetDistinctListenerCount(ct)` → `ResultContainer<int>` (wave 16.3 added the distinct-listener overloads; `GetTotalPlayCount` is the one new member for 16.5).
+  - **`EventRepository.CountTotalPlaysAsync`** (`DeepDrftData/Repositories/EventRepository.cs`): sums `PartialCount + SampledCount + CompleteCount` directly over `PlayCounters` via LINQ — **not** `PlayCounter.TotalPlays` (which is an EF-ignored computed property and not translatable). An empty counter table sums to 0.
+  - **`NowPlayingStats.razor`** (`DeepDrftPublic.Client/Controls/NowPlayingStats.razor`): third card now renders `@_stats.TotalPlays` in `.hero-stat-odometer` and `@_stats.UniqueListeners listeners` as `.hero-stat-sub`. No change to the `PersistentComponentState` bridge or `IStatsDataService` fetch path — the DTO fields arrive in the same existing round-trip.
+  - **`DeepDrftFooter.razor`** (`DeepDrftPublic.Client/Layout/DeepDrftFooter.razor`): privacy disclosure paragraph (`.deepdrft-footer-privacy`) added: "We keep a random tag in your browser so we can count how many people a track reaches — not who they are. No account, no name, nothing personal, nothing shared with anyone else. Clear your browser data and the tag's gone."
+  - **No migration.** The `play_counter` rollup table was created by `20260619155610_AddPlayShareTelemetry` (wave 16.1; authored, not yet applied — Daniel-gated). The `CountTotalPlaysAsync` query returns 0 gracefully until that migration runs.
+
+---
+
+## Phase 16 — Anonymous Play & Share Tracking: Wave 16.1 — Foundation (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev.
+
+- **What:** The anonymous telemetry **substrate** — foundation end-to-end with nothing reading it yet. No `anonId` written; no home-card/read surface changed (those are waves 16.3 and 16.5). The full capture-and-storage pipeline is in place: client-side play-session tracker and share tracker, `sendBeacon` transport with page-unload handler, proxied and rate-limited intake endpoints, append-only SQL event log with incremental rollup, and server-side release attribution.
+
+- **Why:** The home hero's Plays stat card (`NowPlayingStats.razor`'s third card) has been a static "XXX / Plays (Coming Soon)" placeholder. Phase 16 builds the anonymous, privacy-light substrate that will eventually power it. Wave 16.1 is the cold-start foundation — nothing reads the log yet; correctness and storage are the deliverable, not the visible metric.
+
+- **Shape:**
+  - **Client — `PlayTracker`** (`DeepDrftPublic.Client/Services/PlayTracker.cs`): opens a play session on playback start, advances a high-water position on each progress tick (instrumented at `StreamingAudioPlayerService`, not at the HTTP layer, so seek-beyond-buffer re-fetches count as the same play), closes on track-switch / stop / organic-end / page-unload. Engagement floor: ≥3s OR ≥5% of duration (whichever is smaller). Three-bucket classification: `partial` < 30%, `sampled` 30–80%, `complete` > 80%. Emits at most one event per session via `IPlayEventSink`. Deliberately free of player, HTTP, and JS dependencies for testability.
+  - **Client — `ShareTracker`** (`DeepDrftPublic.Client/Services/ShareTracker.cs`): called by `SharePopover` after a successful clipboard write; applies a 60-second per-(target, channel) debounce so repeated copies of the same link in a session count as one share. Sends via `sendBeacon`. No `anonId` in wave 16.1.
+  - **Client — `BeaconInterop`** (`DeepDrftPublic.Client/Services/BeaconInterop.cs`): `navigator.sendBeacon` JS interop wrapper + page-unload handler that flushes any pending play event when the page is torn down.
+  - **Public proxy — `EventProxyController`** (`DeepDrftPublic/Controllers/EventProxyController.cs`): proxies `POST api/event/play` and `POST api/event/share` to DeepDrftAPI. Buffers and relays the small JSON body verbatim; forwards `X-Forwarded-For` for per-IP rate limiting on the API side. Opts out of antiforgery (`[IgnoreAntiforgeryToken]`) — `sendBeacon` cannot attach tokens.
+  - **API — `EventController`** (`DeepDrftAPI/Controllers/EventController.cs`): `POST api/event/play` and `POST api/event/share`, unauthenticated, rate-limited by the `"events"` fixed-window policy (30 requests / 60 s per IP, registered in `Program.cs`). Returns `202 Accepted` (fire-and-forget contract). Payload-validates the track key and enum values; delegates writes to `IEventService`.
+  - **API — rate limiter** (`DeepDrftAPI/Program.cs`): `AddRateLimiter` + `"events"` fixed-window policy keyed on `Connection.RemoteIpAddress`; `UseForwardedHeaders` in production resolves the XFF chain into the real client IP. `UseRateLimiter()` added to the middleware pipeline.
+  - **Data — `EventRepository`** (`DeepDrftData/Repositories/EventRepository.cs`): append-only writes to `play_event` and `share_event` tables; incremental-on-write bump of the `play_counter` rollup (D6); server-side track→release resolution at write time (D4) — the client sends only the track `EntryKey`, the repository stamps the release id.
+  - **Data — `EventManager` / `IEventService`** (`DeepDrftData/EventManager.cs`): `IEventService` boundary (`RecordPlay`, `RecordShare`); `EventManager` wraps `EventRepository` and returns NetBlocks `Result`. Registered scoped in `DeepDrftAPI/Program.cs` alongside the existing track and release domain services.
+  - **Migration `20260619155610_AddPlayShareTelemetry`**: adds `play_event`, `share_event`, and `play_counter` tables. **Authored but not yet applied** (Daniel-gated).
+
+---
+
+## Phase 16 — Anonymous Play & Share Tracking: Wave 16.3 — Unique-listener `anonId` layer (landed 2026-06-19)
+
+**Landed:** 2026-06-19 on dev (merge `297805b`). No migration — `anon_id varchar(64)` columns and `IX_play_event_anon_id`/`IX_share_event_anon_id` indexes already shipped in the wave 16.1 migration.
+
+- **What:** The unique-listener `anonId` seam end-to-end — the "last metric layer" of the Phase 16 substrate. Client mints a first-party `localStorage` GUID on first visit, threads it onto play and share beacon payloads (omitted when null), server accepts and length-clamps it (reject-not-truncate, ≤64 chars), persists it to the reserved nullable `anon_id` columns, and exposes all-time distinct-listener aggregation. The distinct-count capability is in place but not yet surfaced on any read surface (16.5 consumes it). Privacy-notice copy deliberately not authored (Daniel-gated).
+
+- **Why:** The anonymous unique-listener metric (D5 / D3) is the final substrate wave before the home Plays card can be lit (16.5). It was sequenced last of the metric layers because it is the lowest-priority metric and carries no dependency — the event log captures `anon_id` on the same rows 16.1 already writes; 16.3 simply lights the seam that was reserved but unused.
+
+- **Shape:**
+  - **Client — `IAnonIdProvider` / `AnonIdProvider`** (`DeepDrftPublic.Client/Services/IAnonIdProvider.cs`, `AnonIdProvider.cs`): `IAnonIdProvider` exposes `string? Current` (synchronous cached read, safe on the unload path) and `ValueTask EnsureLoadedAsync()` (warms the cache from `localStorage` via JS interop — idempotent, best-effort, never throws). `AnonIdProvider` is the production implementation over the `window.DeepDrftAnonId.get` interop call. Degrades to null when `localStorage` is unavailable (private mode / blocked / partitioned iframe) — missing id is the accepted graceful path; over-counting is the direction of error (§3). Scoped (per-session cache); the token itself outlives the session in `localStorage`.
+  - **Client — TypeScript interop** (`DeepDrftPublic/Interop/telemetry/anonid.ts`): mints and reads the `localStorage` GUID. Exposes `window.DeepDrftAnonId.get`. Returns null without throwing when storage is unavailable.
+  - **Client — `BeaconPlayEventSink`** (`DeepDrftPublic.Client/Services/BeaconPlayEventSink.cs`): now injects `IAnonIdProvider`; reads `_anonId.Current` synchronously at emit time and sets `PlayEventDto.AnonId`. Null id produces an anonId-less payload (the field is omitted from the wire JSON entirely via `WhenWritingNull` — the API treats absent and null identically).
+  - **Client — `ShareTracker`** (`DeepDrftPublic.Client/Services/ShareTracker.cs`): now injects `IAnonIdProvider`; reads `_anonId.Current` at share time and sets `ShareEventDto.AnonId`. Same null-omit posture as the play sink.
+  - **API — `EventController`** (`DeepDrftAPI/Controllers/EventController.cs`): `TryNormalizeAnonId` helper on both `POST api/event/play` and `POST api/event/share` — whitespace-only / empty / null collapses to null (valid anonId-less event); a token longer than 64 chars is rejected with `400 Bad Request` rather than truncated (truncation would collide distinct listeners onto one prefix); valid tokens are trimmed and passed through.
+  - **Data — `EventRepository`** (`DeepDrftData/Repositories/EventRepository.cs`): three new distinct-count queries (already in the repository as of 16.3): `CountDistinctListenersAsync()` (site-wide, nulls excluded), `CountDistinctListenersForTrackAsync(trackEntryKey)` (per-track), `CountDistinctListenersForReleaseAsync(releaseId)` (per-release, uses the stamped `release_id` on the play event row — D4 attribution).
+  - **Data — `IEventService` / `EventManager`** (`DeepDrftData/EventManager.cs`): three new members exposing the distinct-count capability: `GetDistinctListenerCount()`, `GetDistinctListenerCountForTrack(trackEntryKey)`, `GetDistinctListenerCountForRelease(releaseId)` — each returns `ResultContainer<int>`. No read surface or card consumes them yet (16.5).
+  - **No migration** — the `anon_id varchar(64)` columns on `play_event` and `share_event` and their covering indexes (`IX_play_event_anon_id`, `IX_share_event_anon_id`) were already created by `20260619155610_AddPlayShareTelemetry` (wave 16.1). Wave 16.3 only wires the client seam and adds the server-side aggregation queries.
+
+---
+
+## Phase 16 — Anonymous Play & Share Tracking: Wave 16.2 — Completion-bucket classification + shares (landed by absorption into 16.1)
+
+**Landed:** absorbed into wave 16.1 (2026-06-19). All §4.1 deliverables shipped inside the foundation wave.
+
+- **What:** Three-bucket completion classification correct and exhaustive end to end, and share-channel split. Because these were structurally inseparable from the foundation (the tracker, payload, log table, and rollup all required the bucket column set from day one), they landed together with 16.1 rather than as a follow-on wave.
+
+- **Why:** The §4.2 spec listed bucket classification and share-channel split as wave 16.2 items, but the implementation showed they could not be cleanly deferred — the `play_counter` rollup columns are per-bucket by design (D6), and the share `channel` discriminator is a single non-null column on the `share_event` table. Building the log without them would have required a migration to add them in 16.2 anyway.
+
+- **Shape:**
+  - **`PlayBucket` enum** (`DeepDrftModels.Enums`): `Partial` (< 30%), `Sampled` (30–80%), `Complete` (> 80%) — exhaustive, non-overlapping. D1 resolved.
+  - **`PlayCounter` rollup columns** (`DeepDrftModels.Entities.PlayCounter`): `PartialCount`, `SampledCount`, `CompleteCount` (each `long`), `TotalPlays` (computed `long` sum). `BumpCounterAsync` in `EventRepository` switches on the bucket to increment the correct column in the same transaction as the event append.
+  - **API-boundary bucket validation** (`EventController`): `Enum.IsDefined(payload.Bucket)` guard — an undefined bucket value returns `400 Bad Request` before the write reaches the repository.
+  - **`ShareChannel` enum** (`DeepDrftModels.Enums`): `Link` / `Embed` on `ShareEvent.Channel`. `ShareTracker` passes the channel through from the `SharePopover` clipboard action; `EventController` validates it is a defined `ShareChannel` value.
+  - **Deferred:** optional `share_count` rollup column on `play_counter` (per-track share count in the rollup table) — not built. Shares are not on the home-card hot path; per-target share reads are speculative wave 16.4 work.
+
+---
+
+## Home Hero Stats — Live data wiring (landed 2026-06-18)
+
+**Landed:** 2026-06-18 on dev (commits `5f0422a` + `8fa330f`, merged `e9e6b60`).
+
+- **What:** Replaced the hard-coded placeholder figures in the public home hero stat row (`NowPlayingStats`) with real SQL-backed aggregates. Resolves the "Real stat-row numbers" deferred item from Phase 0 §0.3.
+
+- **Why:** The stat row ("47+ / 2 / ∞") was intentionally hard-coded at Phase 0 with a TODO; the data model now has enough shape (releases, medium discriminator, track–release join) to serve real numbers in a single efficient query.
+
+- **Shape:**
+  - **New SQL column:** `DurationSeconds` (`double?`, column `duration_seconds`) on `TrackEntity` and `TrackDto`. Populated at upload via the existing dual-database add flow (`TrackContentService` extracts duration from vault audio; `UnifiedTrackService` persists it to SQL). Migration `20260618155002_AddTrackDuration`. Configured in `TrackConfiguration`.
+  - **New aggregate query:** `TrackRepository.GetHomeStatsAsync` → `HomeStatsDto` (new DTO in `DeepDrftModels/DTOs/`). Returns cut track count, per-`ReleaseType` cut release counts (zero-count types suppressed), mix release count, and total mix runtime seconds (null durations counted as 0; tracks under soft-deleted releases excluded). Surfaced via `ITrackService.GetHomeStats` on `TrackManager`.
+  - **New API endpoints:** `GET api/stats/home` (`StatsController`, unauthenticated; returns `HomeStatsDto` bare) and `POST api/track/duration/backfill` (ApiKey-gated; one-time backfill of `DurationSeconds` for pre-existing rows from vault audio, delegated to `UnifiedTrackService.BackfillDurationsAsync`).
+  - **New public proxy:** `StatsProxyController` in `DeepDrftPublic` mirrors `ReleaseProxyController`; forwards `GET api/stats/home` from the browser to DeepDrftAPI.
+  - **New client surface:** `StatsClient` (`Clients/`, named `"DeepDrft.API"` client) + `IStatsDataService` / `StatsClientDataService` (`Services/`) registered scoped in `Startup.ConfigureDomainServices`. `RuntimeFormat` static helper (`Helpers/`) converts seconds to `hh:mm`.
+  - **`NowPlayingStats.razor`:** now renders live data — Studio Cuts card (cut track count + zero-suppressed Single/EP/Album breakdown), Mixes card (`MixReleaseCount` "Sets" + `hh:mm` runtime), Plays card (static "XXX / Coming Soon" odometer placeholder). Uses `PersistentComponentState` to bridge the SSR prerender fetch across the WASM seam (only persists on a successful load).
+
+---
+
+## Phase 12 — About Page (public site editorial) (landed 2026-06-17)
+
+**Landed:** 2026-06-17 on dev.
+
+- **What:** A real About page for the public site (`/about`), built entirely in the **Home page's existing visual language** — no new look. Three movements — **the People**, **the Process**, **the Product** — with ethos / pathos / logos woven through the prose as registers, not labelled blocks. The strategic frame (Daniel): the site is *presentation and proof of effort* — evidence that real people are pushing the classic club sound forward; the About page is where that claim is made explicit. Built as `DeepDrftPublic.Client/Pages/About.razor` + scoped `About.razor.css`; registered in the nav index (`DeepDrftPublic.Client/Layout/Pages.cs`). Images served statically from `DeepDrftPublic/wwwroot/img/`; image slots and Khabran's bio degrade gracefully until final assets/copy land.
+
+- **Why:** This is its own phase, not a graft onto Phase 11: Phase 11 was structural (release-cardinal browse, queue, GUID handles), whereas this is a net-new **editorial** surface. The page reuses Home's section primitives wholesale (`.hero`, `.section-divider`, two-column `.section`, dark `.section-dark` feature band, `.section-split`, `.cta-banner`, `ParallaxImage` full-bleed bands) — no new visual language introduced; the only candidate new styling is two member-bio cards, assembled from existing type tokens. Full spec: `product-notes/about-page.md`.
+
+- **Shape:** `DeepDrftPublic.Client/Pages/About.razor` (new; `@page "/about"`; three-movement editorial page using Home section primitives); `DeepDrftPublic.Client/Pages/About.razor.css` (new; scoped styles — Home section primitives currently re-declared here rather than shared globally, a known follow-up); `DeepDrftPublic.Client/Layout/Pages.cs` (nav index registration added). Static images from `DeepDrftPublic/wwwroot/img/`.
+
+**Voice constraint (hard):** smart, serious, no AI-isms — underground Detroit/Midwest deep-club-house heritage carried to Charleston. All body prose remains DRAFT pending Daniel's approval — section headers and UI labels are set; any sentence/paragraph of site copy is a placeholder until Daniel passes it.
+
+**Open follow-ups:** (1) ~~Final photo files for the five image slots~~ Photo slots largely resolved: bio portraits (Khabran + Daniel) now wired as circular framed portraits with a bw→colour hover crossfade (`dd-khabran`, `dd-daniel`); Process hands-on-gear figure now uses bespoke `dd-mixer-2`; the Liner Notes redesign removed the separate full-bleed atmosphere and closing-band slots, so the duo hero (`dd-duo-2`) and the hands-on-gear inset are the only full-bleed image positions remaining and both carry bespoke assets. Home page "Our Origin" split swapped the retired `kp-shoulder` for `dd-pedals`. (2) ~~Khabran's bio text still open~~ Khabran's bio is now wired (three paragraphs; bio-body render updated to emit each paragraph as its own `<p class="bio-body">` — Daniel's single-paragraph bio is unaffected). (3) Optional promotion of the duplicated Home section primitives from `About.razor.css` to a shared global stylesheet. (4) ~~Whether CUTS/SESSIONS/MIXES are explained on the page~~ Resolved by the Liner Notes redesign: the triptych renders as a stacked editorial definition list (see Redesign addendum below).
+
+**Redesign — Liner Notes editorial treatment (2026-06-17):** The page was rebuilt from the Home section primitives approach into a distinct **"Liner Notes"** editorial layout. Structure and copy (three-movement People / Process / Product) are unchanged; the visual treatment is entirely new. Key elements: numbered left rail (oversized Bodoni 01/02/03 movement numerals + continuous vertical hairline spine + mono marginalia captions), asymmetric content column, pull-quotes breaking left into the margin, hand-authored SVG waveform movement dividers (a self-contained decorative motif, not the live `WaveformVisualizer` component). The CUTS/SESSIONS/MIXES triptych is now a stacked editorial definition list rather than Home's medium-card image grid. Active-movement highlight on the left rail is progressive enhancement via a new `DeepDrftPublic/Interop/about/about-rail.ts` IntersectionObserver interop (compiled output gitignored). Superseded Home section primitives were removed from `About.razor.css`; the global stylesheet was untouched. Design authority: `product-notes/about-page-distinction.md` (Direction 1).
+
+---
+
+## Phase 15 — Visualizer Controls Enhancements (landed 2026-06-17)
+
+**Landed:** 2026-06-17 on dev.
+
+- **What:** A presentation and interaction rework of the waveform visualizer control surface — the eight-RadialKnob panel (Phase 12) hosted by `WaveformVisualizerControlPopover`. Not a renderer change: the WebGL2 visualizer, the eight continuous dial values + their defaults, and the `Changed`-event bridge seam are unchanged. The phase reworks how the controls are reached and presented, adds two on/off toggles (lava, waveform), and gives the panel a deterministic, sectioned layout that encodes the visualizer's composition (lava field + waveform ribbon, optionally overlaid).
+
+  Four tracks shipped as a single bundled PR (`15.A → {15.B, 15.C} → 15.D`):
+
+  - **15.A — State booleans + bridge wiring.** Two new `WaveformVisualizerControlState` booleans: `LavaEnabled` and `WaveformEnabled` (both default `true`). `WaveformVisualizer.ts` gained a genuine per-subsystem draw-skip: when a subsystem is "off" it is not drawn, contributes no collisions, and incurs no render cost (not dimmed). The bridge pushes the new booleans on `Changed` alongside the eight existing dials. The per-subsystem draw-skip seam was built as part of this track (it did not exist prior).
+  - **15.B — Screen-centered tinted-modal primitive + NowPlayingCard chrome.** `WaveformVisualizerControlPopover` changed from an anchored `MudPopover` to a screen-centered, tinted modal `MudOverlay` (`DarkBackground`, `Modal="true"`). The `AnchorOrigin`/`TransformOrigin` parameters were dropped — a centered modal has no anchor. Panel chrome follows the NowPlayingCard look: square corners, lighter-navy ground, thin light border. Chrome classes stay in the global `deepdrft-styles.css` (CSS isolation cannot reach portaled overlay content). Tint opacity resolves from a single `--deepdrft-modal-scrim-alpha` token. Knob-drag safety is preserved: `RadialKnob` mounts its own `position:fixed` capture div above the scrim while dragging, so releasing outside the panel does not close the modal.
+  - **15.C — Deterministic three-row layout + toggles + scroll slider.** The flat eight-knob grid replaced by a three-row sectioned layout: **Row 1 (MODE, always visible):** two lamp toggles (lava / waveform) left-aligned + collisions knob (only when both subsystems on) + color knob pinned far-right. **Row 2 (LAVA, visible only when lava on):** "LAVA:" label + Gravity / Heat / FluidAmount / FluidViscosity knobs. **Row 3 (WAVE, visible only when waveform on):** "WAVE:" label + scroll/zoom `MudSlider` (bound to `ScrollSpeed` alone) + width knob pinned far-right. The lamp toggles use the `DDIcons.LavaLamp` / `DDIcons.LavaLampFilled` glyph (lit = on, unlit = off) and are green (`Color.Primary`) because they are interactive.
+  - **15.D — Tooltips + light icon colour.** Each control received a playful, non-technical `MudTooltip`. Knob caption icons and section labels changed to light (`Color.Default` / CSS light token) per the resolved colour principle: green = interactive elements (toggles, knob arcs/pointers, scroll slider); light = static/decorative elements (section labels, caption icons).
+
+- **Why:** The eight-knob flat grid gave the user no signal about which knobs drive the lava vs. the waveform, and neither subsystem could be turned off independently. The new layout sections controls by subsystem, making "lava only" / "waveform only" first-class operating modes. The screen-centering solves the anchored-popover problem: `MudPopover` positions off its trigger's bounding rect — wrong for a control panel that should read as centered regardless of where the lava-lamp icon sits (Mix corner, Cut/Session ambient, NowPlaying corner).
+
+- **Shape:** `DeepDrftPublic.Client/Controls/WaveformVisualizerControls.razor` — three-row layout replacing the flat eight-knob grid; two `ToggleLava`/`ToggleWaveform` handlers; conditional row visibility; `MudSlider` for scroll speed. `DeepDrftPublic.Client/Controls/WaveformVisualizerControlPopover.razor` — `MudPopover` replaced by `MudOverlay` (centered, `DarkBackground`, `Modal`); `AnchorOrigin`/`TransformOrigin` parameters removed. `DeepDrftPublic.Client/Services/WaveformVisualizerControlState.cs` — two new boolean properties (`LavaEnabled`, `WaveformEnabled`) and matching `DefaultLavaEnabled`/`DefaultWaveformEnabled` consts (both `true`). `DeepDrftPublic/Interop/visualizer/WaveformVisualizer.ts` — per-subsystem draw-skip seam (lava physics + blob uploads skipped when lava off; ribbon SDF + collision boundary dropped when waveform off). `DeepDrftPublic/wwwroot/styles/deepdrft-styles.css` — `--deepdrft-modal-scrim-alpha` token; `.waveform-visualizer-control-overlay` centering; `.waveform-visualizer-control-modal` panel chrome (square corners, lighter-navy, thin border); row/section layout classes (`wvc-row`, `wvc-row-mode`, `wvc-row-section`, `wvc-row-wave`, `wvc-section-label`, `wvc-toggle`, `wvc-slider`). Full design, layout contract, primitive rationale, tooltip copy, and acceptance: `product-notes/phase-15-visualizer-controls-enhancements.md`.
+
+**Post-landing fixes (2026-06-17):** Seven defects found during smoke-testing were remediated in a follow-up round on dev: (1) new `--deepdrft-panel-ground` CSS token so the blue slider reads against the panel background; (2) drag-scrollbar removed + body-scroll locked while the modal is open; (3) knob caption icons forced light so lamp toggles stay green; (4) WAVE-row slider vertically centered; (5) **site-wide `RadialKnob` pointer-capture fix** — drag no longer sticks when the cursor leaves the browser window, implemented via real `setPointerCapture` / `releasePointerCapture` (benefits every `RadialKnob` on the site, not just this panel); (6) modal scrim alpha softened (0.3 → 0.15); (7) modal overlay z-index raised above the header and player-dock footer. Fix #5 introduced a **new TypeScript interop module in `DeepDrftShared.Client`**: `Interop/knob/knob.ts` (exports `capturePointer`/`releasePointer`), compiled to `wwwroot/js/knob/knob.js` via `Microsoft.TypeScript.MSBuild`, lazy-imported by `RadialKnob.razor` as `_content/DeepDrftShared.Client/js/knob/knob.js` — following the existing `parallax.ts` precedent in the same RCL.
+
+**Polish round 2 (2026-06-17):** Five further UI changes from Daniel's second review: (1) panel ground darkened further (`--deepdrft-panel-ground` `#1e2028` → `#1a1c22`); (2) **WAVE-row scroll/zoom control reverted from `MudSlider` back to a `RadialKnob`** — Daniel's explicit call, reversing the §8 slider decision; the scroll control is now a knob like the other dials; (3) **waveform toggle given its own distinct icon** — new `DDIcons.Waveform`/`WaveformFilled` six-bar sound-wave glyph, so the waveform toggle and lava toggle each have a unique visual identity (lava toggle keeps the lamp); (4) **strong active-state styling on both toggles** — green-accent filled chip + ring when ON, dimmed when OFF, making subsystem state unmistakable at a glance; (5) `WaveformVisualizerControlPopover.razor` in-source comment refreshed to describe the `setPointerCapture` mechanism.
+
+---
+
+## Phase 14 — CMS Releases Consolidation (landed 2026-06-17)
+
+**Landed:** 2026-06-17 on dev.
+
+- **What:** Retired the CMS `/tracks` list view and consolidated all release browsing into a new standalone **`/releases`** page (`DeepDrftManager/Components/Pages/Tracks/Releases.razor`). The TRACKS|RELEASES `BrowseMode` toggle is gone. The `/releases` layout is: bulk-action buttons (Generate All Profiles / Backfill High-res) → medium tab strip (ALL / CUTS / SESSIONS / MIXES) → the active tab's grid. The unique per-track waveform-status columns (Profile / High-res, with per-row generate buttons) and the per-track info tooltip (EntryKey + OriginalFileName) now live in `CmsAlbumBrowser`'s expanded child-row track table; page-level bulk runs and per-row generates share a refresh bridge (`InvalidateWaveformStatusAsync` + `OnWaveformGenerated` EventCallback wired through each medium container). The `/catalogue` dashboard cards changed from Tracks / Releases / Genres to **CUTS / SESSIONS / MIXES**, each deep-linking to `/releases?medium=<medium>` with the matching tab pre-selected. Old list routes `/tracks`, `/tracks/albums`, `/tracks/archive` are kept as aliases on `Releases.razor` so bookmarks don't 404; `/tracks/genres` was removed. Operational sub-routes (`/tracks/upload`, edit routes, `/tracks/mixes`, `/tracks/sessions`, etc.) stayed at `/tracks/*`. `ICmsTrackService.GetGenreSummariesAsync` removed (dead interface member). `GetTrackCountAsync` intentionally retained — planned for the public-site NowPlayingStats feature.
+- **Why:** The `/tracks` page mixed a list view and a releases browser behind a toggle (`BrowseMode`), and the waveform-status columns cluttered a per-track list that had no natural home once releases became the cardinal browse unit. Consolidating into a dedicated `/releases` page with a medium tab strip matches the release-medium mental model established in Phase 9 and makes waveform management a subordinate detail of the release's expanded track table rather than a top-level grid column. Retiring genre browse removes a dead-end CMS surface (genre is a filter, not a first-class browse dimension for the admin).
+- **Shape:** New: `DeepDrftManager/Components/Pages/Tracks/Releases.razor` (`@page "/releases"` + alias routes for `/tracks`, `/tracks/albums`, `/tracks/archive`). Deleted: `TrackList.razor`, `CmsTrackGrid.razor` (+ `.css`), `CmsGenreBrowser.razor` (+ `.css`), `Services/CmsTrackBrowserViewModel.cs` (+ its DI registration in `Program.cs`). Changed: `Index.razor` dashboard cards updated to CUTS / SESSIONS / MIXES deep-linking to `/releases?medium=<medium>`; `CmsAlbumBrowser` expanded child-row track table gains waveform-status columns + info tooltip + `OnWaveformGenerated` EventCallback; `ICmsTrackService` / `CmsTrackService` — `GetGenreSummariesAsync` removed.
+
+---
+
+## Phase 13 — CMS Public Landing (landed 2026-06-17)
+
+**Landed:** 2026-06-17 on dev.
+
+- **What:** Gave `DeepDrftManager` (the CMS) a true public face: an unauthenticated splash at `/` with DeepDrft branding and a single **Login** CTA; authenticated admins are redirected past it to the catalogue. Previously `/` was the `[Authorize]`-gated catalogue dashboard, so an anonymous hit fell straight through to the login form with no front door. Pattern borrowed from the `MainHomeLayout` / `Home.razor` idiom (dedicated public layout + `HierarchicalRoleAuthorizeView` redirect-the-authed-user), branded to the DeepDrft navy/green/off-white identity (`DeepDrftPalettes.Cms`). Additive — the admin experience is intact; only the catalogue's route moved. Routing decision: **Option A — splash owns `/`, catalogue moves to `/catalogue`** (Options B and C were weighed and rejected). New files: `Components/Pages/Home.razor` (`@page "/"`, no `[Authorize]`, `CmsHomeLayout`) wraps its body in `<HierarchicalRoleAuthorizeView>`: `Authorized` → `<RedirectToCatalogue />`; `NotAuthorized` → hero (`img/cms-hero.png`) + Login CTA (returnUrl → `/catalogue`). `Components/Layout/CmsHomeLayout.razor` — lean public layout (`DeepDrftPalettes.Cms` theme, "Deep Drft — Admin" AppBar, centered narrow `MudContainer`, `MudPopoverProvider` only). `Components/RedirectToCatalogue.razor` — inline `NavigationManager.NavigateTo("/catalogue")` redirect, mirroring `RedirectToAccessDenied`. Changed: `Index.razor` route `@page "/"` → `@page "/catalogue"`; `CmsLayout.razor` "Back to site" home button `Href` and tooltip updated to `/catalogue` / "Catalogue". AppBar wording resolved: "Deep Drft — Admin" in the bar, "Deep Drft" as the hero title.
+- **Why:** An anonymous visitor hitting the CMS root landed directly on the AuthBlocks login form with no DeepDrft context, branding, or explanation. The splash provides a proper front door while keeping the admin surface fully intact.
+- **Shape:** `DeepDrftManager/Components/Pages/Home.razor` (new); `DeepDrftManager/Components/Layout/CmsHomeLayout.razor` (new); `DeepDrftManager/Components/RedirectToCatalogue.razor` (new); `DeepDrftManager/Components/Pages/Index.razor` (route changed to `/catalogue`); `DeepDrftManager/Components/Layout/CmsLayout.razor` (home-button href + tooltip updated). Hero asset: `DeepDrftManager/wwwroot/img/cms-hero.png` (Daniel-supplied; page compiles and renders without it). Full spec: `product-notes/cms-public-landing.md`.
+
+---
+
+## Phase 12 — Waveform Visualizer Generalization + NowPlayingHero Rewire (all tracks landed 2026-06-17)
+
+**Landed:** 2026-06-17 on dev. Six tracks (12.A, 12.B1, 12.B2, 12.E, 12.C, 12.D) plus a bridge live-track fix, all merged.
+
+- **What:** Took the landed Mix WebGL2 lava visualizer (Phase 10 reframe) and made it the one track-cardinal visualizer — serving Mix detail, all Release Detail pages, and the home-page NowPlaying card — rendering the waveform of whatever track is currently playing/selected. Two deliverables: (1) the generalized engine serving three hosting modes, (2) the NowPlayingHero rewire. Full design, extraction analysis, per-track model, Direction B compute, wave decomposition: `product-notes/phase-12-waveform-visualizer-generalization.md`.
+
+  - **12.A — Rename to the abstraction.** `MixWaveformVisualizer` → `WaveformVisualizer`, `MixVisualizerControls` → `WaveformVisualizerControls`, `MixVisualizerControlState` → `WaveformVisualizerControlState`, `MixZoomMapping` → `WaveformZoomMapping`, `MixVisualizer.ts` → `WaveformVisualizer.ts`. Mechanical rename across the five C#/Razor files + TS module + import path + DI registration. No behavior change; Mix detail identical after.
+  - **12.B1 — Generalize high-res compute to every track + backfill (Direction B).** `MixWaveformResolution` → `WaveformResolution`. Vault `mix-waveforms` → `track-waveforms` (`VaultConstants.TrackWaveforms`), keyed per-track by `EntryKey`. New `WaveformProfileService.ComputeAndStoreHighResAsync` is the shared compute seam — upload path, CMS generate action, and Mix trigger all funnel through it. `UnifiedTrackService.UploadAsync` now computes the high-res datum for every new track. CMS generate action generalized to any track; a re-runnable "backfill high-res" batch action added in the CMS `TrackList`. `WaveformStatusDto.HasHighRes` added alongside the existing `HasProfile`. Backfill is Daniel-gated (CMS batch action; fetch 404s gracefully for not-yet-backfilled tracks).
+  - **12.B2 — Per-track datum fetch + bridge rewire.** New track-cardinal endpoint `GET api/track/{trackEntryKey}/waveform/high-res` (unauthenticated) + public proxy; `ITrackDataService.GetTrackWaveform`; bridge resolves the current track's `EntryKey` and re-fetches on track change. Client `GetMixWaveform` read path retired; API-side release waveform endpoint kept as a caller-less legacy delegate. Mix renders the same high-res lava via the track-cardinal fetch.
+  - **12.E — Popover-hosted control panel.** `WaveformVisualizerControls` became the panel content; new `WaveformVisualizerControlPopover` pairs the lava-lamp icon with the panel as overlay content (`MudPopover`). Panel styled to the NowPlaying Hero look from `deepdrft-tokens.css` (no hardcoded hex). A `PanelChrome` flag scopes panel chrome to the popover mount. One popover placed by the lava-lamp icon on every host — full parity across Mix, Cut, Session, and NowPlaying card.
+  - **Bridge live-track fix.** The visualizer now follows the live playing track (keys on host `TrackId` match OR shared host `ReleaseEntryKey`), not the fixed host `TrackId`.
+  - **12.C — `Ambient` slot on `ReleaseDetailScaffold` + mount on detail pages (mode B).** New optional `Ambient` slot on `ReleaseDetailScaffold` (full-bleed layer behind content; absent slot = no regression). Cut mounts the ambient visualizer + the lava-lamp icon → popover. Session mounts the engine directly behind its hero (it doesn't compose the scaffold) + the popover. Mix swapped its inline controls bar for the lava-lamp icon → popover, keeping its own full-bleed mode-A mount.
+  - **12.D — NowPlayingHero rewire (mode C).** `NowPlayingCard` replaced the 20 synthetic CSS bars with a contained `<WaveformVisualizer>` driven by the live cascaded player, pointed at the current track. Added a `Fill` container-sizing mode (CSS-only, defaults off). Placed the lava-lamp icon → popover on the card for full parity. Visualizer runs at-rest on the home page even before playback (deliberate; perf tuning deferred).
+
+- **Why:** The landed Mix visualizer was structurally track-cardinal below the surface (bridge keyed on `TrackId`; renderer a pure function of a loudness datum + duration) but named `Mix*` throughout and restricted to Mix-only data. "Generalize" was a rename + per-track high-res compute extension, not a rebuild. Direction B (high-res for all media) was chosen over the cheaper 512-bucket-fallback Direction A to deliver uniform waveform quality. Controls moved from per-page inline knob bars to a single popover-hosted panel to achieve zero-cost placement on any host including the small NowPlaying card.
+
+- **Shape:** `DeepDrftPublic.Client/Controls/`: `WaveformVisualizer.razor` (+ `.razor.cs`, `.razor.css`) — renamed engine, added `[Parameter] bool Fill`; `WaveformVisualizerControls.razor` — renamed, now panel content with `PanelChrome` flag; `WaveformVisualizerControlPopover.razor` — new, lava-lamp icon + `MudPopover` wrapping the panel; `WaveformZoomMapping.cs` — renamed; `ReleaseDetailScaffold.razor` (+ `.razor.cs`) — new optional `Ambient` `RenderFragment` slot; `NowPlayingCard.razor` — synthetic bars replaced, `<WaveformVisualizer Fill="true">` + `<WaveformVisualizerControlPopover>`. `DeepDrftPublic.Client/Services/`: `WaveformVisualizerControlState.cs` — renamed. `DeepDrftPublic.Client/Pages/`: `CutDetail.razor` — mounts ambient visualizer + popover; `SessionDetail.razor` — mounts engine + popover directly; `MixDetail.razor` — swaps inline controls bar for popover. `DeepDrftPublic/Interop/visualizer/WaveformVisualizer.ts` — renamed TS module. `DeepDrftContent/Processors/`: `WaveformResolution.cs` — renamed; `WaveformProfileService.cs` — `ComputeAndStoreHighResAsync` added, medium-neutral. `DeepDrftContent/Constants/VaultConstants.cs` — `TrackWaveforms = "track-waveforms"`. `DeepDrftAPI/Controllers/TrackController.cs` — `GET api/track/{trackEntryKey}/waveform/high-res` (unauthenticated) + `POST api/track/{trackId}/waveform/high-res` (ApiKey, generalized generate); `WaveformStatusDto.HasHighRes` populated. `DeepDrftAPI/Services/UnifiedTrackService.cs` — `UploadAsync` now calls `ComputeAndStoreHighResAsync` for every new track. `DeepDrftPublic/Controllers/TrackProxyController.cs` — proxy for the new high-res endpoint.
+
+---
+
 ## Phase 10 — Mix Visualizer Reframe: Waves R1–R4 (Lava tuning + eight-knob controls)
 
 **Landed:** 2026-06-17 on dev.

DeepDrftAPI/CLAUDE.md

@@ -6,7 +6,7 @@ See the root `CLAUDE.md` for full architecture overview. This file covers what i
 
 ## One-line purpose
 
-Dual-database authority for tracks (SQL metadata + FileDatabase binary), releases (SQL metadata with media-specific satellites), and images (FileDatabase binary); AuthBlocks API host (JWT auth, role/admin seed). Track endpoints expose CRUD with upload+persist, delete+cleanup, paged listing with filters, metadata operations, waveform profiles, and release associations. Release endpoints provide paged listing with medium filter, single-release read, and media-specific operations (mix waveform compute, session hero-image upload). Image endpoints provide authenticated upload and unauthenticated streaming. ApiKey middleware for authenticated endpoints, JWT + AuthBlocks for auth. CORS, forwarded headers. **FileDatabase implementation lives in `DeepDrftContent`; SQL services in `DeepDrftData`.**
+Dual-database authority for tracks (SQL metadata + FileDatabase binary), releases (SQL metadata with media-specific satellites), and images (FileDatabase binary); AuthBlocks API host (JWT auth, role/admin seed). Track endpoints expose CRUD with upload+persist, delete+cleanup, paged listing with filters, metadata operations, waveform profiles (512-bucket player-bar seeker + per-track high-res visualizer datum), and release associations. Release endpoints provide paged listing with medium filter, single-release read, and media-specific operations (session hero-image upload; mix waveform is a caller-less legacy delegate — the track-cardinal `GET api/track/{entryKey}/waveform/high-res` is the live fetch path). Image endpoints provide authenticated upload and unauthenticated streaming. ApiKey middleware for authenticated endpoints, JWT + AuthBlocks for auth. CORS, forwarded headers. **FileDatabase implementation lives in `DeepDrftContent`; SQL services in `DeepDrftData`.**
 
 ## What lives here now (only)
 
@@ -16,7 +16,7 @@ Dual-database authority for tracks (SQL metadata + FileDatabase binary), release
 - `Controllers/TrackController.cs`: Track endpoints (see below).
 - `Controllers/ReleaseController.cs`: Release endpoints (see below).
 - `Middleware/ApiKeyAuthenticationMiddleware.cs`, `Middleware/ApiKeyAuthorizeAttribute.cs`: ApiKey validation logic (for track endpoints only).
-- `Models/`: Settings POCOs only (`ApiKeySettings`, `CorsSettings`, `FileDatabaseSettings`). No domain code.
+- `Models/`: Settings POCOs only (`ApiKeySettings`, `CorsSettings`, `FileDatabaseSettings`, `UploadSettings`, `UploadStagingDirectory`). No domain code.
 - `environment/filedatabase.json`: FileDatabase vault path config (loaded via CredentialTools, not in repo).
 - `environment/apikey.json`: API key for track endpoints (loaded via CredentialTools, not in repo, must be created locally or at deployment).
 - `environment/connections.json`: SQL and Auth connection strings (loaded via CredentialTools, not in repo, format: `{ "ConnectionStrings": { "DefaultConnection": "...", "Auth": "..." } }`).
@@ -77,6 +77,23 @@ Admin backfill: computes and stores a waveform profile for an existing track fro
 - Fetches audio from vault, decodes it, computes a loudness profile, and stores the profile in the `waveform-profiles` vault.
 - Returns 200 on success. Returns 404 if no audio is stored under that key. Returns 500 if WAV decoding or vault write fails.
 
+### GET api/track/{trackId}/waveform/high-res (unauthenticated)
+
+Track-cardinal high-res datum fetch. Returns the per-track duration-derived high-res waveform datum (~333 samples/sec) from the `track-waveforms` vault. This is the live read path for the `WaveformVisualizer` bridge — the release-level mix waveform endpoint is a caller-less legacy delegate.
+
+- **Route parameter `trackId`** (string): the entry id (TrackEntity.EntryKey).
+- **Response**: `WaveformProfileDto` with `BucketCount` and `Data` (base64).
+- Returns 200 on success. Returns 404 if no high-res datum is stored (graceful — not-yet-backfilled tracks fall back to no visualizer data). Returns 500 on vault error.
+
+### POST api/track/{trackId}/waveform/high-res ([ApiKeyAuthorize])
+
+Server-side trigger: compute and store the per-track high-res datum for any track from its vault audio, keyed by `EntryKey` in the `track-waveforms` vault. Drives the CMS per-row "Generate high-res" action and the CMS batch backfill action. Generalised off Mix-only in Phase 12.
+
+- **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
+- **Route parameter `trackId`** (string): the entry id (TrackEntity.EntryKey).
+- Calls `WaveformProfileService.ComputeAndStoreHighResAsync` via `UnifiedTrackService`.
+- Returns 200 on success. Returns 404 if no audio stored under that key. Returns 500 on compute/storage failure.
+
 ### GET api/track/meta/by-key/{entryKey} (unauthenticated)
 
 Single track metadata by vault entry key (EntryKey). Unauthenticated, reachable through the public proxy.
@@ -87,12 +104,33 @@ Single track metadata by vault entry key (EntryKey). Unauthenticated, reachable
 
 ### GET api/track/waveform-status ([ApiKeyAuthorize])
 
-Admin backfill view: returns every track with a flag indicating whether a waveform profile is stored. Used by the CMS PreProcessing panel to flag tracks needing waveform computation.
+Admin backfill view: returns every track with flags indicating whether each waveform type is stored. Used by the CMS track list to flag tracks needing waveform computation.
 
 - **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
-- **Response**: `List<WaveformStatusDto>` with `TrackId`, `EntryKey`, `TrackName`, and `HasProfile` (bool).
+- **Response**: `List<WaveformStatusDto>` with `TrackId`, `EntryKey`, `TrackName`, `HasProfile` (bool — 512-bucket player-bar seeker profile in `waveform-profiles` vault), and `HasHighRes` (bool — duration-derived high-res visualizer datum in `track-waveforms` vault).
 - Returns 200 on success. Returns 500 on query error.
 
+### POST api/track/duration/backfill ([ApiKeyAuthorize])
+
+Admin backfill: for every track whose `DurationSeconds` SQL column is still null, reads the `AudioBinary.Duration` from the vault and writes it to SQL. Idempotent — a re-run only touches still-null rows; rows that already have a value are skipped.
+
+- **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
+- No request body.
+- Calls `UnifiedTrackService.BackfillDurationsAsync`. Lives on `TrackController` in the literal-route block (before `{trackId}` routes, so the segment is never treated as a trackId).
+- **Response**: `{ updated: int, skipped: int }` — counts of rows written vs. already-populated rows bypassed.
+- Returns 200 on success. Returns 500 if the backfill operation fails.
+
+### GET api/track/release/exists ([ApiKeyAuthorize])
+
+Upload-form pre-flight: checks whether a release with the given (title, artist) already exists in the catalogue. Returns the matching `ReleaseDto` (so the caller can name it in a block message) or 404 when none exists. Uses the same `GetReleaseByTitleAndArtist` read the upload CREATE-path duplicate guard uses, so the pre-flight and the server backstop agree on the match by construction (exact ordinal comparison, soft-deleted rows excluded).
+
+- **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
+- **Query parameters**:
+  - `title` (string, required): the release title to check.
+  - `artist` (string, required): the artist name to check.
+- Declared as a literal 2-segment route (`"release/exists"`) before the parameterized `{trackId}` route and distinct from `"release/{id:long}"` (different segment shape) — no routing ambiguity.
+- Returns 200 with `ReleaseDto` JSON if a match exists. Returns 400 if either query parameter is missing or whitespace. Returns 404 if no match. Returns 500 on query error.
+
 ### DELETE api/track/release/{id:long} ([ApiKeyAuthorize])
 
 Soft-delete a release row. Used by the albums browser to remove an orphaned release (one with no live tracks).
@@ -129,10 +167,11 @@ Soft-delete a release row. Used by the albums browser to remove an orphaned rele
   - `releaseType` (string, optional): enum `ReleaseType` (e.g., `Single`, `Album`, `EP`). Defaults to `Single` if null or unrecognized.
   - `medium` (string, optional): enum `ReleaseMedium` (e.g., `Cut`, `Mix`, `Session`). Defaults to `Cut` if null or unrecognized.
   - `trackNumber` (int?, optional): track position within the release (1-based). Defaults to 1 if ≤ 0 or null.
-- The upload stream is copied to a temp file under `Path.GetTempPath()` with the appropriate extension (`.wav`, `.mp3`, or `.flac`). The audio processor reads from disk and requires the correct extension for format detection. The temp file is always deleted in a `finally` block — success or failure.
-- `[RequestSizeLimit(1 GB)]` + `[RequestFormLimits(MultipartBodyLengthLimit = 1 GB)]` lift the per-request ceiling above the framework default (~28 MB) so production-sized files are accepted. The body is streamed to the temp file, not buffered in memory.
-- Calls `UnifiedTrackService.UploadAsync`, which orchestrates: `TrackContentService.AddTrackAsync` (format-agnostic vault write via router) → `TrackManager` (SQL persist with `createdByUserId`).
-- Returns 200 with the **persisted** `TrackDto` JSON (Id populated) on success. Returns 400 for missing/invalid form fields or unsupported audio format. Returns 409 if the request violates domain cardinality rules (e.g., track number conflict). Returns 500 if processing fails.
+  - `releaseId` (long?, optional): the SQL release ID to attach this track to. Omit (null) on the first row of a submit — this is the **CREATE path**, which mints a new release and blocks a pre-existing (title, artist) with 409. Set to the release id returned by row 1 for rows 2..N of a within-batch multi-track Cut — this is the **ATTACH path**, which skips the (title, artist) pre-existing check and attaches directly to the already-created release after validating the id matches the natural key. The upload form is create-only; appending to a pre-existing release must go through the edit tools.
+- The upload stream is copied to a staging file under the **upload staging directory** (resolved from `Upload:StagingPath`, defaulting to a `staging` subdirectory under the FileDatabase vault path — on the data disk, **never** `Path.GetTempPath()`) with the appropriate extension (`.wav`, `.mp3`, or `.flac`). The audio processor reads from disk and requires the correct extension for format detection. The staging file is always deleted in a `finally` block — success or failure. The framework's own multipart file-section buffer is relocated off the system temp mount too: `Startup.ConfigureDomainServices` sets the `ASPNETCORE_TEMP` env var to the same staging directory, so neither on-disk copy of a large body lands on `/tmp` (a small RAM-backed tmpfs on the Linux host).
+- `[RequestSizeLimit(~1.86 GB / 2_000_000_000)]` + `[RequestFormLimits(MultipartBodyLengthLimit = 2_000_000_000)]` lift the per-request ceiling above the framework default (~28 MB) so production-sized files are accepted. The body is streamed to the staging file, not buffered in memory.
+- `UnifiedTrackService.UploadAsync` orchestrates: release resolution (CREATE or ATTACH, see above) → `TrackContentService.AddTrackAsync` (format-agnostic vault write via router) → `TrackManager` (SQL persist with `createdByUserId`). Release resolution runs the cardinality guard on both paths and, on the CREATE path, calls `ITrackService.FindOrCreateRelease` (returns `(ReleaseDto Release, bool WasCreated)`); if `WasCreated` is false, a concurrent upload won the race and the request is rejected as a duplicate rather than silently attaching.
+- Returns 200 with the **persisted** `TrackDto` JSON (Id populated) on success. Returns 400 for missing/invalid form fields or unsupported audio format. Returns 409 for two distinct domain conditions: a pre-existing (title, artist) duplicate on the CREATE path (`DUPLICATE_RELEASE:` marker → 409 Conflict), or a track-number conflict within the release (`CARDINALITY_VIOLATION:` marker → 409 Conflict). Returns 500 if processing fails.
 
 ### DELETE api/track/{id:long} ([ApiKeyAuthorize])
 
@@ -143,6 +182,17 @@ Soft-delete a release row. Used by the albums browser to remove an orphaned rele
 - Calls `UnifiedTrackService.DeleteAsync`, which: looks up SQL row → deletes SQL row → deletes vault entry via EntryKey.
 - Returns 200 on success, 404 if track not found, 500 if deletion fails.
 
+### POST api/track/{id:long}/replace-audio ([ApiKeyAuthorize])
+
+**Authenticated endpoint.** Accepts a raw audio file upload (.wav, .mp3, .flac) as `multipart/form-data` and replaces the existing track's vault bytes in place, preserving the track id, `EntryKey`, SQL row (metadata/release/position), and release membership. Both waveform datums (512-bucket seeker profile + high-res visualizer datum) are regenerated after the swap; waveform regen failure is logged and swallowed — it does not fail the replace.
+
+- **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
+- **Route parameter `id`** (long): the SQL track ID.
+- **Form field `audioFile`** (`IFormFile`, required): the replacement audio bytes. File name must end in `.wav`, `.mp3`, or `.flac`.
+- `[RequestSizeLimit(~1.86 GB / 2_000_000_000)]` + `[RequestFormLimits(MultipartBodyLengthLimit = 2_000_000_000)]` mirror the upload ceiling. The body is streamed to a staging file under the upload staging directory (the same off-`/tmp` data-disk location as the upload path; correct extension preserved for the audio processor), always deleted in a `finally` block.
+- Calls `UnifiedTrackService.ReplaceAudioAsync`, which: looks up SQL row by id → calls `TrackContentService.ReplaceTrackAudioAsync(entryKey, tempFilePath)` (registers new audio under the existing `EntryKey`; removes the stale backing file only on a cross-format swap, after the new write succeeds) → regenerates both waveform datums (best-effort; a datum failure is logged and swallowed) → writes the new audio's duration to `DurationSeconds` via `ITrackService.SetDuration` (unconditional overwrite; a failure is surfaced, not swallowed, to prevent derived aggregates like `MixRuntimeSeconds` from silently going stale).
+- Returns 200 on success. Returns 400 if the file is missing or the format is unsupported. Returns 404 if the track id is not found. Returns 500 if vault processing fails.
+
 ### GET api/track/page (unauthenticated)
 
 Paged metadata list from SQL with optional filtering. Public browser data, same auth posture as `GET api/track/{id}`.
@@ -228,9 +278,9 @@ Single release with both metadata navs (nulls for non-matching media). Public, s
 - **Response**: `ReleaseDto` with `Id`, `EntryKey`, `Title`, `Artist`, `Genre`, `ReleaseDate`, `Medium`, `ImagePath`, and media-specific metadata satellites (`MixMetadata` for Cut/Mix, `SessionMetadata` for Session; others null).
 - Returns 200 on success. Returns 404 if not found. Returns 500 on query error.
 
-### GET api/release/{entryKey}/mix/waveform (unauthenticated)
+### GET api/release/{entryKey}/mix/waveform (unauthenticated — caller-less legacy delegate)
 
-Serves the high-res waveform datum for a Mix release as base64-encoded bytes. Mirrors `GET api/track/{id}/waveform` but reads from the `mix-waveforms` vault. Public read — addresses by the release `EntryKey` (§3e).
+Legacy endpoint: formerly served the high-res waveform datum for a Mix release from the `mix-waveforms` vault. **No longer called by the client** — the live fetch path is now the track-cardinal `GET api/track/{trackId}/waveform/high-res` (Phase 12). The endpoint is retained in the API but has no active callers. `UnifiedReleaseService.TriggerMixWaveformAsync` now delegates to `WaveformProfileService.ComputeAndStoreHighResAsync` (the same shared seam used by the upload path and the generalized CMS generate action).
 
 - **Route parameter `entryKey`** (string): the release's `EntryKey`.
 - **Response**: `WaveformProfileDto` with `BucketCount` and `Data` (base64).
@@ -238,7 +288,7 @@ Serves the high-res waveform datum for a Mix release as base64-encoded bytes. Mi
 
 ### POST api/release/{id:long}/mix/waveform ([ApiKeyAuthorize])
 
-Server-side trigger: fetch the Mix's track audio from the vault, compute a 2048-bucket waveform, store it in the `mix-waveforms` vault, and link it via `MixMetadata.WaveformEntryKey`. No request body.
+Server-side trigger: fetch the Mix's track audio from the vault, compute the duration-derived high-res datum, store it in the `track-waveforms` vault under the track's `EntryKey`, and link it via `MixMetadata.WaveformEntryKey`. Delegates to `WaveformProfileService.ComputeAndStoreHighResAsync` — the same shared seam used by the upload path and the generalized CMS generate action. No request body.
 
 - **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
 - **Route parameter `id`** (long): the SQL release ID.
@@ -255,6 +305,44 @@ Stores a hero image in the `images` vault and links it via `SessionMetadata.Hero
 - Validates MIME type (rejects unsupported types with `.bin` sentinel). Calls `UnifiedReleaseService.SetHeroImageAsync`.
 - Returns 200 on success. Returns 400 for missing file or unsupported MIME type. Returns 404 if release not found. Returns 500 on processing or vault failure.
 
+## The stats endpoints
+
+### GET api/stats/home (unauthenticated)
+
+Aggregate figures behind the public home hero stat row (`NowPlayingStats`). A single read returns everything the three cards need so the client makes one round-trip. Public, same auth posture as `GET api/track/page`.
+
+- **Response**: `HomeStatsDto` with:
+  - `CutTrackCount` (int): total non-deleted tracks on Cut-medium releases.
+  - `CutReleaseTypeCounts` (`List<CutReleaseTypeCount>`): per-`ReleaseType` Cut release counts; zero-count types are absent (zero-suppressed server-side).
+  - `MixReleaseCount` (int): total non-deleted Mix-medium releases.
+  - `MixRuntimeSeconds` (double): sum of `DurationSeconds` across all non-deleted tracks on Mix releases (null durations count as 0).
+  - `TotalPlays` (long): site-wide total plays — sum of every `play_counter` row's bucket columns (`PartialCount + SampledCount + CompleteCount`), all-time (Phase 16). Zero until the play-telemetry migration is applied.
+  - `UniqueListeners` (int): site-wide distinct anonymous listeners — distinct non-null `anon_id` across all play events, all-time (Phase 16). Zero until the migration is applied.
+- `StatsController` injects **both** `ITrackService` (track-domain aggregation — Cuts/Mixes cards) and `IEventService` (event-domain aggregation — Plays card). Neither domain reaches into the other's tables; the controller is the thin composition seam. Track-domain aggregation comes from `TrackRepository.GetHomeStatsAsync` via `ITrackService.GetHomeStats`; play/listener figures come from `IEventService.GetTotalPlayCount` and `IEventService.GetDistinctListenerCount` (Phase 16 wave 16.5). Play/listener reads are **best-effort**: a telemetry failure or not-yet-applied migration leaves those fields at 0 rather than failing the whole endpoint with 500.
+- Returns 200 on success. Returns 500 if the track-domain aggregation fails.
+
+## The event endpoints (Phase 16 anonymous telemetry)
+
+Both endpoints are unauthenticated and rate-limited by the `"events"` fixed-window policy (30 requests / 60 s per IP, keyed on `Connection.RemoteIpAddress` after `UseForwardedHeaders()` resolves XFF). Returns `202 Accepted` — fire-and-forget contract; the `sendBeacon` client ignores the response. Controller: `EventController`.
+
+### POST api/event/play (unauthenticated, rate-limited)
+
+Records an anonymous play event. Client sends the track `EntryKey`, a completion bucket, and an optional `anonId` (wave 16.3); server-side release resolution joins track→release at write time (D4). The `anonId` is length-clamped server-side: whitespace-only / empty / null collapses to null (valid anonId-less event); a token longer than 64 chars returns `400` rather than being truncated (truncation would collide distinct listeners).
+
+- **Body** (`PlayEventDto`): `{ "trackEntryKey": "...", "bucket": "partial"|"sampled"|"complete", "anonId": "..." }` (`anonId` optional — omitted when null).
+- Validates: non-empty `trackEntryKey`; `bucket` must be a defined `PlayBucket` enum value.
+- Delegates to `IEventService.RecordPlay`, which appends to `play_event` and bumps `play_counter`.
+- Returns 202 on success. Returns 400 for missing/invalid fields. Returns 429 when the rate limit is exceeded. Returns 500 on a write failure (logged; beacon ignores it).
+
+### POST api/event/share (unauthenticated, rate-limited)
+
+Records an anonymous share event (a clipboard write from `SharePopover`).
+
+- **Body** (`ShareEventDto`): `{ "targetKey": "...", "targetType": "track"|"release", "channel": "link"|"embed", "anonId": "..." }` (`anonId` optional — omitted when null; same length-clamp as the play endpoint).
+- Validates: non-empty `targetKey`; defined `ShareTargetType` and `ShareChannel` enum values; `anonId` ≤ 64 chars (reject-not-truncate).
+- Delegates to `IEventService.RecordShare`, which appends to `share_event`.
+- Returns 202 on success. Returns 400 for missing/invalid fields. Returns 429 on rate limit. Returns 500 on write failure.
+
 ## ApiKey middleware behaviour
 
 `ApiKeyAuthenticationMiddleware` runs on every request but only enforces on endpoints with `[ApiKeyAuthorize]` metadata.
@@ -289,7 +377,9 @@ Configured in `Startup.ConfigureDomainServices()`, applied to all endpoints via
 3. Register `FileDatabase` as singleton.
 4. Ensure the `tracks` vault exists (type `MediaVaultType.Audio`, created on first boot if missing).
 5. Ensure the `images` vault exists (type `MediaVaultType.Image`, created on first boot if missing) via `InitializeImageVault`.
-6. Register singletons: `AudioProcessor`, `ImageProcessor`, `TrackService` (the `DeepDrftContent` version for vault operations).
+5a. Ensure the `track-waveforms` vault exists (type `MediaVaultType.Media`, created on first boot if missing) — holds per-track high-res visualizer datum keyed by `TrackEntity.EntryKey`.
+6. Register singletons: `AudioProcessor`, `ImageProcessor`, `TrackService` (the `DeepDrftContent` version for vault operations), `WaveformProfileService`.
+6a. **Upload staging directory** — resolve and create the on-disk staging directory (read `Upload:StagingPath`; if empty, default to a `staging` subdirectory under the FileDatabase vault path via `Startup.ResolveStagingPath`). Set the `ASPNETCORE_TEMP` env var to this directory before any request is served, relocating the framework's multipart file-section buffer (Layer 1) off the system temp mount. Register `UploadStagingDirectory` as a singleton so both `UploadTrack` and `ReplaceAudio` in `TrackController` stage to the same data-disk location (Layer 2) and never write to `/tmp` (a small RAM-backed tmpfs on the Linux host).
 
 **In `Program.cs`** (SQL + AuthBlocks + wiring):
 
@@ -312,8 +402,9 @@ Mapped in `Development` only. Swagger UI at `/swagger` for testing endpoints loc
 
 ## Configuration files
 
-- `appsettings.json`: Logging, hosting, CORS, and AuthBlocks config. **Does not contain secrets.**
+- `appsettings.json`: Logging, hosting, CORS, AuthBlocks, and non-secret upload config. **Does not contain secrets.**
   - `Logging`: standard ASP.NET structure.
+  - `Upload:StagingPath`: non-secret string. Empty default → a `staging` subdirectory under the FileDatabase vault path (on the data disk). Override to an absolute path when the vault default is not suitable. Consumed by `Startup.ResolveStagingPath`.
   - `CorsSettings.AllowedOrigins`: array of origin URLs allowed to call the API (required; throws on startup if missing).
   - `AuthBlocks:Jwt:Issuer`, `AuthBlocks:Jwt:Audience`: JWT validation settings (loaded from `environment/authblocks.json`).
 - `environment/filedatabase.json` (required, loaded via CredentialTools, not in repo):

DeepDrftAPI/Controllers/EventController.cs

@@ -0,0 +1,114 @@
+using DeepDrftData;
+using DeepDrftModels.DTOs;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+
+namespace DeepDrftAPI.Controllers;
+
+/// <summary>
+/// Anonymous play/share telemetry intake (Phase 16 §2.2 / §4.3). Unauthenticated — same posture as the
+/// public reads — but IP rate-limited (the "events" limiter, registered in Program.cs) and payload-
+/// validated to make casual inflation annoying (§2.5). Both endpoints return <c>202 Accepted</c>: these
+/// are fire-and-forget telemetry, not transactions, and the client (a <c>sendBeacon</c>) never reads the
+/// response. The release dimension on a play is resolved server-side from the track key (§2.3 / D4).
+/// The controller is a thin HTTP boundary; all write logic lives in <see cref="IEventService"/>.
+/// </summary>
+[ApiController]
+[Route("api/event")]
+[EnableRateLimiting("events")]
+public class EventController : ControllerBase
+{
+    // Reject oversized bodies before deserialization — a coarse abuse guard (§2.5). The legitimate
+    // payloads are a track key + an enum, well under 1 KB.
+    private const int MaxBodyBytes = 1024;
+
+    // The anonId is a client-minted GUID string (~36 chars); the anon_id column is varchar(64). Reject
+    // anything longer as malformed rather than silently truncating — an over-long token is either a bug
+    // or an inflation attempt, and a truncated id would corrupt the distinct-listener count by colliding
+    // distinct listeners onto one prefix. Whitespace-only is treated as absent.
+    private const int MaxAnonIdLength = 64;
+
+    private readonly IEventService _eventService;
+    private readonly ILogger<EventController> _logger;
+
+    public EventController(IEventService eventService, ILogger<EventController> logger)
+    {
+        _eventService = eventService;
+        _logger = logger;
+    }
+
+    // POST api/event/play (unauthenticated, rate-limited)
+    [HttpPost("play")]
+    [RequestSizeLimit(MaxBodyBytes)]
+    public async Task<ActionResult> RecordPlay([FromBody] PlayEventDto payload, CancellationToken ct = default)
+    {
+        // Reject a missing track key and an out-of-range bucket (§2.5). [ApiController] model binding
+        // already 400s a malformed/oversized body and an undefined enum value, but the explicit guards
+        // keep the contract obvious and cover the empty-string key the model binder lets through.
+        if (string.IsNullOrWhiteSpace(payload.TrackEntryKey))
+            return BadRequest("trackEntryKey is required");
+        if (!Enum.IsDefined(payload.Bucket))
+            return BadRequest("bucket is invalid");
+        if (!TryNormalizeAnonId(payload.AnonId, out var anonId))
+            return BadRequest("anonId is invalid");
+
+        var result = await _eventService.RecordPlay(payload.TrackEntryKey, payload.Bucket, anonId, ct);
+        if (!result.Success)
+        {
+            // A telemetry failure must never surface to the listener as an error they can act on, but
+            // we still log it and answer 5xx so a monitor can see the substrate is unhealthy. The
+            // beacon ignores the status either way.
+            _logger.LogWarning("RecordPlay failed: {Error}", result.Messages.FirstOrDefault()?.Message);
+            return StatusCode(500);
+        }
+
+        return Accepted();
+    }
+
+    // POST api/event/share (unauthenticated, rate-limited)
+    [HttpPost("share")]
+    [RequestSizeLimit(MaxBodyBytes)]
+    public async Task<ActionResult> RecordShare([FromBody] ShareEventDto payload, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(payload.TargetKey))
+            return BadRequest("targetKey is required");
+        if (!Enum.IsDefined(payload.TargetType))
+            return BadRequest("targetType is invalid");
+        if (!Enum.IsDefined(payload.Channel))
+            return BadRequest("channel is invalid");
+        if (!TryNormalizeAnonId(payload.AnonId, out var anonId))
+            return BadRequest("anonId is invalid");
+
+        var result = await _eventService.RecordShare(payload.TargetType, payload.TargetKey, payload.Channel, anonId, ct);
+        if (!result.Success)
+        {
+            _logger.LogWarning("RecordShare failed: {Error}", result.Messages.FirstOrDefault()?.Message);
+            return StatusCode(500);
+        }
+
+        return Accepted();
+    }
+
+    // Normalize an incoming anonId (wave 16.3): whitespace-only / empty / null collapses to a null token
+    // (the listener didn't send one, or storage was unavailable — a valid, anonId-less event). A token
+    // over the column width is rejected (400) rather than truncated, since truncation would collide
+    // distinct listeners. Returns false only on the over-long case; null and a valid token both pass.
+    private static bool TryNormalizeAnonId(string? raw, out string? anonId)
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            anonId = null;
+            return true;
+        }
+
+        var trimmed = raw.Trim();
+        if (trimmed.Length > MaxAnonIdLength)
+        {
+            anonId = null;
+            return false;
+        }
+
+        anonId = trimmed;
+        return true;
+    }
+}

DeepDrftAPI/Controllers/ReleaseController.cs

@@ -67,11 +67,17 @@ public class ReleaseController : ControllerBase
     }
 
     // GET api/release/{entryKey}/mix/waveform (unauthenticated)
-    // Serves the high-res waveform datum for a Mix release as base64. Mirrors GET api/track/{id}/waveform
-    // but reads from the mix-waveforms vault. 404 when the release is not a Mix, carries no waveform key,
-    // or no datum is stored. Public read — addresses by the opaque EntryKey, not the int PK (§3e). The
-    // {entryKey} string segment cannot collide with the ApiKey-gated POST {id:long}/mix/waveform (different
-    // verb + constraint). Declared before the shorter "{entryKey}" route for clarity.
+    // Serves the high-res waveform datum for a Mix release as base64, reading the Mix's track datum from
+    // the track-waveforms vault. 404 when the release is not a Mix, carries no waveform key, or no datum
+    // is stored. Public read — addresses by the opaque EntryKey, not the int PK (§3e). The {entryKey}
+    // string segment cannot collide with the ApiKey-gated POST {id:long}/mix/waveform (different verb +
+    // constraint). Declared before the shorter "{entryKey}" route for clarity.
+    //
+    // LEGACY (phase-12 §5b): the visualizer no longer fetches through this release-addressed route — it
+    // resolves the current track's datum via the track-cardinal GET api/track/{trackEntryKey}/waveform/
+    // high-res. This endpoint is retained as a thin transitional delegate (it serves the identical datum,
+    // since a Mix is single-track) and has no client caller today; remove it once nothing depends on the
+    // release-addressed shape.
     [HttpGet("{entryKey}/mix/waveform")]
     public async Task<ActionResult> GetMixWaveform(string entryKey, CancellationToken ct = default)
     {
@@ -91,7 +97,7 @@ public class ReleaseController : ControllerBase
             return NotFound();
         }
 
-        var bytes = await _waveformProfileService.GetProfileAsync(waveformEntryKey, VaultConstants.MixWaveforms);
+        var bytes = await _waveformProfileService.GetProfileAsync(waveformEntryKey, VaultConstants.TrackWaveforms);
         if (bytes is null)
         {
             _logger.LogInformation("Mix waveform key set but no datum stored for release: {EntryKey}", entryKey);
@@ -106,9 +112,10 @@ public class ReleaseController : ControllerBase
     }
 
     // POST api/release/{id}/mix/waveform ([ApiKeyAuthorize], no body)
-    // Server-side trigger: fetch the Mix's track audio from the vault, compute a 2048-bucket waveform,
-    // store it in the mix-waveforms vault, and set MixMetadata.WaveformEntryKey. 404 when the release is
-    // missing or has no stored audio; 500 on compute/storage failure. Declared before "{id:long}".
+    // Server-side trigger: fetch the Mix's track audio from the vault, compute a duration-derived high-res
+    // waveform via ComputeAndStoreHighResAsync, store it in the track-waveforms vault, and set
+    // MixMetadata.WaveformEntryKey. 404 when the release is missing or has no stored audio; 500 on
+    // compute/storage failure. Declared before "{id:long}".
     [ApiKeyAuthorize]
     [HttpPost("{id:long}/mix/waveform")]
     public async Task<ActionResult> GenerateMixWaveform(long id, CancellationToken ct = default)

DeepDrftAPI/Controllers/StatsController.cs

@@ -0,0 +1,59 @@
+using DeepDrftData;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DeepDrftAPI.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class StatsController : ControllerBase
+{
+    private readonly ITrackService _sqlTrackService;
+    private readonly IEventService _eventService;
+    private readonly ILogger<StatsController> _logger;
+
+    public StatsController(
+        ITrackService sqlTrackService, IEventService eventService, ILogger<StatsController> logger)
+    {
+        _sqlTrackService = sqlTrackService;
+        _eventService = eventService;
+        _logger = logger;
+    }
+
+    // GET api/stats/home (unauthenticated)
+    // Aggregate figures behind the public home hero stat row — one read for all three cards. Same auth
+    // posture as the other public browse reads (GET api/track/page). The figures span two domains:
+    // the track-domain aggregation (Cuts/Mixes cards) lives in the SQL track service; the play-domain
+    // figures (Phase 16 Plays card — total plays + unique listeners) live in the event service. This
+    // controller is the thin composition seam that assembles both into one HomeStatsDto — neither
+    // domain reaches into the other's tables. Play/listener figures are best-effort: a telemetry read
+    // failure (or the not-yet-applied migration) leaves them at zero rather than failing the whole card.
+    [HttpGet("home")]
+    public async Task<ActionResult> GetHome(CancellationToken ct = default)
+    {
+        var trackResult = await _sqlTrackService.GetHomeStats(ct);
+        if (!trackResult.Success || trackResult.Value is null)
+        {
+            var error = trackResult.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError("GetHome stats failed: {Error}", error);
+            return StatusCode(500, "Failed to load stats");
+        }
+
+        var stats = trackResult.Value;
+
+        var playsResult = await _eventService.GetTotalPlayCount(ct);
+        if (playsResult is { Success: true })
+            stats.TotalPlays = playsResult.Value;
+        else
+            _logger.LogWarning("GetHome total-plays read failed; Plays card falls back to 0: {Error}",
+                playsResult.Messages.FirstOrDefault()?.Message);
+
+        var listenersResult = await _eventService.GetDistinctListenerCount(ct);
+        if (listenersResult is { Success: true })
+            stats.UniqueListeners = listenersResult.Value;
+        else
+            _logger.LogWarning("GetHome unique-listeners read failed; secondary line falls back to 0: {Error}",
+                listenersResult.Messages.FirstOrDefault()?.Message);
+
+        return Ok(stats);
+    }
+}

DeepDrftAPI/Controllers/TrackController.cs

@@ -20,6 +20,7 @@ public class TrackController : ControllerBase
     private readonly UnifiedTrackService _unifiedService;
     private readonly ITrackService _sqlTrackService;
     private readonly WaveformProfileService _waveformProfileService;
+    private readonly UploadStagingDirectory _stagingDirectory;
     private readonly ILogger<TrackController> _logger;
 
     // FileDatabase is injected directly for PutTrack because that endpoint receives a pre-processed
@@ -34,6 +35,7 @@ public class TrackController : ControllerBase
         UnifiedTrackService unifiedService,
         ITrackService sqlTrackService,
         WaveformProfileService waveformProfileService,
+        UploadStagingDirectory stagingDirectory,
         ILogger<TrackController> logger)
     {
         _trackContentService = trackContentService;
@@ -41,9 +43,48 @@ public class TrackController : ControllerBase
         _unifiedService = unifiedService;
         _sqlTrackService = sqlTrackService;
         _waveformProfileService = waveformProfileService;
+        _stagingDirectory = stagingDirectory;
         _logger = logger;
     }
 
+    // Builds a unique staging file path on the data disk with the validated extension. The caller MUST
+    // assign this to the local that its finally block guards BEFORE calling StageUploadAsync — that
+    // way a mid-copy abort (OperationCanceledException, IO error) still triggers deletion of the
+    // partially-written file. Staging lives under UploadStagingDirectory, never Path.GetTempPath() —
+    // on the Linux host /tmp is a small tmpfs that cannot hold a large WAV.
+    private string BuildStagingPath(string uploadExtension) =>
+        Path.Combine(_stagingDirectory.Path, Guid.NewGuid().ToString("N") + uploadExtension);
+
+    // Streams an uploaded audio body to the pre-allocated staging path. The caller owns the path and
+    // must delete it in a finally block; separating path generation from the copy ensures the finally
+    // guard fires even when CopyToAsync throws before returning.
+    private async Task StageUploadAsync(
+        IFormFile audioFile, string stagingPath, CancellationToken cancellationToken)
+    {
+        await using var stagingStream = new FileStream(
+            stagingPath, FileMode.CreateNew, FileAccess.Write, FileShare.None,
+            bufferSize: 81920, useAsync: true);
+        await using var uploadStream = audioFile.OpenReadStream();
+        await uploadStream.CopyToAsync(stagingStream, cancellationToken);
+    }
+
+    // Best-effort removal of a staging file. Logs and swallows — a stranded staging file is a
+    // disk-hygiene concern, not a request failure.
+    private void DeleteStagingFile(string stagingPath)
+    {
+        try
+        {
+            if (System.IO.File.Exists(stagingPath))
+            {
+                System.IO.File.Delete(stagingPath);
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to delete staging file {StagingPath}", stagingPath);
+        }
+    }
+
     // --- Literal-segment routes first ---
     // These are declared before the parameterized "{trackId}" / "{id:long}" actions so route
     // resolution never treats "page", "upload", or "meta" as a trackId.
@@ -96,6 +137,37 @@ public class TrackController : ControllerBase
         return Ok(result.Value);
     }
 
+    // GET api/track/release/exists?title=...&artist=... ([ApiKeyAuthorize])
+    // Upload-form pre-flight: does a release with this exact (title, artist) already exist? Returns the
+    // matching ReleaseDto (so the caller can name it in the block message) or 404 when none exists. Uses
+    // the same GetReleaseByTitleAndArtist read the upload create-path duplicate guard uses, so the
+    // pre-flight and the server backstop agree on the match by construction (exact ordinal comparison,
+    // soft-deleted rows excluded). "release/exists" is a literal 2-segment route declared before the
+    // parameterized "{trackId}" route and distinct from "release/{id:long}" (different segment shape).
+    [ApiKeyAuthorize]
+    [HttpGet("release/exists")]
+    public async Task<ActionResult> ReleaseExists(
+        [FromQuery] string? title,
+        [FromQuery] string? artist,
+        CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(title) || string.IsNullOrWhiteSpace(artist))
+            return BadRequest("title and artist are both required");
+
+        var result = await _sqlTrackService.GetReleaseByTitleAndArtist(title, artist, ct);
+        if (!result.Success)
+        {
+            var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError("ReleaseExists failed for ({Title}, {Artist}): {Error}", title, artist, error);
+            return StatusCode(500, "Failed to check release");
+        }
+
+        if (result.Value is null)
+            return NotFound();
+
+        return Ok(result.Value);
+    }
+
     // GET api/track/genres (unauthenticated)
     // Distinct non-null genres with track counts. Public browse data, same posture as GET
     // api/track/page. Literal segment, declared before the parameterized "{trackId}" route.
@@ -138,8 +210,9 @@ public class TrackController : ControllerBase
     }
 
     // GET api/track/waveform-status ([ApiKeyAuthorize])
-    // Admin backfill view: returns every track with a flag for whether a waveform profile is
-    // stored in the WaveformProfiles vault. The catalogue is small enough that the CMS panel reads
+    // Admin backfill view: returns every track with flags for whether each waveform datum is stored —
+    // the 512-bucket player-bar profile (WaveformProfiles vault) and the per-track high-res visualizer
+    // datum (TrackWaveforms vault, phase-12 §5). The catalogue is small enough that the CMS panel reads
     // the whole list unpaged. Declared before the parameterized "{trackId}" route so the literal
     // segment is never treated as a trackId.
     [ApiKeyAuthorize]
@@ -158,31 +231,54 @@ public class TrackController : ControllerBase
         foreach (var track in tracks.Value)
         {
             var profile = await _waveformProfileService.GetProfileAsync(track.EntryKey);
+            var highRes = await _waveformProfileService.GetProfileAsync(track.EntryKey, VaultConstants.TrackWaveforms);
             status.Add(new WaveformStatusDto
             {
                 TrackId = track.Id,
                 EntryKey = track.EntryKey,
                 TrackName = track.TrackName,
                 HasProfile = profile is not null,
+                HasHighRes = highRes is not null,
             });
         }
 
         return Ok(status);
     }
 
+    // POST api/track/duration/backfill ([ApiKeyAuthorize], no body)
+    // One-time admin backfill: for every track whose SQL duration is still null, read the duration from
+    // the vault audio and write it to SQL. Mirrors the waveform backfill posture. Idempotent — a re-run
+    // only touches still-missing rows. Returns { updated, skipped }. Declared in the literal-route block
+    // (before "{trackId}") so the segment is never treated as a trackId.
+    [ApiKeyAuthorize]
+    [HttpPost("duration/backfill")]
+    public async Task<ActionResult> BackfillDurations(CancellationToken cancellationToken)
+    {
+        var result = await _unifiedService.BackfillDurationsAsync(cancellationToken);
+        if (!result.Success)
+        {
+            var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError("BackfillDurations failed: {Error}", error);
+            return StatusCode(500, error);
+        }
+
+        return Ok(new { updated = result.Value.Updated, skipped = result.Value.Skipped });
+    }
+
     // POST api/track/upload: raw audio in (multipart/form-data) + metadata → persisted TrackDto out.
     // Accepts .wav, .mp3, and .flac. Used by the CMS upload flow on DeepDrftManager; that host
     // proxies the upload here so it never touches the vault disk path or SQL directly.
     // UnifiedTrackService owns the two-database write.
     //
-    // RequestSizeLimit/MultipartBodyLengthLimit set to 1 GB: audio uploads can be tens to hundreds
-    // of MB and the framework defaults (~28 MB) reject them outright. The IFormFile path streams
-    // the body to a temp file once Kestrel surfaces it, so the limit is the per-request ceiling,
-    // not a buffered allocation.
+    // RequestSizeLimit/MultipartBodyLengthLimit set to ~1.86 GB: audio uploads can be tens to
+    // hundreds of MB (or over a GB for high-res WAVs); the framework defaults (~28 MB) reject them
+    // outright. The IFormFile path streams the body to a temp file once Kestrel surfaces it, so the
+    // limit is the per-request ceiling, not a buffered allocation. 2_000_000_000 stays below
+    // int.MaxValue (2,147,483,647) so it is safe where limits are int-typed.
     [ApiKeyAuthorize]
     [HttpPost("upload")]
-    [RequestSizeLimit(1_073_741_824)]
-    [RequestFormLimits(MultipartBodyLengthLimit = 1_073_741_824)]
+    [RequestSizeLimit(2_000_000_000)]
+    [RequestFormLimits(MultipartBodyLengthLimit = 2_000_000_000)]
     public async Task<ActionResult<DeepDrftModels.DTOs.TrackDto>> UploadTrack(
         [FromForm] IFormFile? audioFile,
         [FromForm] string? trackName,
@@ -196,6 +292,7 @@ public class TrackController : ControllerBase
         [FromForm] string? releaseType,
         [FromForm] string? medium,
         [FromForm] int? trackNumber,
+        [FromForm] long? releaseId,
         CancellationToken cancellationToken)
     {
         _logger.LogInformation("UploadTrack called: trackName={TrackName}, artist={Artist}, fileName={FileName}, size={Size}",
@@ -263,23 +360,15 @@ public class TrackController : ControllerBase
 
         var resolvedTrackNumber = trackNumber is > 0 ? trackNumber.Value : 1;
 
-        // The processor router selects by extension and reads from disk, so the temp file must carry
-        // the upload's real extension. Path.GetTempFileName() yields .tmp, which the router rejects —
-        // generate our own path preserving the validated .wav/.mp3/.flac extension.
-        var tempPath = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N") + uploadExtension);
-
+        // Build the staging path before the copy so the finally block can delete the partial file
+        // even if CopyToAsync throws mid-stream (client cancellation, disk-full, IO error).
+        var stagingPath = BuildStagingPath(uploadExtension);
         try
         {
-            await using (var tempStream = new FileStream(
-                tempPath, FileMode.CreateNew, FileAccess.Write, FileShare.None,
-                bufferSize: 81920, useAsync: true))
-            await using (var uploadStream = audioFile.OpenReadStream())
-            {
-                await uploadStream.CopyToAsync(tempStream, cancellationToken);
-            }
+            await StageUploadAsync(audioFile, stagingPath, cancellationToken);
 
             var result = await _unifiedService.UploadAsync(
-                tempPath,
+                stagingPath,
                 trackName,
                 artist,
                 string.IsNullOrWhiteSpace(album) ? null : album,
@@ -291,6 +380,7 @@ public class TrackController : ControllerBase
                 parsedReleaseType,
                 parsedMedium,
                 resolvedTrackNumber,
+                releaseId,
                 cancellationToken);
 
             if (!result.Success || result.Value is null)
@@ -298,14 +388,19 @@ public class TrackController : ControllerBase
                 var error = result.Messages.FirstOrDefault()?.Message ?? "Failed to process and store audio";
                 _logger.LogWarning("UploadTrack: UnifiedTrackService failed for {TrackName}: {Error}", trackName, error);
 
-                // A cardinality rejection is a well-formed request that violates a domain rule, so it
-                // is 409 Conflict — distinct from the 500 used for processing failure. The marker is
-                // stripped so the client sees only the human-readable detail.
+                // A cardinality or duplicate-release rejection is a well-formed request that violates a
+                // domain rule, so it is 409 Conflict — distinct from the 500 used for processing failure.
+                // The marker is stripped so the client sees only the human-readable detail.
                 if (error.StartsWith(UnifiedTrackService.CardinalityViolationMarker, StringComparison.Ordinal))
                 {
                     return Conflict(error[UnifiedTrackService.CardinalityViolationMarker.Length..]);
                 }
 
+                if (error.StartsWith(UnifiedTrackService.DuplicateReleaseMarker, StringComparison.Ordinal))
+                {
+                    return Conflict(error[UnifiedTrackService.DuplicateReleaseMarker.Length..]);
+                }
+
                 return StatusCode(500, error);
             }
 
@@ -319,17 +414,7 @@ public class TrackController : ControllerBase
         }
         finally
         {
-            try
-            {
-                if (System.IO.File.Exists(tempPath))
-                {
-                    System.IO.File.Delete(tempPath);
-                }
-            }
-            catch (Exception ex)
-            {
-                _logger.LogWarning(ex, "UploadTrack: failed to delete temp file {TempPath}", tempPath);
-            }
+            DeleteStagingFile(stagingPath);
         }
     }
 
@@ -476,6 +561,69 @@ public class TrackController : ControllerBase
         return StatusCode(500, error);
     }
 
+    // POST api/track/{id}/replace-audio ([ApiKeyAuthorize])
+    // Swap an existing track's audio bytes from a raw upload, preserving the track's id, EntryKey,
+    // release membership, position, and metadata. UnifiedTrackService.ReplaceAudioAsync owns the
+    // vault swap + waveform regen; nothing in SQL is written. Mirrors the upload endpoint's temp-file
+    // streaming and ~1.86 GB ceiling (a WAV replace is a large-body upload like the original). The
+    // literal "{id:long}/replace-audio" segment is declared in the literal-route block so it never
+    // resolves to the parameterized "{trackId}" GET.
+    [ApiKeyAuthorize]
+    [HttpPost("{id:long}/replace-audio")]
+    [RequestSizeLimit(2_000_000_000)]
+    [RequestFormLimits(MultipartBodyLengthLimit = 2_000_000_000)]
+    public async Task<ActionResult> ReplaceAudio(
+        long id,
+        [FromForm] IFormFile? audioFile,
+        CancellationToken cancellationToken)
+    {
+        _logger.LogInformation("ReplaceAudio called: id={Id}, size={Size}", id, audioFile?.Length);
+
+        if (audioFile is null || audioFile.Length == 0)
+        {
+            return BadRequest("Audio file is required");
+        }
+
+        var uploadExtension = Path.GetExtension(audioFile.FileName).ToLowerInvariant();
+        if (uploadExtension is not (".wav" or ".mp3" or ".flac"))
+        {
+            return BadRequest("Uploaded file must have a .wav, .mp3, or .flac extension");
+        }
+
+        // Build the staging path before the copy so the finally block can delete the partial file
+        // even if CopyToAsync throws mid-stream (client cancellation, disk-full, IO error).
+        var stagingPath = BuildStagingPath(uploadExtension);
+        try
+        {
+            await StageUploadAsync(audioFile, stagingPath, cancellationToken);
+
+            var result = await _unifiedService.ReplaceAudioAsync(id, stagingPath, cancellationToken);
+            if (result.Success)
+            {
+                _logger.LogInformation("ReplaceAudio succeeded: id={Id}", id);
+                return Ok();
+            }
+
+            var error = result.Messages.FirstOrDefault()?.Message ?? "Failed to replace audio";
+            if (string.Equals(error, UnifiedTrackService.TrackNotFoundMessage, StringComparison.Ordinal))
+            {
+                return NotFound();
+            }
+
+            _logger.LogError("ReplaceAudio failed for id {Id}: {Error}", id, error);
+            return StatusCode(500, error);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "ReplaceAudio failed for id {Id}", id);
+            return StatusCode(500, "Internal server error");
+        }
+        finally
+        {
+            DeleteStagingFile(stagingPath);
+        }
+    }
+
     // DELETE api/track/release/{id} ([ApiKeyAuthorize])
     // Soft-delete a release row directly. Used by the albums browser to remove an orphaned release
     // (one with no live tracks). "release" is a literal segment, declared here in the literal-route
@@ -574,6 +722,31 @@ public class TrackController : ControllerBase
         });
     }
 
+    // GET api/track/{trackId}/waveform/high-res (unauthenticated)
+    // Track-cardinal high-res datum fetch (phase-12 §5b): returns the per-track high-res waveform datum
+    // from the track-waveforms vault, base64-encoded, keyed by EntryKey. This is what the lava visualizer
+    // fetches for whatever track is currently playing/selected — the release is only addressing context.
+    // Distinct from GET {trackId}/waveform (the 512-bucket player-bar profile in the default vault): the
+    // "high-res" suffix selects the duration-derived TrackWaveforms datum. 404 when no high-res datum is
+    // stored (a track not yet backfilled — the visualizer blanks gracefully). Declared before the
+    // parameterized PUT "{trackId}" route so the literal "waveform/high-res" segment wins.
+    [HttpGet("{trackId}/waveform/high-res")]
+    public async Task<ActionResult> GetHighResWaveform(string trackId)
+    {
+        var bytes = await _waveformProfileService.GetProfileAsync(trackId, VaultConstants.TrackWaveforms);
+        if (bytes is null)
+        {
+            _logger.LogInformation("No high-res waveform datum for track: {TrackId}", trackId);
+            return NotFound();
+        }
+
+        return Ok(new WaveformProfileDto
+        {
+            BucketCount = bytes.Length,
+            Data = Convert.ToBase64String(bytes),
+        });
+    }
+
     // POST api/track/{trackId}/waveform ([ApiKeyAuthorize])
     // Admin backfill: compute and store a waveform profile for an existing track from its vault
     // audio. trackId is the EntryKey. 404 when no audio is stored under that key; 500 when the
@@ -600,6 +773,35 @@ public class TrackController : ControllerBase
         return Ok();
     }
 
+    // POST api/track/{trackId}/waveform/high-res ([ApiKeyAuthorize])
+    // Track-cardinal generalization of the Mix-only waveform trigger (phase-12 §5): compute and store
+    // the per-track high-res datum for ANY track from its vault audio, keyed by EntryKey in the
+    // track-waveforms vault. Drives the CMS per-row "Generate high-res" action and the batch backfill.
+    // Re-runnable: a second call recomputes and overwrites. trackId is the EntryKey. 404 when no audio
+    // is stored under that key; 500 when the WAV cannot be decoded or the vault write fails. Declared
+    // before the parameterized PUT "{trackId}" route so the literal "waveform/high-res" segment wins.
+    [ApiKeyAuthorize]
+    [HttpPost("{trackId}/waveform/high-res")]
+    public async Task<ActionResult> GenerateHighResWaveform(string trackId)
+    {
+        var audio = await _trackContentService.GetAudioBinaryAsync(trackId);
+        if (audio is null)
+        {
+            _logger.LogWarning("GenerateHighResWaveform: no audio in vault for {TrackId}", trackId);
+            return NotFound();
+        }
+
+        var stored = await _waveformProfileService.ComputeAndStoreHighResAsync(
+            audio.Buffer, trackId, audio.Duration);
+        if (!stored)
+        {
+            _logger.LogError("GenerateHighResWaveform: computation/storage failed for {TrackId}", trackId);
+            return StatusCode(500, "Failed to generate high-res waveform datum.");
+        }
+
+        return Ok();
+    }
+
     [ApiKeyAuthorize]
     [HttpPut("{trackId}")]
     public async Task<ActionResult> PutTrack(string trackId, [FromBody] AudioBinaryDto track)

DeepDrftAPI/DeepDrftAPI.csproj

@@ -15,7 +15,13 @@
         <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
         <!-- AuthBlocks API host surface: AddAuthBlocks / MapAuthBlocks / UseAuthBlocksStartupAsync.
              The Manager keeps only Cerebellum.AuthBlocks.Web (web-side auth, no signing secret). -->
-        <PackageReference Include="Cerebellum.AuthBlocks" Version="10.3.33" />
+        <PackageReference Include="Cerebellum.AuthBlocks" Version="10.3.39" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <!-- Exposes the internal 409 markers (CardinalityViolationMarker / DuplicateReleaseMarker) to the
+           test suite so UploadDuplicateDetectionTests can assert the orchestrator's rejection contract. -->
+      <InternalsVisibleTo Include="DeepDrftTests" />
     </ItemGroup>
 
     <ItemGroup>
@@ -26,3 +32,4 @@
 
 
 </Project>
+

DeepDrftAPI/Models/UploadSettings.cs

@@ -0,0 +1,13 @@
+namespace DeepDrftAPI.Models
+{
+    /// <summary>
+    /// Non-secret upload tunables. <see cref="StagingPath"/> is the directory used to stage the raw
+    /// audio body during upload/replace-audio. It must live on the data disk, never the system temp
+    /// mount (on the Linux host <c>/tmp</c> is a small RAM-backed tmpfs that cannot hold a multi-hundred-MB
+    /// WAV). When null/empty it defaults to a "staging" subdirectory under the FileDatabase vault path.
+    /// </summary>
+    public class UploadSettings
+    {
+        public string? StagingPath { get; set; }
+    }
+}

DeepDrftAPI/Models/UploadStagingDirectory.cs

@@ -0,0 +1,10 @@
+namespace DeepDrftAPI.Models
+{
+    /// <summary>
+    /// The resolved, on-disk staging directory for upload/replace-audio bodies. Resolved once at
+    /// startup from <see cref="UploadSettings"/> (or the vault path default) and guaranteed to exist.
+    /// Injected into <c>TrackController</c> so the upload path never stages on the system temp mount.
+    /// A typed wrapper rather than a bare string so DI resolves it unambiguously.
+    /// </summary>
+    public sealed record UploadStagingDirectory(string Path);
+}

DeepDrftAPI/Program.cs

@@ -8,8 +8,10 @@ using DeepDrftData;
 using DeepDrftData.Data;
 using DeepDrftData.Repositories;
 using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 using NetBlocks.Utilities.Environment;
+using System.Threading.RateLimiting;
 
 // Required credential files — must exist before the app will start.
 // Production secrets stay gitignored; the *.example.json templates at the project root show the shape.
@@ -64,6 +66,14 @@ builder.Services
     .AddScoped<ITrackService>(sp => sp.GetRequiredService<TrackManager>());
 builder.Services.AddScoped<UnifiedTrackService>();
 
+// Phase 16 anonymous telemetry — append-only event logs + incremental play-counter rollup (all SQL).
+// EventManager is the IEventService boundary; EventRepository owns the EF writes and the
+// release-resolution + counter-bump transaction.
+builder.Services
+    .AddScoped<EventRepository>()
+    .AddScoped<EventManager>()
+    .AddScoped<IEventService>(sp => sp.GetRequiredService<EventManager>());
+
 // Release domain — medium-aware read projection + satellite metadata writes. ReleaseManager is the
 // IReleaseService implementation; UnifiedReleaseService orchestrates the vault + SQL satellite writes.
 builder.Services
@@ -93,10 +103,13 @@ builder.Services.AddAuthBlocks(options =>
     options.JwtSettings.Audience = builder.Configuration["AuthBlocks:Jwt:Audience"]
         ?? throw new InvalidOperationException("AuthBlocks:Jwt:Audience is required");
 
-    options.EmailConnection.Host  = builder.Configuration["AuthBlocks:Email:Host"]
+    options.EmailConnection.Host        = builder.Configuration["AuthBlocks:Email:Host"]
         ?? throw new InvalidOperationException("AuthBlocks:Email:Host is required");
-    options.EmailConnection.Token = builder.Configuration["AuthBlocks:Email:Token"]
+    options.EmailConnection.Token       = builder.Configuration["AuthBlocks:Email:Token"]
         ?? throw new InvalidOperationException("AuthBlocks:Email:Token is required");
+    options.EmailConnection.FromAddress = builder.Configuration["AuthBlocks:Email:From"]
+        ?? throw new InvalidOperationException("AuthBlocks:Email:From is required");
+    options.EmailConnection.TestInbox   = builder.Configuration["AuthBlocks:Email:TestInbox"];
 
     options.AdminUserSettings = new AdminUserSettings
     {
@@ -118,6 +131,25 @@ builder.Services.Configure<ForwardedHeadersOptions>(options =>
     options.KnownProxies.Clear();
 });
 
+// Per-IP rate limiting for the anonymous telemetry intake (Phase 16 §2.5). Coarse and stateless —
+// a fixed window keyed by the (forwarded) remote IP. The substrate sits behind nginx, so the real
+// client IP is the X-Forwarded-For value UseForwardedHeaders resolves into Connection.RemoteIpAddress.
+// On limit, reject with 429 (the beacon ignores it; this only blunts casual inflation). The 30-window
+// budget is generous for a real listening session and only bites on scripted spam.
+builder.Services.AddRateLimiter(options =>
+{
+    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+    options.AddPolicy("events", httpContext =>
+        RateLimitPartition.GetFixedWindowLimiter(
+            partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+            factory: _ => new FixedWindowRateLimiterOptions
+            {
+                PermitLimit = 30,
+                Window = TimeSpan.FromMinutes(1),
+                QueueLimit = 0,
+            }));
+});
+
 var app = builder.Build();
 
 // Apply AuthBlocks EF migrations, seed system roles, seed admin user on first boot.
@@ -136,6 +168,11 @@ if (app.Environment.IsDevelopment())
 
 app.UseCors("ContentApiPolicy");
 
+// Rate limiter must sit in the pipeline for the [EnableRateLimiting("events")] attribute on
+// EventController to take effect. Only the telemetry endpoints carry the policy; everything else is
+// unaffected (no global limiter is set).
+app.UseRateLimiter();
+
 // ApiKey middleware only enforces on endpoints tagged [ApiKeyAuthorize] (the track surface); it
 // passes all other endpoints through. JWT auth/authorization gate the AuthBlocks endpoints, which
 // carry no [ApiKeyAuthorize] metadata — the two schemes are orthogonal and do not interfere.

DeepDrftAPI/Services/UnifiedReleaseService.cs

@@ -102,9 +102,12 @@ public class UnifiedReleaseService
     /// <summary>
     /// Fetch the Mix's track audio from the vault, compute a high-res waveform datum at a constant time
     /// resolution (≈333 samples/sec derived from the track's duration; see
-    /// <see cref="MixWaveformResolution"/>), store it in the MixWaveforms vault under the track's
+    /// <see cref="WaveformResolution"/>), store it in the TrackWaveforms vault under the track's
     /// EntryKey, then point the release's Mix satellite at that same key. The datum key equals the
-    /// track's EntryKey — the Mix is single-track.
+    /// track's EntryKey — the Mix is single-track. Under the per-track model (phase-12 §5) this is the
+    /// same datum every track now carries. The visualizer fetches it via the track-cardinal
+    /// <c>GET api/track/{trackEntryKey}/waveform/high-res</c> (12.B2); the Mix satellite link and the
+    /// legacy release-addressed read path are retained transitionally and no longer feed the visualizer.
     /// </summary>
     public async Task<Result> TriggerMixWaveformAsync(long releaseId, CancellationToken ct)
     {
@@ -148,10 +151,10 @@ public class UnifiedReleaseService
         }
 
         // Duration-derived, constant-time-resolution capture (≈333 samples/sec) so long mixes are not
-        // under-sampled by a fixed bucket count — see MixWaveformResolution / spec §F.
-        var bucketCount = MixWaveformResolution.BucketCountForDuration(audio.Duration);
-        var computed = await _waveformProfileService.ComputeAndStoreAsync(
-            audio.Buffer, entryKey, bucketCount, VaultConstants.MixWaveforms);
+        // under-sampled by a fixed bucket count — see WaveformResolution / spec §F. Same per-track
+        // high-res datum every track now carries (phase-12 §5).
+        var computed = await _waveformProfileService.ComputeAndStoreHighResAsync(
+            audio.Buffer, entryKey, audio.Duration);
         if (!computed)
         {
             _logger.LogError("TriggerMixWaveform: waveform computation/storage failed for {EntryKey}", entryKey);

DeepDrftAPI/Services/UnifiedTrackService.cs

@@ -25,6 +25,16 @@ public class UnifiedTrackService
     /// follows the marker and is what the CMS surfaces to the admin.
     /// </summary>
     internal const string CardinalityViolationMarker = "CARDINALITY_VIOLATION: ";
+
+    /// <summary>
+    /// Stable marker prefixed onto a duplicate-release rejection so the controller can map it to 409
+    /// Conflict, the same way <see cref="CardinalityViolationMarker"/> is mapped. Fires when an upload
+    /// with no explicit releaseId would create a release whose (title, artist) already exists in the
+    /// catalogue — the upload form is a create-new tool, never an edit/append path. The human-readable
+    /// detail follows the marker and is what the CMS surfaces to the admin.
+    /// </summary>
+    internal const string DuplicateReleaseMarker = "DUPLICATE_RELEASE: ";
+
     private readonly TrackContentService _contentTrackContentService;
     private readonly ITrackService _sqlTrackService;
     private readonly FileDb _fileDatabase;
@@ -64,33 +74,66 @@ public class UnifiedTrackService
         ReleaseType releaseType,
         ReleaseMedium medium,
         int trackNumber,
+        long? releaseId,
         CancellationToken ct)
     {
-        // Cardinality pre-check — BEFORE the vault write so a rejected over-limit add never orphans
-        // audio in the tracks vault. This is a READ-only peek (no release is created for an upload we
-        // may reject); the real FindOrCreateRelease still runs below for the accepted path. Only the
-        // find path can violate: a release that does not yet exist has zero tracks and admits its
-        // first. The guard is the general form `(liveCount + 1) > Max`, not Session/Mix-hardcoded, so
-        // a future bounded medium is covered by the same line.
+        // Resolve which release this track lands on BEFORE the vault write, so a rejected upload never
+        // orphans audio. Two paths:
+        //   - releaseId is null  → CREATE path: this is the first row of a submit. (title, artist) must
+        //     NOT already exist — the upload form creates new releases only. A pre-existing match is a
+        //     duplicate and is blocked (409).
+        //   - releaseId is set   → ATTACH path: rows 2..N of a within-batch multi-track Cut, attaching
+        //     to the release row 1 just created. No (title, artist) lookup — the release id is
+        //     authoritative — so the within-batch build is never mistaken for a pre-existing duplicate.
+        // Both paths run the cardinality guard `(liveCount + 1) > Max` (not Session/Mix-hardcoded, so a
+        // future bounded medium is covered by the same line).
+        ResolvedRelease? resolved = null;
         if (!string.IsNullOrWhiteSpace(album))
         {
-            var peek = await _sqlTrackService.GetReleaseByTitleAndArtist(album, artist, ct);
-            if (!peek.Success)
+            if (releaseId is { } attachId)
             {
-                var error = peek.Messages.FirstOrDefault()?.Message ?? "Unknown error";
-                _logger.LogError("UploadAsync: release peek failed for ({Album}, {Artist}): {Error}", album, artist, error);
-                return ResultContainer<TrackDto>.CreateFailResult($"Could not verify the release: {error}");
-            }
+                var attachPeek = await _sqlTrackService.GetReleaseByTitleAndArtist(album, artist, ct);
+                if (!attachPeek.Success)
+                {
+                    var error = attachPeek.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                    _logger.LogError("UploadAsync: release peek failed for ({Album}, {Artist}): {Error}", album, artist, error);
+                    return ResultContainer<TrackDto>.CreateFailResult($"Could not verify the release: {error}");
+                }
 
-            if (peek.Value is { } existing)
-            {
-                var cardinality = MediumRules.CardinalityOf(existing.Medium);
-                if (existing.TrackCount + 1 > cardinality.Max)
+                // The attach target must be the same release the natural key resolves to — a guard against
+                // a stale/forged releaseId pointing at a different (title, artist) than this row carries.
+                if (attachPeek.Value is not { } target || target.Id != attachId)
                 {
                     return ResultContainer<TrackDto>.CreateFailResult(
-                        $"{CardinalityViolationMarker}A {existing.Medium} release holds a single track; " +
-                        $"'{existing.Title}' already has one — edit the existing track or choose a different release.");
+                        $"{DuplicateReleaseMarker}The release this track should attach to could not be found. " +
+                        "Start the upload again.");
                 }
+
+                var cardinalityCheck = CheckCardinality(target);
+                if (cardinalityCheck is { } violation)
+                    return ResultContainer<TrackDto>.CreateFailResult(violation);
+
+                resolved = new ResolvedRelease(target.Id);
+            }
+            else
+            {
+                var peek = await _sqlTrackService.GetReleaseByTitleAndArtist(album, artist, ct);
+                if (!peek.Success)
+                {
+                    var error = peek.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                    _logger.LogError("UploadAsync: release peek failed for ({Album}, {Artist}): {Error}", album, artist, error);
+                    return ResultContainer<TrackDto>.CreateFailResult($"Could not verify the release: {error}");
+                }
+
+                // CREATE path: a pre-existing (title, artist) is a duplicate. Block it — the form never
+                // edits or appends to an existing release.
+                if (peek.Value is { } existing)
+                {
+                    return ResultContainer<TrackDto>.CreateFailResult(
+                        $"{DuplicateReleaseMarker}A release titled '{existing.Title}' by {existing.Artist} already " +
+                        "exists. The upload form creates new releases only — use the edit tools to change an existing one.");
+                }
+                // resolved stays null → FindOrCreateRelease below creates the release.
             }
         }
 
@@ -109,9 +152,12 @@ public class UnifiedTrackService
         // shared release (created on first sighting); an upload without one stays a loose track with
         // a null ReleaseId. Release-cardinal metadata (artist/genre/description/releaseDate/type/uploader)
         // rides on the release, not the track.
-        long? releaseId = null;
-        if (!string.IsNullOrWhiteSpace(album))
+        long? resolvedReleaseId = resolved?.Id;
+        if (!string.IsNullOrWhiteSpace(album) && resolvedReleaseId is null)
         {
+            // CREATE path only: the duplicate guard above proved no (title, artist) match exists, so this
+            // mints the release. (The attach path already resolved the id from the pre-check above and
+            // skips FindOrCreateRelease entirely, so a within-batch row never re-runs the natural-key find.)
             var releaseData = new ReleaseDto
             {
                 Title = album,
@@ -124,13 +170,13 @@ public class UnifiedTrackService
                 CreatedByUserId = createdByUserId,
             };
 
-            // Medium (like every other field in releaseData) applies only when this upload CREATES the
-            // release. FindOrCreateRelease returns an existing (title, artist) row untouched — the first
-            // upload's medium is authoritative. Do NOT "fix" this to overwrite the stored medium on a
-            // subsequent track add: medium is a release-level property, changed only via the edit path
-            // (PUT api/track/meta), never silently flipped by adding a track to an existing release.
+            // FindOrCreateRelease either creates a fresh release (WasCreated = true) or returns the
+            // row the concurrent winner just inserted (WasCreated = false). In the CREATE path the
+            // duplicate peek above already verified no pre-existing row exists — so WasCreated = false
+            // means we lost a concurrent-insert race. Treat that as the duplicate condition: reject
+            // rather than silently attaching, keeping the DB unique index as the final safety net.
             var releaseResult = await _sqlTrackService.FindOrCreateRelease(album, artist, releaseData, ct);
-            if (!releaseResult.Success || releaseResult.Value is null)
+            if (!releaseResult.Success)
             {
                 var error = releaseResult.Messages.FirstOrDefault()?.Message ?? "Unknown error";
                 _logger.LogError(
@@ -139,11 +185,21 @@ public class UnifiedTrackService
                 return ResultContainer<TrackDto>.CreateFailResult($"Track was uploaded but could not be saved: {error}");
             }
 
-            releaseId = releaseResult.Value.Id;
+            var (resolvedRelease, wasCreated) = releaseResult.Value;
+            if (!wasCreated)
+            {
+                // The winning concurrent upload created this release between our peek and our insert.
+                // Reject with the same marker the pre-flight peek uses so the controller maps it to 409.
+                return ResultContainer<TrackDto>.CreateFailResult(
+                    $"{DuplicateReleaseMarker}A release titled '{resolvedRelease.Title}' by {resolvedRelease.Artist} already " +
+                    "exists. The upload form creates new releases only — use the edit tools to change an existing one.");
+            }
+
+            resolvedReleaseId = resolvedRelease.Id;
         }
 
         var trackDto = TrackConverter.Convert(unpersisted);
-        trackDto.ReleaseId = releaseId;
+        trackDto.ReleaseId = resolvedReleaseId;
         trackDto.Release = null; // FK already resolved; Create must not re-resolve a detached graph.
 
         var saveResult = await _sqlTrackService.Create(trackDto);
@@ -158,25 +214,171 @@ public class UnifiedTrackService
             return ResultContainer<TrackDto>.CreateFailResult($"Track was uploaded but could not be saved: {error}");
         }
 
-        // Best-effort waveform profile: both stores succeeded, so the upload is a success
-        // regardless of the profile outcome. A missing profile renders as a flat seekbar on the
+        // Best-effort waveform datums: both stores succeeded, so the upload is a success regardless of
+        // the datum outcome. A missing datum renders as a flat seekbar / blank visualizer on the
         // frontend, so a failure here is logged and swallowed — never fails the upload.
-        await TryStoreWaveformProfileAsync(tempFilePath, unpersisted.EntryKey, ct);
+        await TryStoreWaveformDatumsAsync(unpersisted.EntryKey, ct);
 
         return saveResult;
     }
 
-    private async Task TryStoreWaveformProfileAsync(string tempFilePath, string entryKey, CancellationToken ct)
+    // The release a track resolved onto before the vault write. A null Id is the create path (mint
+    // below); a non-null Id is the attach path (a within-batch multi-track Cut row 2..N).
+    private readonly record struct ResolvedRelease(long Id);
+
+    // The cardinality guard shared by the attach path and (historically) the create path: a release
+    // already at its medium's Max rejects a further track. Returns the marker-prefixed rejection
+    // message, or null when the add is within limits. The create path never trips this (a brand-new
+    // release has zero tracks and admits its first), so only the attach path calls it today.
+    private static string? CheckCardinality(ReleaseDto release)
     {
+        var cardinality = MediumRules.CardinalityOf(release.Medium);
+        if (release.TrackCount + 1 > cardinality.Max)
+        {
+            return $"{CardinalityViolationMarker}A {release.Medium} release holds a single track; " +
+                   $"'{release.Title}' already has one — edit the existing track or choose a different release.";
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Replace an existing track's audio in place: look up the SQL row, swap only the vault bytes
+    /// keyed by its EntryKey, regenerate both waveform datums from the new audio, then write the
+    /// new duration to SQL. Track id, EntryKey, release membership, track number, and all other
+    /// metadata are preserved. The waveform regen is best-effort (a missing datum renders as a flat
+    /// seekbar / blank visualizer downstream), so a datum failure is logged and swallowed rather than
+    /// failing the replace. The duration write is not best-effort — a failure is surfaced so derived
+    /// aggregates (e.g. MixRuntimeSeconds) do not silently go stale. No release-cardinality cascade
+    /// applies: the track count is unchanged, so the single-track-Mix case stays intact.
+    /// </summary>
+    public async Task<Result> ReplaceAudioAsync(long trackId, string tempFilePath, CancellationToken ct)
+    {
+        var lookup = await _sqlTrackService.GetById(trackId);
+        if (!lookup.Success)
+        {
+            var error = lookup.Messages.FirstOrDefault()?.Message ?? "unknown error";
+            _logger.LogError("ReplaceAudioAsync: GetById failed for track {TrackId}: {Error}", trackId, error);
+            return Result.CreateFailResult("Failed to load track.");
+        }
+
+        if (lookup.Value is null)
+        {
+            return Result.CreateFailResult(TrackNotFoundMessage);
+        }
+
+        var entryKey = lookup.Value.EntryKey;
+
+        var newAudio = await _contentTrackContentService.ReplaceTrackAudioAsync(entryKey, tempFilePath);
+        if (newAudio is null)
+        {
+            _logger.LogWarning("ReplaceAudioAsync: content swap returned null for track {TrackId} ({EntryKey})", trackId, entryKey);
+            return Result.CreateFailResult("Failed to process and store the replacement audio.");
+        }
+
+        // The old waveform no longer matches the new bytes. Regenerate both datums in place; keyed
+        // by the same EntryKey, the re-run overwrites the stale data (proven re-runnable). The
+        // freshly stored buffer is the authoritative source — no re-read of the vault needed.
         try
         {
-            var wavBytes = await File.ReadAllBytesAsync(tempFilePath, ct);
-            await _waveformProfileService.ComputeAndStoreAsync(wavBytes, entryKey);
+            await _waveformProfileService.ComputeAndStoreAsync(newAudio.Buffer, entryKey);
+            await _waveformProfileService.ComputeAndStoreHighResAsync(newAudio.Buffer, entryKey, newAudio.Duration);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            _logger.LogError(ex, "Waveform profile step failed for {EntryKey}; upload unaffected.", entryKey);
+            _logger.LogError(ex, "ReplaceAudioAsync: waveform regen failed for {EntryKey}; replace unaffected.", entryKey);
         }
+
+        // Write the new duration to SQL. The vault bytes are already swapped, so this is the
+        // authoritative metadata update for the replace. A failure here is surfaced (unlike the
+        // best-effort waveform regen above) because a stale DurationSeconds silently corrupts
+        // derived aggregates (e.g. MixRuntimeSeconds on the home stats endpoint).
+        var durationWrite = await _sqlTrackService.SetDuration(trackId, newAudio.Duration, ct);
+        if (!durationWrite.Success)
+        {
+            var error = durationWrite.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError(
+                "ReplaceAudioAsync: vault swap succeeded but SQL duration update failed for track {TrackId} ({EntryKey}): {Error}",
+                trackId, entryKey, error);
+            return Result.CreateFailResult("Audio replaced but duration metadata could not be updated.");
+        }
+
+        return Result.CreatePassResult();
+    }
+
+    // Compute and store both waveform datums for a freshly uploaded track: the fixed 512-bucket profile
+    // the player-bar seeker consumes, and the duration-derived high-res datum the lava visualizer
+    // consumes (phase-12 §5 — every track now carries one, computed at upload). Both source the same
+    // audio: read it back from the vault once (the authoritative parsed duration + the stored buffer)
+    // rather than re-reading and re-parsing the temp file. Best-effort throughout — never fails upload.
+    private async Task TryStoreWaveformDatumsAsync(string entryKey, CancellationToken ct)
+    {
+        try
+        {
+            var audio = await _contentTrackContentService.GetAudioBinaryAsync(entryKey);
+            if (audio is null)
+            {
+                _logger.LogWarning(
+                    "Waveform datum step: no audio in vault for {EntryKey} immediately after store; skipping.",
+                    entryKey);
+                return;
+            }
+
+            await _waveformProfileService.ComputeAndStoreAsync(audio.Buffer, entryKey);
+            await _waveformProfileService.ComputeAndStoreHighResAsync(audio.Buffer, entryKey, audio.Duration);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogError(ex, "Waveform datum step failed for {EntryKey}; upload unaffected.", entryKey);
+        }
+    }
+
+    /// <summary>
+    /// One-time backfill: for every non-deleted track whose SQL duration is still null, read the
+    /// processor-extracted runtime from the vault audio (by EntryKey) and write it to SQL. The migration
+    /// cannot read the vault, so this runs at runtime after deploy. Idempotent — a re-run only touches
+    /// rows still missing a duration. Returns (updated, skipped) counts. A per-track vault miss or SQL
+    /// failure is logged and skipped, never aborting the batch.
+    /// </summary>
+    public async Task<ResultContainer<(int Updated, int Skipped)>> BackfillDurationsAsync(CancellationToken ct)
+    {
+        var missing = await _sqlTrackService.GetTracksMissingDuration(ct);
+        if (!missing.Success || missing.Value is null)
+        {
+            var error = missing.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError("BackfillDurationsAsync: failed to load tracks missing duration: {Error}", error);
+            return ResultContainer<(int, int)>.CreateFailResult($"Could not load tracks: {error}");
+        }
+
+        var updated = 0;
+        var skipped = 0;
+        foreach (var track in missing.Value)
+        {
+            ct.ThrowIfCancellationRequested();
+
+            var audio = await _contentTrackContentService.GetAudioBinaryAsync(track.EntryKey);
+            if (audio is null)
+            {
+                _logger.LogWarning("BackfillDurationsAsync: no vault audio for {EntryKey} (track {Id}); skipping.",
+                    track.EntryKey, track.Id);
+                skipped++;
+                continue;
+            }
+
+            var write = await _sqlTrackService.UpdateDuration(track.Id, audio.Duration, ct);
+            if (!write.Success)
+            {
+                var error = write.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                _logger.LogWarning("BackfillDurationsAsync: SQL update failed for track {Id}: {Error}", track.Id, error);
+                skipped++;
+                continue;
+            }
+
+            updated++;
+        }
+
+        _logger.LogInformation("BackfillDurationsAsync complete: {Updated} updated, {Skipped} skipped.", updated, skipped);
+        return ResultContainer<(int, int)>.CreatePassResult((updated, skipped));
     }
 
     /// <summary>

DeepDrftAPI/Startup.cs

@@ -43,13 +43,45 @@ namespace DeepDrftAPI
                 if (db is null) throw new Exception("Unable to initialize file database");
                 InitializeTrackVault(db).GetAwaiter().GetResult();
                 InitializeImageVault(db).GetAwaiter().GetResult();
-                InitializeMixWaveformsVault(db).GetAwaiter().GetResult();
+                InitializeTrackWaveformsVault(db).GetAwaiter().GetResult();
                 return db;
             });
 
+            // Upload staging directory. Large audio bodies (multi-hundred-MB WAVs) must never stage on
+            // the system temp mount — on the Linux host /tmp is a small RAM-backed tmpfs. We move BOTH
+            // on-disk copies of an upload off /tmp onto the data disk:
+            //   Layer 1 — the framework's multipart file-section buffer (FileBufferingReadStream), which
+            //             reads its directory from the ASPNETCORE_TEMP env var (falling back to
+            //             Path.GetTempPath()). Setting the var here, before the host runs, relocates it.
+            //   Layer 2 — the controller's own staging file, via the injected UploadStagingDirectory.
+            // Default location is a "staging" subdirectory beside the vaults; override with
+            // Upload:StagingPath in appsettings.json.
+            var uploadSettings = builder.Configuration.GetSection("Upload").Get<UploadSettings>();
+            var stagingPath = ResolveStagingPath(uploadSettings?.StagingPath, vaultPath);
+            Directory.CreateDirectory(stagingPath);
+
+            // AspNetCoreTempDirectory caches this value on first read and throws if the directory is
+            // absent, so set it (and create the dir) before any request is served.
+            Environment.SetEnvironmentVariable("ASPNETCORE_TEMP", stagingPath);
+            builder.Services.AddSingleton(new UploadStagingDirectory(stagingPath));
+
             return Task.CompletedTask;
         }
 
+        /// <summary>
+        /// Resolves the absolute upload-staging directory. An explicit <paramref name="configuredPath"/>
+        /// (from <c>Upload:StagingPath</c>) wins; otherwise it defaults to a <c>staging</c> subdirectory
+        /// under <paramref name="vaultPath"/> — on the data disk, never the system temp mount. Pure so
+        /// the "never <c>/tmp</c>" invariant is unit-testable without standing up the host.
+        /// </summary>
+        public static string ResolveStagingPath(string? configuredPath, string vaultPath)
+        {
+            var path = string.IsNullOrWhiteSpace(configuredPath)
+                ? Path.Combine(vaultPath, "staging")
+                : configuredPath;
+            return Path.GetFullPath(path);
+        }
+
         private static async Task InitializeTrackVault(FileDatabase fileDatabase)
         {
             if (!fileDatabase.HasVault(VaultConstants.Tracks))
@@ -66,12 +98,13 @@ namespace DeepDrftAPI
             }
         }
 
-        // Ensure the mix-waveforms vault exists. Holds high-resolution waveform datums for DJ Mix releases.
-        private static async Task InitializeMixWaveformsVault(FileDatabase fileDatabase)
+        // Ensure the track-waveforms vault exists. Holds the per-track high-resolution waveform datum
+        // (every track — Mix, Session, Cut), keyed by the track's EntryKey.
+        private static async Task InitializeTrackWaveformsVault(FileDatabase fileDatabase)
         {
-            if (!fileDatabase.HasVault(VaultConstants.MixWaveforms))
+            if (!fileDatabase.HasVault(VaultConstants.TrackWaveforms))
             {
-                await fileDatabase.CreateVaultAsync(VaultConstants.MixWaveforms, MediaVaultType.Media);
+                await fileDatabase.CreateVaultAsync(VaultConstants.TrackWaveforms, MediaVaultType.Media);
             }
         }
     }

DeepDrftAPI/appsettings.json

@@ -7,13 +7,17 @@
     }
   },
   "AllowedHosts": "*",
+  "Upload": {
+    "StagingPath": ""
+  },
   "CorsSettings": {
     "AllowedOrigins": [
       "https://localhost:12778",
       "https://localhost:5004",
       "http://localhost:5003",
       "https://deepdrft.com",
-      "https://www.deepdrft.com"
+      "https://www.deepdrft.com",
+      "https://app.deepdrft.com"
     ]
   },
   "ForwardedHeaders": {

DeepDrftAPI/environment/authblocks.example.json

@@ -8,7 +8,9 @@
     },
     "Email": {
       "Host": "smtp.your-provider.com",
-      "Token": "your-email-token-here"
+      "Token": "your-email-token-here",
+      "From": "noreply@yourdomain.com",
+      "TestInbox": "<sandbox-id>"
     },
     "Admin": {
       "UserName": "admin",

DeepDrftContent/CLAUDE.md

@@ -82,6 +82,8 @@ Multi-format support via router pattern. All processors live in `DeepDrftContent
 - `Mp3AudioProcessor.ProcessMp3FileAsync(filePath)`: MP3 processor. Skips ID3v2 tag, finds first valid MPEG frame sync, decodes frame header (bitrate, sample rate, channels). Reads Xing/Info header for VBR total-frame count (accurate duration); VBRI header as fallback; CBR estimate from file size otherwise. Returns `AudioBinary` with original bytes and `.mp3` extension. On parse failure, falls back to defaults (180s / 320 kbps).
 - `FlacAudioProcessor.ProcessFlacFileAsync(filePath)`: FLAC processor. Validates `fLaC` magic, reads STREAMINFO metadata block (20-bit sample rate, 3-bit channels, 5-bit bits-per-sample, 36-bit total samples — all bit-packed). Computes duration from `totalSamples / sampleRate`; average bitrate from file size. Returns `AudioBinary` with original bytes and `.flac` extension. On parse failure, falls back to defaults (180s / 1411 kbps).
 - `AudioProcessorRouter.ProcessAudioFileAsync(filePath)`: Routes by extension — `.wav` → `AudioProcessor`, `.mp3` → `Mp3AudioProcessor`, `.flac` → `FlacAudioProcessor`. Throws `ArgumentException` for unsupported extensions.
+- `WaveformProfileService.ComputeAndStoreHighResAsync(entryKey)`: The shared compute seam for the duration-derived high-res waveform datum (~333 samples/sec). Medium-neutral — computes for any track by `EntryKey`, stores in the `track-waveforms` vault. Called by the upload path (`UnifiedTrackService.UploadAsync` for every new track), the CMS per-row generate action, and the Mix release trigger (now a legacy delegate). Phase 12 generalization of the former Mix-only compute.
+- `WaveformResolution`: Enum / constants controlling bucket density for the high-res compute. Renamed from `MixWaveformResolution` in Phase 12.
 
 Vault stores original bytes with correct extension and MIME type (inferred from file extension or content-type header at upload time).
 
@@ -120,7 +122,7 @@ Safety call to ensure the `tracks` vault exists (creates if missing). Called on
 
 ## Vault constants
 
-`VaultConstants.Tracks = "tracks"` and `VaultConstants.Images = "images"` — the vault names in production use. New vault names go here when adding new vault types.
+`VaultConstants.Tracks = "tracks"`, `VaultConstants.Images = "images"`, and `VaultConstants.TrackWaveforms = "track-waveforms"` — the vault names in production use. `TrackWaveforms` holds the per-track high-res waveform datum keyed by `TrackEntity.EntryKey` (Phase 12; renamed from the former `mix-waveforms`, which was Mix-only). New vault names go here when adding new vault types.
 
 ## Service registration
 

DeepDrftContent/Constants/VaultConstants.cs

@@ -22,8 +22,10 @@ public static class VaultConstants
     public const string Images = "images";
 
     /// <summary>
-    /// Vault name for Mix high-resolution waveform datums, keyed by the mix track's EntryKey.
+    /// Vault name for per-track high-resolution waveform datums, keyed by the track's EntryKey.
+    /// Every track (Mix, Session, Cut) carries one — computed at upload, regenerable on demand.
     /// Distinct from WaveformProfiles (player-bar low-res); same pipeline at higher resolution.
+    /// The datum resolution is duration-derived (≈333 samples/sec, see <c>WaveformResolution</c>).
     /// </summary>
-    public const string MixWaveforms = "mix-waveforms";
+    public const string TrackWaveforms = "track-waveforms";
 }

DeepDrftContent/Processors/WaveformProfileService.cs

@@ -42,9 +42,9 @@ public class WaveformProfileService
     /// <paramref name="entryKey"/> in <paramref name="vaultName"/> (defaults to
     /// <see cref="VaultConstants.WaveformProfiles"/> when null). Bucket resolution defaults to
     /// <see cref="WaveformProfileOptions.BucketCount"/> (512) when <paramref name="bucketCount"/> is null;
-    /// callers pass an explicit count for higher-resolution data — e.g. the Mix datum derives its count
-    /// from the audio duration (≈333 samples/sec, see <c>MixWaveformResolution</c>) so long mixes are not
-    /// under-sampled. This service is content-agnostic: it captures however many buckets it is told to and
+    /// callers pass an explicit count for higher-resolution data — e.g. the per-track high-res datum
+    /// derives its count from the audio duration (≈333 samples/sec, see <c>WaveformResolution</c>) so long
+    /// tracks are not under-sampled. This service is content-agnostic: it captures however many buckets it is told to and
     /// does not itself decide the count. Returns false (and logs) on any
     /// failure — a missing profile is handled gracefully downstream, so callers on the upload path
     /// log-and-continue rather than failing the upload. Does not throw for expected failure modes.
@@ -99,6 +99,24 @@ public class WaveformProfileService
         }
     }
 
+    /// <summary>
+    /// Computes a track's high-resolution loudness datum and stores it in the
+    /// <see cref="VaultConstants.TrackWaveforms"/> vault keyed by <paramref name="entryKey"/>. The bucket
+    /// count is duration-derived (≈333 samples/sec, clamped — see <see cref="WaveformResolution"/>) so the
+    /// datum captures at a constant time resolution regardless of track length. This is the single home
+    /// for "the high-res per-track datum" — the upload path, the CMS generate action, and the Mix trigger
+    /// all funnel through it, so every track (Mix, Session, Cut) gets an identical datum keyed the same way.
+    /// Returns false (logged) on any failure, per the content-agnostic contract above.
+    /// </summary>
+    public Task<bool> ComputeAndStoreHighResAsync(
+        ReadOnlyMemory<byte> wavBytes,
+        string entryKey,
+        double durationSeconds)
+    {
+        var bucketCount = WaveformResolution.BucketCountForDuration(durationSeconds);
+        return ComputeAndStoreAsync(wavBytes, entryKey, bucketCount, VaultConstants.TrackWaveforms);
+    }
+
     /// <summary>
     /// Returns the stored quantized profile bytes for a track from <paramref name="vaultName"/>
     /// (defaults to <see cref="VaultConstants.WaveformProfiles"/> when null), or null if no profile

DeepDrftContent/Processors/WaveformResolution.cs

@@ -1,40 +1,41 @@
 namespace DeepDrftContent.Processors;
 
 /// <summary>
-/// Derives the bucket count for a Mix loudness datum from the audio's duration, so the stored
-/// profile captures at a constant <em>time</em> resolution instead of a fixed bucket count.
+/// Derives the bucket count for a track's high-resolution loudness datum from the audio's duration, so
+/// the stored profile captures at a constant <em>time</em> resolution instead of a fixed bucket count.
+/// Applies to every track (Mix, Session, Cut) — the release is just the host (phase-12 §5).
 ///
 /// Rationale (phase-9 Mix Visualizer redesign spec §F): the max-zoom window shows one quarter note
 /// at 180 BPM = 333 ms of audio, and a smooth glassy curve wants ~100+ sample points across that
 /// window. A fixed 2048-bucket datum gives fractions of a sample per 333 ms window on any real-length
-/// mix (a 30-minute mix gets ~0.38 buckets), so long content is badly under-sampled. Capturing at a
-/// constant ≈333 samples/sec (≈3 ms/sample) makes a 333 ms window hold ~111 samples regardless of mix
+/// audio (a 30-minute mix gets ~0.38 buckets), so long content is badly under-sampled. Capturing at a
+/// constant ≈333 samples/sec (≈3 ms/sample) makes a 333 ms window hold ~111 samples regardless of
 /// length — the direct expression of "high enough resolution regardless of content length."
 ///
 /// This is the orchestration-side derivation (duration → bucket count); the actual compute/store stays
 /// in <see cref="WaveformProfileService"/>, which is content-agnostic and parameterized by bucket count.
 /// </summary>
-public static class MixWaveformResolution
+public static class WaveformResolution
 {
     /// <summary>≈333 samples/sec (≈3 ms/sample): one quarter note at 180 BPM (333 ms) holds ~111 samples.</summary>
     public const int SamplesPerSecond = 333;
 
     /// <summary>
-    /// Upper cap on bucket count (~2,000,000 samples ≈ a 100-minute mix at 333/s). Past this length we
+    /// Upper cap on bucket count (~2,000,000 samples ≈ a 100-minute track at 333/s). Past this length we
     /// accept slightly-below-target density rather than an unbounded datum (spec §F mitigation #1).
     /// </summary>
     public const int MaxBucketCount = 2_000_000;
 
     /// <summary>
     /// Floor on bucket count. Keeps the historical 2048-bucket density as the minimum so a degenerate
-    /// near-zero or very-short mix still yields a usable profile rather than zero/handful of buckets.
+    /// near-zero or very-short track still yields a usable profile rather than zero/handful of buckets.
     /// </summary>
     public const int MinBucketCount = 2048;
 
     /// <summary>
     /// Maps a track's duration (seconds) to a bucket count of <c>ceil(durationSeconds × 333)</c>,
     /// clamped to [<see cref="MinBucketCount"/>, <see cref="MaxBucketCount"/>]. Non-finite or negative
-    /// durations fall to the floor. A 60-minute mix → ~1.2M buckets; a 3-minute mix → ~60k.
+    /// durations fall to the floor. A 60-minute track → ~1.2M buckets; a 3-minute track → ~60k.
     /// </summary>
     public static int BucketCountForDuration(double durationSeconds)
     {

DeepDrftContent/TrackContentService.cs

@@ -74,7 +74,10 @@ public class TrackContentService
             {
                 EntryKey = trackId, // FileDatabase entry ID
                 TrackName = trackName,
-                OriginalFileName = originalFileName
+                OriginalFileName = originalFileName,
+                // Persist the processor-extracted runtime to SQL so aggregate queries (total mix runtime)
+                // need not touch the vault. Same value the high-res waveform compute reads downstream.
+                DurationSeconds = audioBinary.Duration
             };
 
             return trackEntity;
@@ -100,6 +103,84 @@ public class TrackContentService
         string? originalFileName = null) =>
         AddTrackAsync(wavFilePath, trackName, artist, album, genre, releaseDate, originalFileName);
 
+    /// <summary>
+    /// Swaps the audio bytes for an existing track in place: processes a new audio file and
+    /// re-registers it under the SAME <paramref name="entryKey"/> in the tracks vault. The track's
+    /// vault key — and therefore its SQL link, release membership, position, and metadata — is
+    /// untouched; only the binary changes. The new audio is written first; only on confirmed success
+    /// is a stale old backing file cleaned up. A cross-format replacement (e.g. .wav → .flac) leaves
+    /// the old file on disk under its former filename once the index is updated; the post-success
+    /// cleanup removes it. For a same-extension overwrite the register alone suffices — the file is
+    /// written in place. If the register fails the original audio is left intact and null is returned,
+    /// so the track remains playable. Returns the freshly stored <see cref="AudioBinary"/> on success
+    /// (so the caller can regenerate waveform data from the same bytes) — matching the FileDatabase
+    /// swallow-and-return-null contract.
+    /// </summary>
+    public async Task<AudioBinary?> ReplaceTrackAudioAsync(string entryKey, string audioFilePath)
+    {
+        try
+        {
+            // Capture the old extension before touching the vault. After register the index
+            // will point to the new extension, so we need the old value now to detect a
+            // cross-format swap and clean up the stale file post-success.
+            var existing = await _fileDatabase.LoadResourceAsync<AudioBinary>(VaultConstants.Tracks, entryKey);
+            var oldExtension = existing?.Extension;
+
+            var audioBinary = await _audioProcessorRouter.ProcessAudioFileAsync(audioFilePath);
+            if (audioBinary == null)
+            {
+                Console.WriteLine($"TrackContentService.ReplaceTrackAudioAsync: processing returned null for {entryKey}");
+                return null;
+            }
+
+            if (!_fileDatabase.HasVault(VaultConstants.Tracks))
+            {
+                await _fileDatabase.CreateVaultAsync(VaultConstants.Tracks, MediaVaultType.Audio);
+            }
+
+            // Register the new audio. This upserts the index entry (new extension recorded) and
+            // writes the new file to disk. If this fails the original entry and file are untouched.
+            var success = await _fileDatabase.RegisterResourceAsync(VaultConstants.Tracks, entryKey, audioBinary);
+            if (!success)
+            {
+                Console.WriteLine($"TrackContentService.ReplaceTrackAudioAsync: vault write failed for {entryKey}; original audio preserved");
+                return null;
+            }
+
+            // Post-success stale-file cleanup for cross-format swaps. The register wrote the new
+            // file (e.g. .flac) and updated the index to the new extension, but the old backing
+            // file (e.g. .wav) is now unreferenced on disk. Delete it directly by constructing the
+            // old path — RemoveResourceAsync would now resolve to the new extension and delete the
+            // wrong file. Non-fatal: an orphaned old file is a disk-hygiene concern, not a
+            // playback issue (the index no longer references it).
+            if (oldExtension != null && oldExtension != audioBinary.Extension)
+            {
+                var vault = _fileDatabase.GetVault(VaultConstants.Tracks);
+                if (vault != null)
+                {
+                    var sanitizedKey = System.Text.RegularExpressions.Regex.Replace(entryKey, @"[^a-zA-Z0-9]", "-");
+                    var staleFilePath = Path.Combine(vault.RootPath, $"{sanitizedKey}{oldExtension}");
+                    try
+                    {
+                        if (File.Exists(staleFilePath))
+                            File.Delete(staleFilePath);
+                    }
+                    catch (Exception ex)
+                    {
+                        Console.WriteLine($"TrackContentService.ReplaceTrackAudioAsync: stale backing-file removal failed for {entryKey} ({staleFilePath}): {ex.Message} — new audio is live; orphaned file may remain on disk");
+                    }
+                }
+            }
+
+            return audioBinary;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            Console.WriteLine($"TrackContentService.ReplaceTrackAudioAsync failed: {ex.Message}");
+            return null;
+        }
+    }
+
     /// <summary>
     /// Retrieves audio binary from FileDatabase
     /// </summary>

DeepDrftData/CLAUDE.md

@@ -20,7 +20,7 @@ Separating domain logic from hosts so DeepDrftAPI can reuse `TrackManager` / `Tr
 DeepDrftData/
 ├── Data/
 │   ├── DeepDrftContext.cs              # EF DbContext
-│   ├── DeepDrftContextFactory.cs       # Design-time factory (hard-codes ../Database/deepdrft.db)
+│   ├── DeepDrftContextFactory.cs       # Design-time factory (reads environment/connections.json; Npgsql dummy fallback)
 │   └── Configurations/
 │       └── TrackConfiguration.cs       # EF fluent configuration for TrackEntity
 ├── Migrations/                         # EF-generated migrations (namespace DeepDrftData.Migrations)
@@ -32,7 +32,7 @@ DeepDrftData/
 
 ## EF DbContext and configuration
 
-`DeepDrftContext` targets SQLite, connection string from `appsettings.json` (`ConnectionStrings:DefaultConnection`). The design-time factory (`DeepDrftContextFactory`) hard-codes `../Database/deepdrft.db` for `dotnet ef` commands, so you can run migrations locally without a full app context.
+`DeepDrftContext` targets **PostgreSQL** (Npgsql), connection string from `environment/connections.json` (loaded at runtime via `CredentialTools.ResolvePathOrThrow("connections", ...)` in `DeepDrftAPI/Program.cs`, key `ConnectionStrings:DefaultConnection`). The design-time factory (`DeepDrftContextFactory`) reads the same `environment/connections.json` when present and falls back to a Npgsql dummy connection string (`Host=localhost;Database=deepdrft-design-time;Username=dummy`) for CI or environments without the file, so `dotnet ef` commands work without a live database.
 
 `TrackConfiguration` uses EF fluent API:
 - Table name: `track` (singular)
@@ -42,6 +42,7 @@ DeepDrftData/
 - `Album`, `Genre`: optional, max 200 / 100
 - `ReleaseDate`: optional `DateOnly`
 - `ImagePath`: optional, max 500 (currently a free-form URL string; points to images vault in future)
+- `DurationSeconds`: optional `double?` (nullable; populated at upload from vault audio; backfillable via `POST api/track/duration/backfill`; used for aggregate mix-runtime queries). Column: `duration_seconds`. Migration: `20260618155002_AddTrackDuration`.
 
 ## Service → Repository → DbContext shape
 
@@ -49,6 +50,20 @@ DeepDrftData/
 - **Repository** (`TrackRepository`): Internal data access. Queries the DbContext. Throws on error (service catches).
 - **DbContext** (`DeepDrftContext`): EF Core. Directly accessed by repository, never by service (pattern isolation).
 
+Notable repository / service methods beyond the standard CRUD:
+
+- `TrackRepository.GetHomeStatsAsync` / `ITrackService.GetHomeStats`: Returns `HomeStatsDto` — cut track count, per-`ReleaseType` cut release counts (zero-suppressed), mix release count, total mix runtime seconds (null durations counted as 0; tracks under a soft-deleted release excluded). Used by `StatsController`.
+- `TrackRepository.UpdateDurationAsync` / `ITrackService.UpdateDuration`: Null-guarded duration write — skips rows where `DurationSeconds` is already set. Used by the one-time backfill (`POST api/track/duration/backfill`).
+- `TrackRepository.SetDurationAsync` / `ITrackService.SetDuration`: Unconditional duration overwrite — no null guard, always stamps the new value. Used by the replace-audio path (`POST api/track/{id:long}/replace-audio`) where the existing non-null duration must be overwritten with the new audio's value. Returns a fail result when zero rows are affected (track removed between lookup and write).
+- `ITrackService.FindOrCreateRelease` / `TrackManager.FindOrCreateRelease`: Finds the release row matching (title, artist) or creates one if none exists. Returns `ResultContainer<(ReleaseDto Release, bool WasCreated)>` — the `WasCreated` flag lets the upload CREATE path distinguish a freshly minted release from one returned because a concurrent upload won the insert race (the latter is treated as a duplicate and rejected with 409, not silently attached). `ITrackService.GetReleaseByTitleAndArtist` is the read-only counterpart used for the upload pre-flight check and the ATTACH-path validation.
+
+## Phase 16 — anonymous telemetry domain (EventRepository / EventManager)
+
+`EventRepository` and `EventManager` (with `IEventService` boundary) are the SQL-side domain for anonymous play/share telemetry (Phase 16 waves 16.1 + 16.3). Unlike `TrackRepository`, these entities have no soft-delete lifecycle and are not `BaseEntity`/`IEntity` — `EventRepository` is a plain context-backed repository against the same scoped `DeepDrftContext`.
+
+- **`EventRepository`** (`Repositories/EventRepository.cs`): append-only writes to the `play_event` and `share_event` tables; incremental-on-write bump of the `play_counter` rollup (D6); server-side track→release resolution at write time (D4) — the client sends only the track `EntryKey`, the repository joins track→release and stamps the `release_id` on the row. Also owns the three distinct-listener aggregation queries added in wave 16.3: `CountDistinctListenersAsync()` (site-wide), `CountDistinctListenersForTrackAsync(trackEntryKey)`, `CountDistinctListenersForReleaseAsync(releaseId)` — each excludes null `anon_id` rows.
+- **`EventManager` / `IEventService`** (`EventManager.cs`): `RecordPlay(trackEntryKey, bucket, anonId, ct)` and `RecordShare(targetType, targetKey, channel, anonId, ct)` return NetBlocks `Result`. Wave 16.3 added three distinct-count members returning `ResultContainer<int>`: `GetDistinctListenerCount()`, `GetDistinctListenerCountForTrack(trackEntryKey)`, `GetDistinctListenerCountForRelease(releaseId)`. Registered scoped in `DeepDrftAPI/Program.cs`. Migration: `20260619155610_AddPlayShareTelemetry` (authored; not yet applied — Daniel-gated). The `anon_id` columns and covering indexes on `play_event`/`share_event` are part of this migration — no additional migration was needed for 16.3.
+
 Example:
 
 ```csharp
@@ -117,10 +132,10 @@ Run from the solution root:
 
 ```bash
 # Add a migration
-dotnet ef migrations add MigrationName --project DeepDrftData --startup-project DeepDrftPublic
+dotnet ef migrations add MigrationName --project DeepDrftData --startup-project DeepDrftAPI
 
 # Apply to database
-dotnet ef database update --project DeepDrftData --startup-project DeepDrftPublic
+dotnet ef database update --project DeepDrftData --startup-project DeepDrftAPI
 ```
 
 The design-time factory means you can also run `dotnet ef ... --project DeepDrftData` standalone for local development (it doesn't need the startup project).
@@ -132,9 +147,9 @@ Migrations live in the `DeepDrftData.Migrations` namespace. Migration files are
 ## Connection string
 
 - **DeepDrftAPI**: `environment/connections.json` → `ConnectionStrings:DefaultConnection`
-- Points at the same database (PostgreSQL in production, SQLite for local development).
+- Always PostgreSQL (Npgsql) — both production and local development.
 
-The design-time factory hard-codes the local path for `dotnet ef` commands.
+The design-time factory reads `environment/connections.json` when present; falls back to a Npgsql dummy for CI.
 
 ## Service registration
 
@@ -142,7 +157,7 @@ In `DeepDrftAPI/Program.cs`:
 
 ```csharp
 services.AddDbContext<DeepDrftContext>(options =>
-    options.UseNpgsql(configuration.GetConnectionString("DefaultConnection")));  // or UseSqlite for dev
+    options.UseNpgsql(configuration.GetConnectionString("DefaultConnection")));
 services.AddScoped<TrackRepository>();
 services.AddScoped<TrackManager>();
 services.AddScoped<ITrackService>(sp => sp.GetRequiredService<TrackManager>());

DeepDrftData/Data/Configurations/PlayCounterConfiguration.cs

@@ -0,0 +1,47 @@
+using DeepDrftModels.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace DeepDrftData.Data.Configurations;
+
+/// <summary>
+/// EF configuration for the <c>play_counter</c> rollup (Phase 16 §4.1 / D6). One row per track, unique
+/// on track_id so the incremental-on-write bump is an upsert against a single row. <c>TotalPlays</c> is
+/// a computed C# property (sum of the three bucket columns) and is not mapped — it is derived on read.
+/// </summary>
+public class PlayCounterConfiguration : IEntityTypeConfiguration<PlayCounter>
+{
+    public void Configure(EntityTypeBuilder<PlayCounter> builder)
+    {
+        builder.ToTable("play_counter");
+
+        builder.HasKey(e => e.Id);
+        builder.Property(e => e.Id).HasColumnName("id");
+
+        builder.Property(e => e.TrackId)
+            .IsRequired()
+            .HasColumnName("track_id");
+
+        builder.Property(e => e.PartialCount)
+            .IsRequired()
+            .HasDefaultValue(0L)
+            .HasColumnName("partial_count");
+
+        builder.Property(e => e.SampledCount)
+            .IsRequired()
+            .HasDefaultValue(0L)
+            .HasColumnName("sampled_count");
+
+        builder.Property(e => e.CompleteCount)
+            .IsRequired()
+            .HasDefaultValue(0L)
+            .HasColumnName("complete_count");
+
+        // Derived headline figure — never a column.
+        builder.Ignore(e => e.TotalPlays);
+
+        builder.HasIndex(e => e.TrackId)
+            .IsUnique()
+            .HasDatabaseName("IX_play_counter_track_id");
+    }
+}

DeepDrftData/Data/Configurations/PlayEventConfiguration.cs

@@ -0,0 +1,49 @@
+using DeepDrftModels.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace DeepDrftData.Data.Configurations;
+
+/// <summary>
+/// EF configuration for the append-only <c>play_event</c> log (Phase 16 §4.2). Plain entity, not a
+/// <c>BaseEntity</c> — no soft-delete or updated_at, just an immutable fact with a created_at stamp.
+/// Indexed on track key, release id, and anon id (the last reserved for the wave-16.3 distinct-listener
+/// query) so the aggregation paths stay cheap as the log grows.
+/// </summary>
+public class PlayEventConfiguration : IEntityTypeConfiguration<PlayEvent>
+{
+    public void Configure(EntityTypeBuilder<PlayEvent> builder)
+    {
+        builder.ToTable("play_event");
+
+        builder.HasKey(e => e.Id);
+        builder.Property(e => e.Id).HasColumnName("id");
+
+        builder.Property(e => e.TrackEntryKey)
+            .IsRequired()
+            .HasMaxLength(100)
+            .HasColumnName("track_entry_key");
+
+        builder.Property(e => e.ReleaseId)
+            .HasColumnName("release_id");
+
+        builder.Property(e => e.Bucket)
+            .IsRequired()
+            .HasConversion<string>()   // Store the readable bucket name, mirroring ReleaseMedium.
+            .HasMaxLength(20)
+            .HasColumnName("bucket");
+
+        // Reserved nullable token (wave 16.3). Same width as a stringified GUID.
+        builder.Property(e => e.AnonId)
+            .HasMaxLength(64)
+            .HasColumnName("anon_id");
+
+        builder.Property(e => e.CreatedAt)
+            .IsRequired()
+            .HasColumnName("created_at");
+
+        builder.HasIndex(e => e.TrackEntryKey).HasDatabaseName("IX_play_event_track_entry_key");
+        builder.HasIndex(e => e.ReleaseId).HasDatabaseName("IX_play_event_release_id");
+        builder.HasIndex(e => e.AnonId).HasDatabaseName("IX_play_event_anon_id");
+    }
+}

DeepDrftData/Data/Configurations/ShareEventConfiguration.cs

@@ -0,0 +1,48 @@
+using DeepDrftModels.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace DeepDrftData.Data.Configurations;
+
+/// <summary>
+/// EF configuration for the append-only <c>share_event</c> log (Phase 16 §4.2). Plain immutable-fact
+/// entity. Indexed on the target key so per-target share tallies stay cheap.
+/// </summary>
+public class ShareEventConfiguration : IEntityTypeConfiguration<ShareEvent>
+{
+    public void Configure(EntityTypeBuilder<ShareEvent> builder)
+    {
+        builder.ToTable("share_event");
+
+        builder.HasKey(e => e.Id);
+        builder.Property(e => e.Id).HasColumnName("id");
+
+        builder.Property(e => e.TargetType)
+            .IsRequired()
+            .HasConversion<string>()
+            .HasMaxLength(20)
+            .HasColumnName("target_type");
+
+        builder.Property(e => e.TargetKey)
+            .IsRequired()
+            .HasMaxLength(100)
+            .HasColumnName("target_key");
+
+        builder.Property(e => e.Channel)
+            .IsRequired()
+            .HasConversion<string>()
+            .HasMaxLength(20)
+            .HasColumnName("channel");
+
+        builder.Property(e => e.AnonId)
+            .HasMaxLength(64)
+            .HasColumnName("anon_id");
+
+        builder.Property(e => e.CreatedAt)
+            .IsRequired()
+            .HasColumnName("created_at");
+
+        builder.HasIndex(e => e.TargetKey).HasDatabaseName("IX_share_event_target_key");
+        builder.HasIndex(e => e.AnonId).HasDatabaseName("IX_share_event_anon_id");
+    }
+}

DeepDrftData/Data/Configurations/TrackConfiguration.cs

@@ -39,6 +39,10 @@ public class TrackConfiguration : BaseEntityConfiguration<TrackEntity>
             .HasColumnName("track_number")
             .HasDefaultValue(1);
 
+        // Nullable: existing rows carry NULL until the one-time duration backfill populates them.
+        builder.Property(e => e.DurationSeconds)
+            .HasColumnName("duration_seconds");
+
         builder.Property(e => e.ReleaseId)
             .HasColumnName("release_id");
 

DeepDrftData/Data/DeepDrftContext.cs

@@ -15,6 +15,12 @@ public class DeepDrftContext : DbContext
     public DbSet<SessionMetadata> SessionMetadata { get; set; }
     public DbSet<MixMetadata> MixMetadata { get; set; }
 
+    // Phase 16 anonymous telemetry: append-only event logs + incremental play rollup. All SQL — the
+    // FileDatabase vault is not involved.
+    public DbSet<PlayEvent> PlayEvents { get; set; }
+    public DbSet<ShareEvent> ShareEvents { get; set; }
+    public DbSet<PlayCounter> PlayCounters { get; set; }
+
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
         base.OnModelCreating(modelBuilder);
@@ -23,5 +29,8 @@ public class DeepDrftContext : DbContext
         modelBuilder.ApplyConfiguration(new ReleaseConfiguration());
         modelBuilder.ApplyConfiguration(new SessionMetadataConfiguration());
         modelBuilder.ApplyConfiguration(new MixMetadataConfiguration());
+        modelBuilder.ApplyConfiguration(new PlayEventConfiguration());
+        modelBuilder.ApplyConfiguration(new ShareEventConfiguration());
+        modelBuilder.ApplyConfiguration(new PlayCounterConfiguration());
     }
 }

DeepDrftData/DeepDrftData.csproj

@@ -18,9 +18,9 @@
     </PackageReference>
     <!-- Npgsql 10.0.1 requires Microsoft.EntityFrameworkCore >= 10.0.4; keep in sync -->
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
-    <PackageReference Include="Cerebellum.NetBlocks" Version="10.3.30" />
-    <PackageReference Include="Cerebellum.BlazorBlocks.Data" Version="10.3.30" />
-    <PackageReference Include="Cerebellum.BlazorBlocks.Data.Postgres" Version="10.3.30" />
+    <PackageReference Include="Cerebellum.NetBlocks" Version="10.3.32" />
+    <PackageReference Include="Cerebellum.BlazorBlocks.Data" Version="10.3.35" />
+    <PackageReference Include="Cerebellum.BlazorBlocks.Data.Postgres" Version="10.3.35" />
   </ItemGroup>
 
   <ItemGroup>

DeepDrftData/EventManager.cs

@@ -0,0 +1,114 @@
+using DeepDrftData.Repositories;
+using DeepDrftModels.Enums;
+using Microsoft.Extensions.Logging;
+using NetBlocks.Models;
+
+namespace DeepDrftData;
+
+/// <summary>
+/// <see cref="IEventService"/> implementation over <see cref="EventRepository"/>. The layer boundary
+/// matches the rest of DeepDrftData: the repository owns the EF constructs and the write transaction;
+/// this service catches at the boundary and returns a NetBlocks <see cref="Result"/>. Telemetry is
+/// best-effort by design (§2.2) — a failed write is logged and surfaced as a fail result, never thrown
+/// at the caller, so a telemetry hiccup can never reach a listener.
+/// </summary>
+public class EventManager : IEventService
+{
+    private readonly EventRepository _repository;
+    private readonly ILogger<EventManager> _logger;
+
+    public EventManager(EventRepository repository, ILogger<EventManager> logger)
+    {
+        _repository = repository;
+        _logger = logger;
+    }
+
+    public async Task<Result> RecordPlay(
+        string trackEntryKey, PlayBucket bucket, string? anonId = null, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await _repository.RecordPlayAsync(trackEntryKey, bucket, anonId, cancellationToken);
+            return Result.CreatePassResult();
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to record play event for track {TrackEntryKey}", trackEntryKey);
+            return Result.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<Result> RecordShare(
+        ShareTargetType targetType, string targetKey, ShareChannel channel, string? anonId = null,
+        CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await _repository.RecordShareAsync(targetType, targetKey, channel, anonId, cancellationToken);
+            return Result.CreatePassResult();
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to record share event for {TargetType} {TargetKey}", targetType, targetKey);
+            return Result.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<long>> GetTotalPlayCount(CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var count = await _repository.CountTotalPlaysAsync(cancellationToken);
+            return ResultContainer<long>.CreatePassResult(count);
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to count total plays");
+            return ResultContainer<long>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<int>> GetDistinctListenerCount(CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var count = await _repository.CountDistinctListenersAsync(cancellationToken);
+            return ResultContainer<int>.CreatePassResult(count);
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to count distinct listeners");
+            return ResultContainer<int>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<int>> GetDistinctListenerCountForTrack(
+        string trackEntryKey, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var count = await _repository.CountDistinctListenersForTrackAsync(trackEntryKey, cancellationToken);
+            return ResultContainer<int>.CreatePassResult(count);
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to count distinct listeners for track {TrackEntryKey}", trackEntryKey);
+            return ResultContainer<int>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<int>> GetDistinctListenerCountForRelease(
+        long releaseId, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var count = await _repository.CountDistinctListenersForReleaseAsync(releaseId, cancellationToken);
+            return ResultContainer<int>.CreatePassResult(count);
+        }
+        catch (Exception e)
+        {
+            _logger.LogError(e, "Failed to count distinct listeners for release {ReleaseId}", releaseId);
+            return ResultContainer<int>.CreateFailResult(e.Message);
+        }
+    }
+}

DeepDrftData/IEventService.cs

@@ -0,0 +1,46 @@
+using DeepDrftModels.Enums;
+using NetBlocks.Models;
+
+namespace DeepDrftData;
+
+/// <summary>
+/// SQL-side anonymous telemetry service (Phase 16). Records play and share events to the append-only
+/// logs and maintains the incremental play-counter rollup. The release dimension on a play is resolved
+/// server-side from the track key (§2.3 / D4) — callers pass only what the client cheaply knows.
+/// Returns NetBlocks <see cref="Result"/> at the boundary; the controller maps that to 202/4xx/5xx.
+/// </summary>
+public interface IEventService
+{
+    /// <summary>
+    /// Record one play: append a <c>play_event</c> row (release resolved from the track key) and bump
+    /// the track's <c>play_counter</c> in the same transaction. A play of an unknown/removed track key
+    /// still logs (with a null release and no counter bump) rather than failing.
+    /// </summary>
+    Task<Result> RecordPlay(string trackEntryKey, PlayBucket bucket, string? anonId = null, CancellationToken cancellationToken = default);
+
+    /// <summary>Record one share: append a <c>share_event</c> row. Target and channel come straight from the client.</summary>
+    Task<Result> RecordShare(ShareTargetType targetType, string targetKey, ShareChannel channel, string? anonId = null, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Site-wide total play count (Phase 16 §5 — all-time): the sum of every <c>play_counter</c> row's
+    /// three bucket columns. Zero until the telemetry migration is applied. The home Plays card's primary
+    /// figure; the controller composes it onto <c>HomeStatsDto</c> alongside the track-domain figures.
+    /// </summary>
+    Task<ResultContainer<long>> GetTotalPlayCount(CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Site-wide distinct-listener count (Phase 16 §3, D3 — all-time): distinct non-null <c>anon_id</c>
+    /// values across all play events. Null tokens are excluded (not a known listener). The capability for
+    /// wave 16.5's "N listeners" card; nothing surfaces it via API or UI in wave 16.3.
+    /// </summary>
+    Task<ResultContainer<int>> GetDistinctListenerCount(CancellationToken cancellationToken = default);
+
+    /// <summary>Distinct listeners who played the given track (by vault entry key). Null tokens excluded.</summary>
+    Task<ResultContainer<int>> GetDistinctListenerCountForTrack(string trackEntryKey, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Distinct listeners across the release's tracks (derived, D4) — a listener who played any track in
+    /// the release counts once. Null tokens excluded.
+    /// </summary>
+    Task<ResultContainer<int>> GetDistinctListenerCountForRelease(long releaseId, CancellationToken cancellationToken = default);
+}

DeepDrftData/ITrackService.cs

@@ -28,12 +28,43 @@ public interface ITrackService
     /// <summary>Distinct non-null genres with track counts, genre-ascending.</summary>
     Task<ResultContainer<List<GenreSummaryDto>>> GetDistinctGenres(CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Aggregate figures behind the public home hero stat row: Cut track count + per-ReleaseType Cut
+    /// release breakdown, Mix release count, and total Mix runtime in seconds. One read for all three cards.
+    /// </summary>
+    Task<ResultContainer<HomeStatsDto>> GetHomeStats(CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Non-deleted tracks whose SQL duration is still null — the work list for the one-time duration
+    /// backfill. The backfill reads each track's stored duration from the vault and writes it via
+    /// <see cref="UpdateDuration"/>.
+    /// </summary>
+    Task<ResultContainer<List<TrackDto>>> GetTracksMissingDuration(CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Set the SQL duration for one track. Idempotent: a track whose duration is already set is left
+    /// untouched. Backs the duration backfill. Returns the number of rows updated (0 or 1).
+    /// </summary>
+    Task<ResultContainer<int>> UpdateDuration(long id, double durationSeconds, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Unconditionally overwrite the SQL duration for one track. Unlike <see cref="UpdateDuration"/>,
+    /// this carries no null guard — it is for the replace-audio path where the track already has a
+    /// non-null duration that must be overwritten with the new audio's value. Returns a fail Result
+    /// when zero rows are affected (track removed between lookup and write).
+    /// </summary>
+    Task<ResultContainer<int>> SetDuration(long id, double durationSeconds, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Resolve the release matching <paramref name="title"/> + <paramref name="artist"/>, creating
     /// one from <paramref name="releaseData"/> when none exists. Backs the upload flow's FK
     /// resolution so a track lands on a shared release rather than duplicating release-cardinal data.
+    /// The <c>WasCreated</c> flag in the result is <see langword="true"/> when a new row was inserted
+    /// and <see langword="false"/> when an existing row was found (including after a lost concurrent-insert
+    /// race). The CREATE path in <c>UnifiedTrackService.UploadAsync</c> uses this to turn a
+    /// "found existing" outcome into a duplicate rejection rather than a silent attach.
     /// </summary>
-    Task<ResultContainer<ReleaseDto>> FindOrCreateRelease(
+    Task<ResultContainer<(ReleaseDto Release, bool WasCreated)>> FindOrCreateRelease(
         string title, string artist, ReleaseDto releaseData, CancellationToken cancellationToken = default);
 
     /// <summary>

DeepDrftData/Migrations/20260618155002_AddTrackDuration.Designer.cs

@@ -0,0 +1,322 @@
+// <auto-generated />
+using System;
+using DeepDrftData.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DeepDrftData.Migrations
+{
+    [DbContext(typeof(DeepDrftContext))]
+    [Migration("20260618155002_AddTrackDuration")]
+    partial class AddTrackDuration
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.7")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DeepDrftModels.Entities.MixMetadata", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<long>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<string>("WaveformEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("waveform_entry_key");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_mix_metadata_is_deleted");
+
+                    b.HasIndex("ReleaseId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_mix_metadata_release_id");
+
+                    b.ToTable("mix_metadata", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.ReleaseEntity", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Artist")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("artist");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<long?>("CreatedByUserId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("created_by_user_id");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(4000)
+                        .HasColumnType("character varying(4000)")
+                        .HasColumnName("description");
+
+                    b.Property<string>("EntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("entry_key");
+
+                    b.Property<string>("Genre")
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("genre");
+
+                    b.Property<string>("ImagePath")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("image_path");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<string>("Medium")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasDefaultValue("Cut")
+                        .HasColumnName("medium");
+
+                    b.Property<DateOnly?>("ReleaseDate")
+                        .HasColumnType("date")
+                        .HasColumnName("release_date");
+
+                    b.Property<string>("ReleaseType")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasDefaultValue("Single")
+                        .HasColumnName("release_type");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("title");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("EntryKey")
+                        .IsUnique()
+                        .HasDatabaseName("IX_release_entry_key");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_release_is_deleted");
+
+                    b.HasIndex("Title", "Artist")
+                        .IsUnique()
+                        .HasDatabaseName("IX_release_title_artist")
+                        .HasFilter("\"is_deleted\" = false");
+
+                    b.ToTable("release", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.SessionMetadata", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("HeroImageEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("hero_image_entry_key");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<long>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_session_metadata_is_deleted");
+
+                    b.HasIndex("ReleaseId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_session_metadata_release_id");
+
+                    b.ToTable("session_metadata", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.TrackEntity", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<double?>("DurationSeconds")
+                        .HasColumnType("double precision")
+                        .HasColumnName("duration_seconds");
+
+                    b.Property<string>("EntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("entry_key");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<string>("OriginalFileName")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("original_file_name");
+
+                    b.Property<long?>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<string>("TrackName")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("track_name");
+
+                    b.Property<int>("TrackNumber")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1)
+                        .HasColumnName("track_number");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_track_is_deleted");
+
+                    b.HasIndex("ReleaseId");
+
+                    b.ToTable("track", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.MixMetadata", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithOne("MixMetadata")
+                        .HasForeignKey("DeepDrftModels.Entities.MixMetadata", "ReleaseId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.SessionMetadata", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithOne("SessionMetadata")
+                        .HasForeignKey("DeepDrftModels.Entities.SessionMetadata", "ReleaseId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.TrackEntity", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithMany("Tracks")
+                        .HasForeignKey("ReleaseId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.ReleaseEntity", b =>
+                {
+                    b.Navigation("MixMetadata");
+
+                    b.Navigation("SessionMetadata");
+
+                    b.Navigation("Tracks");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

DeepDrftData/Migrations/20260618155002_AddTrackDuration.cs

@@ -0,0 +1,28 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace DeepDrftData.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddTrackDuration : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<double>(
+                name: "duration_seconds",
+                table: "track",
+                type: "double precision",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "duration_seconds",
+                table: "track");
+        }
+    }
+}

DeepDrftData/Migrations/20260619155610_AddPlayShareTelemetry.Designer.cs

@@ -0,0 +1,457 @@
+// <auto-generated />
+using System;
+using DeepDrftData.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DeepDrftData.Migrations
+{
+    [DbContext(typeof(DeepDrftContext))]
+    [Migration("20260619155610_AddPlayShareTelemetry")]
+    partial class AddPlayShareTelemetry
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.7")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DeepDrftModels.Entities.MixMetadata", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<long>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.Property<string>("WaveformEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("waveform_entry_key");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_mix_metadata_is_deleted");
+
+                    b.HasIndex("ReleaseId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_mix_metadata_release_id");
+
+                    b.ToTable("mix_metadata", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.PlayCounter", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<long>("CompleteCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("complete_count");
+
+                    b.Property<long>("PartialCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("partial_count");
+
+                    b.Property<long>("SampledCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("sampled_count");
+
+                    b.Property<long>("TrackId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("track_id");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TrackId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_play_counter_track_id");
+
+                    b.ToTable("play_counter", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.PlayEvent", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("AnonId")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasColumnName("anon_id");
+
+                    b.Property<string>("Bucket")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("bucket");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<long?>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<string>("TrackEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("track_entry_key");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AnonId")
+                        .HasDatabaseName("IX_play_event_anon_id");
+
+                    b.HasIndex("ReleaseId")
+                        .HasDatabaseName("IX_play_event_release_id");
+
+                    b.HasIndex("TrackEntryKey")
+                        .HasDatabaseName("IX_play_event_track_entry_key");
+
+                    b.ToTable("play_event", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.ReleaseEntity", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("Artist")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("artist");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<long?>("CreatedByUserId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("created_by_user_id");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(4000)
+                        .HasColumnType("character varying(4000)")
+                        .HasColumnName("description");
+
+                    b.Property<string>("EntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("entry_key");
+
+                    b.Property<string>("Genre")
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("genre");
+
+                    b.Property<string>("ImagePath")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("image_path");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<string>("Medium")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasDefaultValue("Cut")
+                        .HasColumnName("medium");
+
+                    b.Property<DateOnly?>("ReleaseDate")
+                        .HasColumnType("date")
+                        .HasColumnName("release_date");
+
+                    b.Property<string>("ReleaseType")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasDefaultValue("Single")
+                        .HasColumnName("release_type");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("title");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("EntryKey")
+                        .IsUnique()
+                        .HasDatabaseName("IX_release_entry_key");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_release_is_deleted");
+
+                    b.HasIndex("Title", "Artist")
+                        .IsUnique()
+                        .HasDatabaseName("IX_release_title_artist")
+                        .HasFilter("\"is_deleted\" = false");
+
+                    b.ToTable("release", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.SessionMetadata", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("HeroImageEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("hero_image_entry_key");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<long>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_session_metadata_is_deleted");
+
+                    b.HasIndex("ReleaseId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_session_metadata_release_id");
+
+                    b.ToTable("session_metadata", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.ShareEvent", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("AnonId")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasColumnName("anon_id");
+
+                    b.Property<string>("Channel")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("channel");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("TargetKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("target_key");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("target_type");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AnonId")
+                        .HasDatabaseName("IX_share_event_anon_id");
+
+                    b.HasIndex("TargetKey")
+                        .HasDatabaseName("IX_share_event_target_key");
+
+                    b.ToTable("share_event", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.TrackEntity", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<double?>("DurationSeconds")
+                        .HasColumnType("double precision")
+                        .HasColumnName("duration_seconds");
+
+                    b.Property<string>("EntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("entry_key");
+
+                    b.Property<bool>("IsDeleted")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false)
+                        .HasColumnName("is_deleted");
+
+                    b.Property<string>("OriginalFileName")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)")
+                        .HasColumnName("original_file_name");
+
+                    b.Property<long?>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<string>("TrackName")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)")
+                        .HasColumnName("track_name");
+
+                    b.Property<int>("TrackNumber")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1)
+                        .HasColumnName("track_number");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("IsDeleted")
+                        .HasDatabaseName("IX_track_is_deleted");
+
+                    b.HasIndex("ReleaseId");
+
+                    b.ToTable("track", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.MixMetadata", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithOne("MixMetadata")
+                        .HasForeignKey("DeepDrftModels.Entities.MixMetadata", "ReleaseId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.SessionMetadata", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithOne("SessionMetadata")
+                        .HasForeignKey("DeepDrftModels.Entities.SessionMetadata", "ReleaseId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.TrackEntity", b =>
+                {
+                    b.HasOne("DeepDrftModels.Entities.ReleaseEntity", "Release")
+                        .WithMany("Tracks")
+                        .HasForeignKey("ReleaseId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.Navigation("Release");
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.ReleaseEntity", b =>
+                {
+                    b.Navigation("MixMetadata");
+
+                    b.Navigation("SessionMetadata");
+
+                    b.Navigation("Tracks");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

DeepDrftData/Migrations/20260619155610_AddPlayShareTelemetry.cs

@@ -0,0 +1,110 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DeepDrftData.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddPlayShareTelemetry : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "play_counter",
+                columns: table => new
+                {
+                    id = table.Column<long>(type: "bigint", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    track_id = table.Column<long>(type: "bigint", nullable: false),
+                    partial_count = table.Column<long>(type: "bigint", nullable: false, defaultValue: 0L),
+                    sampled_count = table.Column<long>(type: "bigint", nullable: false, defaultValue: 0L),
+                    complete_count = table.Column<long>(type: "bigint", nullable: false, defaultValue: 0L)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_play_counter", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "play_event",
+                columns: table => new
+                {
+                    id = table.Column<long>(type: "bigint", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    track_entry_key = table.Column<string>(type: "character varying(100)", maxLength: 100, nullable: false),
+                    release_id = table.Column<long>(type: "bigint", nullable: true),
+                    bucket = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    anon_id = table.Column<string>(type: "character varying(64)", maxLength: 64, nullable: true),
+                    created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_play_event", x => x.id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "share_event",
+                columns: table => new
+                {
+                    id = table.Column<long>(type: "bigint", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    target_type = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    target_key = table.Column<string>(type: "character varying(100)", maxLength: 100, nullable: false),
+                    channel = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false),
+                    anon_id = table.Column<string>(type: "character varying(64)", maxLength: 64, nullable: true),
+                    created_at = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_share_event", x => x.id);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_play_counter_track_id",
+                table: "play_counter",
+                column: "track_id",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_play_event_anon_id",
+                table: "play_event",
+                column: "anon_id");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_play_event_release_id",
+                table: "play_event",
+                column: "release_id");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_play_event_track_entry_key",
+                table: "play_event",
+                column: "track_entry_key");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_share_event_anon_id",
+                table: "share_event",
+                column: "anon_id");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_share_event_target_key",
+                table: "share_event",
+                column: "target_key");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "play_counter");
+
+            migrationBuilder.DropTable(
+                name: "play_event");
+
+            migrationBuilder.DropTable(
+                name: "share_event");
+        }
+    }
+}

DeepDrftData/Migrations/DeepDrftContextModelSnapshot.cs

@@ -67,6 +67,94 @@ namespace DeepDrftData.Migrations
                     b.ToTable("mix_metadata", (string)null);
                 });
 
+            modelBuilder.Entity("DeepDrftModels.Entities.PlayCounter", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<long>("CompleteCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("complete_count");
+
+                    b.Property<long>("PartialCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("partial_count");
+
+                    b.Property<long>("SampledCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasDefaultValue(0L)
+                        .HasColumnName("sampled_count");
+
+                    b.Property<long>("TrackId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("track_id");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TrackId")
+                        .IsUnique()
+                        .HasDatabaseName("IX_play_counter_track_id");
+
+                    b.ToTable("play_counter", (string)null);
+                });
+
+            modelBuilder.Entity("DeepDrftModels.Entities.PlayEvent", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("AnonId")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasColumnName("anon_id");
+
+                    b.Property<string>("Bucket")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("bucket");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<long?>("ReleaseId")
+                        .HasColumnType("bigint")
+                        .HasColumnName("release_id");
+
+                    b.Property<string>("TrackEntryKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("track_entry_key");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AnonId")
+                        .HasDatabaseName("IX_play_event_anon_id");
+
+                    b.HasIndex("ReleaseId")
+                        .HasDatabaseName("IX_play_event_release_id");
+
+                    b.HasIndex("TrackEntryKey")
+                        .HasDatabaseName("IX_play_event_track_entry_key");
+
+                    b.ToTable("play_event", (string)null);
+                });
+
             modelBuilder.Entity("DeepDrftModels.Entities.ReleaseEntity", b =>
                 {
                     b.Property<long>("Id")
@@ -209,6 +297,53 @@ namespace DeepDrftData.Migrations
                     b.ToTable("session_metadata", (string)null);
                 });
 
+            modelBuilder.Entity("DeepDrftModels.Entities.ShareEvent", b =>
+                {
+                    b.Property<long>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("bigint")
+                        .HasColumnName("id");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<long>("Id"));
+
+                    b.Property<string>("AnonId")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)")
+                        .HasColumnName("anon_id");
+
+                    b.Property<string>("Channel")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("channel");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at");
+
+                    b.Property<string>("TargetKey")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)")
+                        .HasColumnName("target_key");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)")
+                        .HasColumnName("target_type");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AnonId")
+                        .HasDatabaseName("IX_share_event_anon_id");
+
+                    b.HasIndex("TargetKey")
+                        .HasDatabaseName("IX_share_event_target_key");
+
+                    b.ToTable("share_event", (string)null);
+                });
+
             modelBuilder.Entity("DeepDrftModels.Entities.TrackEntity", b =>
                 {
                     b.Property<long>("Id")
@@ -222,6 +357,10 @@ namespace DeepDrftData.Migrations
                         .HasColumnType("timestamp with time zone")
                         .HasColumnName("created_at");
 
+                    b.Property<double?>("DurationSeconds")
+                        .HasColumnType("double precision")
+                        .HasColumnName("duration_seconds");
+
                     b.Property<string>("EntryKey")
                         .IsRequired()
                         .HasMaxLength(100)

DeepDrftData/Repositories/EventRepository.cs

@@ -0,0 +1,175 @@
+using DeepDrftData.Data;
+using DeepDrftModels.Entities;
+using DeepDrftModels.Enums;
+using Microsoft.EntityFrameworkCore;
+
+namespace DeepDrftData.Repositories;
+
+/// <summary>
+/// Data access for the Phase 16 anonymous telemetry tables (all SQL — the FileDatabase vault is not
+/// involved). Owns the append-only writes to <c>play_event</c> / <c>share_event</c> and the
+/// incremental-on-write bump of the <c>play_counter</c> rollup (D6). Server-side release resolution
+/// (§2.3 / D4) lives here: a play event carries only the track key, and this repository joins
+/// track→release at write time and stamps the release id on the row.
+///
+/// <para>
+/// Unlike <see cref="TrackRepository"/> these entities are not <c>BaseEntity</c>/<c>IEntity</c> (no
+/// soft-delete lifecycle), so this is a plain context-backed repository rather than an extension of the
+/// BlazorBlocks <c>Repository&lt;&gt;</c> base. It holds the same scoped <see cref="DeepDrftContext"/>
+/// the rest of the SQL layer uses, never a service locator.
+/// </para>
+/// </summary>
+public class EventRepository
+{
+    private readonly DeepDrftContext _context;
+
+    public EventRepository(DeepDrftContext context)
+    {
+        _context = context;
+    }
+
+    /// <summary>
+    /// Append one play event and bump the track's counter in a single transaction (D6). The release id
+    /// is resolved here from the track key (§2.3 / D4): a live track contributes its release id (null
+    /// for a loose track); an unknown key records the event with a null release and no counter bump
+    /// (there is no track to roll up against). Returns true when the event was written.
+    /// </summary>
+    public async Task<bool> RecordPlayAsync(
+        string trackEntryKey, PlayBucket bucket, string? anonId, CancellationToken ct = default)
+    {
+        // Resolve the track→release link server-side. Soft-deleted tracks resolve to null so a play of
+        // a since-removed track still logs (with no counter bump) rather than throwing.
+        var track = await _context.Tracks
+            .Where(t => t.EntryKey == trackEntryKey && !t.IsDeleted)
+            .Select(t => new { t.Id, t.ReleaseId })
+            .FirstOrDefaultAsync(ct);
+
+        // The append and the counter bump must commit together — wrap them in one transaction so a
+        // counter that drifts from the log is impossible. Reuse an ambient transaction if the caller
+        // already opened one.
+        var ownsTransaction = _context.Database.CurrentTransaction is null;
+        var transaction = ownsTransaction
+            ? await _context.Database.BeginTransactionAsync(ct)
+            : null;
+        try
+        {
+            _context.PlayEvents.Add(new PlayEvent
+            {
+                TrackEntryKey = trackEntryKey,
+                ReleaseId = track?.ReleaseId,
+                Bucket = bucket,
+                AnonId = anonId,
+                CreatedAt = DateTime.UtcNow,
+            });
+
+            if (track is not null)
+                await BumpCounterAsync(track.Id, bucket, ct);
+
+            await _context.SaveChangesAsync(ct);
+            if (transaction is not null)
+                await transaction.CommitAsync(ct);
+            return true;
+        }
+        catch
+        {
+            if (transaction is not null)
+                await transaction.RollbackAsync(ct);
+            throw;
+        }
+        finally
+        {
+            if (transaction is not null)
+                await transaction.DisposeAsync();
+        }
+    }
+
+    /// <summary>
+    /// Site-wide total plays: the sum of every counter's three bucket columns across all rows (Phase 16
+    /// §5). Sums the mapped columns directly rather than <see cref="PlayCounter.TotalPlays"/>, which is an
+    /// EF-ignored computed property and so not translatable. An empty counter table sums to 0 (the home
+    /// card's expected reading until the telemetry migration is applied).
+    /// </summary>
+    public Task<long> CountTotalPlaysAsync(CancellationToken ct = default)
+        => _context.PlayCounters
+            .SumAsync(c => c.PartialCount + c.SampledCount + c.CompleteCount, ct);
+
+    /// <summary>
+    /// Count distinct non-null anon ids across every play event (Phase 16 §3 / §4.2 — the all-time
+    /// unique-listener metric, D3). Null anon ids (events where the listener sent no token, or storage
+    /// was unavailable) are excluded — they are not a known listener and must not inflate the count. This
+    /// is the site-wide listener reach figure; the per-track / per-release overloads scope it.
+    /// </summary>
+    public Task<int> CountDistinctListenersAsync(CancellationToken ct = default)
+        => _context.PlayEvents
+            .Where(e => e.AnonId != null)
+            .Select(e => e.AnonId)
+            .Distinct()
+            .CountAsync(ct);
+
+    /// <summary>
+    /// Distinct listeners for one track, keyed by its vault entry key (the same key the play event
+    /// stamps). Null anon ids excluded. Per-track scope of <see cref="CountDistinctListenersAsync()"/>.
+    /// </summary>
+    public Task<int> CountDistinctListenersForTrackAsync(string trackEntryKey, CancellationToken ct = default)
+        => _context.PlayEvents
+            .Where(e => e.TrackEntryKey == trackEntryKey && e.AnonId != null)
+            .Select(e => e.AnonId)
+            .Distinct()
+            .CountAsync(ct);
+
+    /// <summary>
+    /// Distinct listeners for one release, derived across the release's tracks (D4): the play event
+    /// stamps the resolved release id at write time, so a distinct count over <c>anon_id</c> filtered by
+    /// <c>release_id</c> is exactly "distinct listeners who played any track in this release." Null anon
+    /// ids excluded. A listener who heard two tracks of the release counts once (it is a distinct count
+    /// over the union, not a sum of per-track counts).
+    /// </summary>
+    public Task<int> CountDistinctListenersForReleaseAsync(long releaseId, CancellationToken ct = default)
+        => _context.PlayEvents
+            .Where(e => e.ReleaseId == releaseId && e.AnonId != null)
+            .Select(e => e.AnonId)
+            .Distinct()
+            .CountAsync(ct);
+
+    /// <summary>Append one share event. No rollup table for shares in wave 16.1 — a plain insert.</summary>
+    public async Task RecordShareAsync(
+        ShareTargetType targetType, string targetKey, ShareChannel channel, string? anonId,
+        CancellationToken ct = default)
+    {
+        _context.ShareEvents.Add(new ShareEvent
+        {
+            TargetType = targetType,
+            TargetKey = targetKey,
+            Channel = channel,
+            AnonId = anonId,
+            CreatedAt = DateTime.UtcNow,
+        });
+        await _context.SaveChangesAsync(ct);
+    }
+
+    // Bump the matching bucket column on the track's counter row, creating the row on first play. The
+    // row is added to the change tracker but not saved here — the caller's SaveChanges/commit persists
+    // it inside the same transaction as the event append.
+    //
+    // Race note: two concurrent first-plays of the same track can both reach this method, find no
+    // counter row, and both Add a new PlayCounter. The second SaveChanges will hit the unique index on
+    // (track_id) and throw, causing the outer transaction to roll back and the event to be dropped —
+    // no crash, no counter corruption. At the expected play volume this is an acceptable loss; the
+    // unique index is the integrity backstop.
+    private async Task BumpCounterAsync(long trackId, PlayBucket bucket, CancellationToken ct)
+    {
+        var counter = await _context.PlayCounters.FirstOrDefaultAsync(c => c.TrackId == trackId, ct);
+        if (counter is null)
+        {
+            counter = new PlayCounter { TrackId = trackId };
+            _context.PlayCounters.Add(counter);
+        }
+
+        switch (bucket)
+        {
+            case PlayBucket.Partial: counter.PartialCount++; break;
+            case PlayBucket.Sampled: counter.SampledCount++; break;
+            case PlayBucket.Complete: counter.CompleteCount++; break;
+        }
+    }
+}

DeepDrftData/Repositories/TrackRepository.cs

@@ -3,6 +3,7 @@ using Data.Errors;
 using DeepDrftData.Data;
 using DeepDrftModels.DTOs;
 using DeepDrftModels.Entities;
+using DeepDrftModels.Enums;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Models.Common;
@@ -157,6 +158,70 @@ public class TrackRepository : Repository<DeepDrftContext, TrackEntity>
             .Select(g => new { ReleaseId = g.Key, Count = g.Count() })
             .ToDictionaryAsync(x => x.ReleaseId, x => x.Count, ct);
 
+    // Aggregate figures for the public home hero stat row, assembled in as few round-trips as is clean.
+    // All counts go through Query (!t.IsDeleted) plus an explicit !t.Release.IsDeleted guard so tracks
+    // under a directly-deleted release are also excluded. Mix runtime sums DurationSeconds with a
+    // null-coalesce to 0 so not-yet-backfilled rows contribute zero rather than throwing or skewing the
+    // total. The cut release-type breakdown is grouped here so a zero-count type is simply absent from
+    // the result (no present-with-zero row).
+    public async Task<HomeStatsDto> GetHomeStatsAsync(CancellationToken ct = default)
+    {
+        var releases = _context.Set<ReleaseEntity>().Where(r => !r.IsDeleted);
+
+        var cutTrackCount = await Query
+            .CountAsync(t => t.Release != null && !t.Release.IsDeleted && t.Release.Medium == ReleaseMedium.Cut, ct);
+
+        var cutReleaseTypeCounts = await releases
+            .Where(r => r.Medium == ReleaseMedium.Cut)
+            .GroupBy(r => r.ReleaseType)
+            .Select(g => new CutReleaseTypeCount { ReleaseType = g.Key, Count = g.Count() })
+            .ToListAsync(ct);
+
+        var mixReleaseCount = await releases
+            .CountAsync(r => r.Medium == ReleaseMedium.Mix, ct);
+
+        var mixRuntimeSeconds = await Query
+            .Where(t => t.Release != null && !t.Release.IsDeleted && t.Release.Medium == ReleaseMedium.Mix)
+            .SumAsync(t => t.DurationSeconds ?? 0d, ct);
+
+        return new HomeStatsDto
+        {
+            CutTrackCount = cutTrackCount,
+            CutReleaseTypeCounts = cutReleaseTypeCounts,
+            MixReleaseCount = mixReleaseCount,
+            MixRuntimeSeconds = mixRuntimeSeconds,
+        };
+    }
+
+    // EntryKey + stored duration for non-deleted tracks whose SQL duration is still null — the work list
+    // the one-time duration backfill iterates. The migration cannot read the vault, so duration is filled
+    // at runtime: this lists which rows still need it, the backfill reads each from the vault and writes
+    // it back via UpdateDurationAsync.
+    public async Task<List<TrackEntity>> GetTracksMissingDurationAsync(CancellationToken ct = default)
+        => await Query.Where(t => t.DurationSeconds == null).ToListAsync(ct);
+
+    // Set-based duration write for one track (no load round-trip), used by the backfill. The
+    // DurationSeconds == null guard keeps a re-run from re-stamping updated_at on an already-filled row
+    // and from clobbering a value the upload path may have set in the meantime.
+    public async Task<int> UpdateDurationAsync(long id, double durationSeconds, CancellationToken ct = default)
+        => await Query
+            .Where(t => t.Id == id && t.DurationSeconds == null)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(t => t.DurationSeconds, durationSeconds)
+                .SetProperty(t => t.UpdatedAt, DateTime.UtcNow), ct);
+
+    // Unconditional duration overwrite for one track (no load round-trip), used by the replace-audio
+    // path. Unlike UpdateDurationAsync, there is no null guard — replace always overwrites the
+    // existing value because a normally-uploaded track already has a non-null DurationSeconds and the
+    // null-guarded backfill query would match zero rows and silently leave it stale. Returns the count
+    // of rows affected; zero means the track was removed between the GetById lookup and this write.
+    public async Task<int> SetDurationAsync(long id, double durationSeconds, CancellationToken ct = default)
+        => await Query
+            .Where(t => t.Id == id)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(t => t.DurationSeconds, durationSeconds)
+                .SetProperty(t => t.UpdatedAt, DateTime.UtcNow), ct);
+
     // Resolve an existing release by its natural key (title + artist). Returns null when no match,
     // signalling the manager to create one. Soft-deleted releases never match.
     public async Task<ReleaseEntity?> GetReleaseByTitleAndArtistAsync(
@@ -211,6 +276,7 @@ public class TrackRepository : Repository<DeepDrftContext, TrackEntity>
         target.TrackName = source.TrackName;
         target.TrackNumber = source.TrackNumber;
         target.OriginalFileName = source.OriginalFileName;
+        target.DurationSeconds = source.DurationSeconds;
         target.ReleaseId = source.ReleaseId;
     }
 }

DeepDrftData/TrackConverter.cs

@@ -80,6 +80,7 @@ public class TrackConverter : IEntityToModelConverter<TrackEntity, TrackDto>
         TrackName = entity.TrackName,
         OriginalFileName = entity.OriginalFileName,
         TrackNumber = entity.TrackNumber,
+        DurationSeconds = entity.DurationSeconds,
         ReleaseId = entity.ReleaseId,
         Release = entity.Release is null ? null : Convert(entity.Release)
     };
@@ -96,6 +97,7 @@ public class TrackConverter : IEntityToModelConverter<TrackEntity, TrackDto>
         TrackName = model.TrackName,
         OriginalFileName = model.OriginalFileName,
         TrackNumber = model.TrackNumber,
+        DurationSeconds = model.DurationSeconds,
         ReleaseId = model.ReleaseId
     };
 }

DeepDrftData/TrackManager.cs

@@ -164,14 +164,14 @@ public class TrackManager
         }
     }
 
-    public async Task<ResultContainer<ReleaseDto>> FindOrCreateRelease(
+    public async Task<ResultContainer<(ReleaseDto Release, bool WasCreated)>> FindOrCreateRelease(
         string title, string artist, ReleaseDto releaseData, CancellationToken cancellationToken = default)
     {
         try
         {
             var existing = await Repository.GetReleaseByTitleAndArtistAsync(title, artist, cancellationToken);
             if (existing is not null)
-                return ResultContainer<ReleaseDto>.CreatePassResult(TrackConverter.Convert(existing));
+                return ResultContainer<(ReleaseDto, bool)>.CreatePassResult((TrackConverter.Convert(existing), false));
 
             // The natural key (title + artist) is authoritative — override whatever the caller put
             // in releaseData so a typo upstream cannot create a release that won't be found again.
@@ -186,21 +186,21 @@ public class TrackManager
             try
             {
                 var added = await Repository.AddReleaseAsync(entity, cancellationToken);
-                return ResultContainer<ReleaseDto>.CreatePassResult(TrackConverter.Convert(added));
+                return ResultContainer<(ReleaseDto, bool)>.CreatePassResult((TrackConverter.Convert(added), true));
             }
             catch (ClassifiedDbException ex) when (ex.Error.Category == DbErrorCategory.UniqueViolation)
             {
                 // Concurrent upload inserted the same (title, artist) between our read and write.
-                // Re-query and return the winning row. Should not return null here since the
-                // constraint just fired, but re-throw if it does so the caller sees an error.
+                // Re-query and return the winning row as WasCreated=false so the caller (UploadAsync
+                // CREATE path) treats the lost race as a duplicate rather than silently attaching.
                 var race = await Repository.GetReleaseByTitleAndArtistAsync(title, artist, cancellationToken);
                 if (race is null) throw;
-                return ResultContainer<ReleaseDto>.CreatePassResult(TrackConverter.Convert(race));
+                return ResultContainer<(ReleaseDto, bool)>.CreatePassResult((TrackConverter.Convert(race), false));
             }
         }
         catch (Exception e)
         {
-            return ResultContainer<ReleaseDto>.CreateFailResult(e.Message);
+            return ResultContainer<(ReleaseDto, bool)>.CreateFailResult(e.Message);
         }
     }
 
@@ -236,6 +236,61 @@ public class TrackManager
         }
     }
 
+    public async Task<ResultContainer<HomeStatsDto>> GetHomeStats(CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var stats = await Repository.GetHomeStatsAsync(cancellationToken);
+            return ResultContainer<HomeStatsDto>.CreatePassResult(stats);
+        }
+        catch (Exception e)
+        {
+            return ResultContainer<HomeStatsDto>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<List<TrackDto>>> GetTracksMissingDuration(CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var entities = await Repository.GetTracksMissingDurationAsync(cancellationToken);
+            return ResultContainer<List<TrackDto>>.CreatePassResult(
+                entities.Select(TrackConverter.Convert).ToList());
+        }
+        catch (Exception e)
+        {
+            return ResultContainer<List<TrackDto>>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<int>> UpdateDuration(long id, double durationSeconds, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var updated = await Repository.UpdateDurationAsync(id, durationSeconds, cancellationToken);
+            return ResultContainer<int>.CreatePassResult(updated);
+        }
+        catch (Exception e)
+        {
+            return ResultContainer<int>.CreateFailResult(e.Message);
+        }
+    }
+
+    public async Task<ResultContainer<int>> SetDuration(long id, double durationSeconds, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var affected = await Repository.SetDurationAsync(id, durationSeconds, cancellationToken);
+            if (affected == 0)
+                return ResultContainer<int>.CreateFailResult($"Duration write matched no rows for track {id}.");
+            return ResultContainer<int>.CreatePassResult(affected);
+        }
+        catch (Exception e)
+        {
+            return ResultContainer<int>.CreateFailResult(e.Message);
+        }
+    }
+
     public async Task<ResultContainer<TrackDto>> Create(TrackDto newTrack)
     {
         try
@@ -247,13 +302,13 @@ public class TrackManager
             if (newTrack.Release is { } release && !string.IsNullOrWhiteSpace(release.Title))
             {
                 var resolved = await FindOrCreateRelease(release.Title, release.Artist, release);
-                if (!resolved.Success || resolved.Value is null)
+                if (!resolved.Success)
                 {
                     var error = resolved.Messages.FirstOrDefault()?.Message ?? "Failed to resolve release.";
                     return ResultContainer<TrackDto>.CreateFailResult(error);
                 }
 
-                newTrack.ReleaseId = resolved.Value.Id;
+                newTrack.ReleaseId = resolved.Value.Release.Id;
             }
 
             var added = await Repository.AddAsync(TrackConverter.Convert(newTrack));

DeepDrftManager/Components/App.razor

@@ -13,6 +13,7 @@
     <link rel="stylesheet" href="@Assets["_content/DeepDrftShared.Client/styles/deepdrft-tokens.css"]" />
     <ImportMap />
     <link rel="icon" type="image/ico" href="deepdrft-logo.ico" />
+    <meta name="robots" content="noindex,nofollow" />
     <HeadOutlet @rendermode="ServerMode" />
 </head>
 

DeepDrftManager/Components/Layout/CmsHomeLayout.razor

@@ -0,0 +1,40 @@
+@inherits LayoutComponentBase
+@using DeepDrftShared.Client.Common
+
+<MudThemeProvider IsDarkMode="false" Theme="@DeepDrftPalettes.Cms" />
+<MudPopoverProvider />
+
+<MudLayout>
+    <MudAppBar Dense="true" Elevation="1" Color="Color.Primary">
+        <a href="/" class="mx-2">
+            <MudStack Row AlignItems="AlignItems.Center">
+                <MudImage Src="img/deepdrft-logo-l.webp" 
+                          Alt="Deep Drft Ornamental Logo Left"
+                          Width="24"
+                          Height="24 "
+                          Style="filter: invert(1);"/>
+                
+                <MudText Typo="Typo.button" Style="color: var(--deepdrft-white);">Deep DRFT Management</MudText>
+                
+                <MudImage Src="img/deepdrft-logo-r.webp" 
+                          Alt="Deep Drft Ornamental Logo Right"
+                          Width="24"
+                          Height="24"
+                          Style="filter: invert(1);"/>
+            </MudStack>
+        </a>
+    </MudAppBar>
+    <MudMainContent>
+        <MudContainer MaxWidth="MaxWidth.Small"
+                      Class="d-flex flex-column justify-center align-center"
+                      Style="min-height: calc(100vh - 48px);">
+            @Body
+        </MudContainer>
+    </MudMainContent>
+</MudLayout>
+
+<div id="blazor-error-ui" data-nosnippet>
+    An unhandled error has occurred.
+    <a href="." class="reload">Reload</a>
+    <span class="dismiss">🗙</span>
+</div>

DeepDrftManager/Components/Layout/CmsLayout.razor

@@ -1,5 +1,6 @@
 @inherits LayoutComponentBase
 @using DeepDrftShared.Client.Common
+@using AuthBlocksWeb.Components.Layout
 
 <MudThemeProvider IsDarkMode="false" Theme="@DeepDrftPalettes.Cms" />
 <MudPopoverProvider />
@@ -8,16 +9,48 @@
 
 <MudLayout>
     <MudAppBar Dense="true" Elevation="1" Color="Color.Primary">
-        <MudText Typo="Typo.h6" Class="ml-3" Style="font-family: 'DM Sans', sans-serif; letter-spacing: 0.05em;">
-            Deep Drft — Admin
-        </MudText>
+        <MudIconButton Icon="@Icons.Material.Filled.Menu"
+                       Color="Color.Inherit"
+                       Edge="Edge.Start"
+                       OnClick="ToggleDrawer" />
+        <a href="/" class="mx-2">
+            <MudStack Row AlignItems="AlignItems.Center">
+                <MudImage Src="img/deepdrft-logo-l.webp" 
+                          Alt="Deep Drft Ornamental Logo Left"
+                          Width="24"
+                          Height="24 "
+                          Style="filter: invert(1);"/>
+                
+                <MudText Typo="Typo.button" Style="color: var(--deepdrft-white);">Deep DRFT Management</MudText>
+                
+                <MudImage Src="img/deepdrft-logo-r.webp" 
+                          Alt="Deep Drft Ornamental Logo Right"
+                          Width="24"
+                          Height="24"
+                          Style="filter: invert(1);"/>
+            </MudStack>
+        </a>
         <MudSpacer />
-        <MudTooltip Text="Back to site">
+        <MudTooltip Text="Catalogue">
             <MudIconButton Icon="@Icons.Material.Filled.Home"
-                           Href="/"
+                           Href="/catalogue"
                            Color="Color.Inherit" />
         </MudTooltip>
     </MudAppBar>
+    <MudDrawer @bind-Open="_drawerOpen" Elevation="2" Variant="DrawerVariant.Responsive" ClipMode="DrawerClipMode.Always">
+        <MudNavMenu>
+            <MudNavLink Href="/catalogue" Match="NavLinkMatch.All" Icon="@Icons.Material.Filled.Dashboard">Catalogue</MudNavLink>
+            <MudNavLink Href="/releases" Match="NavLinkMatch.Prefix" Icon="@Icons.Material.Filled.LibraryMusic">Releases</MudNavLink>
+            <MudNavLink Href="/tracks/upload" Match="NavLinkMatch.Prefix" Icon="@Icons.Material.Filled.UploadFile">Upload</MudNavLink>
+            <UserAdminMenu />
+            <HierarchicalRoleAuthorizeView RolesList="@([SystemRoleConstants.UserAdmin])">
+                <Authorized>
+                    <MudNavLink Href="/useradmin/users/new" Match="NavLinkMatch.Prefix" Icon="@Icons.Material.Filled.PersonAdd">Provision User</MudNavLink>
+                </Authorized>
+            </HierarchicalRoleAuthorizeView>
+            <AccountNavMenu />
+        </MudNavMenu>
+    </MudDrawer>
     <MudMainContent Class="pt-14 pb-8">
         <MudContainer MaxWidth="MaxWidth.False" Class="pa-4">
             @Body
@@ -25,6 +58,12 @@
     </MudMainContent>
 </MudLayout>
 
+@code {
+    private bool _drawerOpen = true;
+
+    private void ToggleDrawer() => _drawerOpen = !_drawerOpen;
+}
+
 <div id="blazor-error-ui" data-nosnippet>
     An unhandled error has occurred.
     <a href="." class="reload">Reload</a>

DeepDrftManager/Components/NotFound.razor

@@ -1,6 +1,6 @@
 @page "/404"
 
-<PageTitle>SkipperHaven - Page Not Found</PageTitle>
+<PageTitle>Deep DRFT Management - Page Not Found</PageTitle>
 
 <MudText Typo="Typo.h1" Color="Color.Primary">
     404 - Resource Not Found 

DeepDrftManager/Components/Pages/Home.razor

@@ -0,0 +1,30 @@
+@page "/"
+@layout Layout.CmsHomeLayout
+
+<PageTitle>Deep DRFT Management</PageTitle>
+
+<HierarchicalRoleAuthorizeView>
+    <Authorized>
+        <RedirectToCatalogue />
+    </Authorized>
+    <NotAuthorized>
+        <MudStack AlignItems="AlignItems.Center" Spacing="4" Class="my-8">
+            <MudImage Fluid="true" Src="img/cms-hero.webp" Alt="Deep Drft" />
+            <MudText Typo="Typo.subtitle1" Align="Align.Center" Class="text-uppercase mud-text-secondary">
+                Catalogue Management
+            </MudText>
+            <MudButton Variant="Variant.Filled"
+                       Color="Color.Primary"
+                       Href="@LoginHref"
+                       Class="mt-4"
+                       Style="min-width: 200px;">
+                Login
+            </MudButton>
+        </MudStack>
+    </NotAuthorized>
+</HierarchicalRoleAuthorizeView>
+
+@code {
+    private static readonly string LoginHref =
+        $"/account/login?returnUrl={Uri.EscapeDataString("catalogue")}";
+}

DeepDrftManager/Components/Pages/Index.razor

@@ -1,125 +1,103 @@
-@page "/"
+@page "/catalogue"
 @using DeepDrftManager.Services
+@using DeepDrftModels.Enums
 @attribute [Authorize]
 @layout Layout.CmsLayout
 @inject NavigationManager Nav
-@inject ICmsTrackService CmsTrackService
+@inject ICmsReleaseService CmsReleaseService
 @inject ILogger<Index> Logger
 
-<PageTitle>DeepDrft CMS</PageTitle>
+<PageTitle>Deep DRFT Management - Catalogue</PageTitle>
 
 <MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
     <MudText Typo="Typo.h3" Class="mb-6">Catalogue</MudText>
 
     <MudGrid Spacing="4">
-        <MudItem xs="12" sm="4">
-            @SummaryCard("Tracks", Icons.Material.Filled.LibraryMusic, Color.Primary, _tracksLoading, _trackCount)
-        </MudItem>
-        <MudItem xs="12" sm="4">
-            @SummaryCard("Releases", Icons.Material.Filled.Album, Color.Secondary, _albumsLoading, _albumCount)
-        </MudItem>
-        <MudItem xs="12" sm="4">
-            @SummaryCard("Genres", Icons.Material.Filled.Category, Color.Tertiary, _genresLoading, _genreCount)
-        </MudItem>
+        @foreach (var card in Cards)
+        {
+            <MudItem xs="12" sm="4">
+                @SummaryCard(card)
+            </MudItem>
+        }
     </MudGrid>
 </MudContainer>
 
 @code {
-    private bool _tracksLoading = true;
-    private bool _albumsLoading = true;
-    private bool _genresLoading = true;
+    // One card per release medium. Each deep-links to /releases with the medium tab pre-selected via the
+    // same ?medium= convention the Add Track buttons use. The count is that medium's release total.
+    private sealed record MediumCard(ReleaseMedium Medium, string Label, string Icon, Color Color);
 
-    private int? _trackCount;
-    private int? _albumCount;
-    private int? _genreCount;
+    private static readonly IReadOnlyList<MediumCard> Cards = new[]
+    {
+        new MediumCard(ReleaseMedium.Cut, "CUTS", Icons.Material.Filled.Album, Color.Primary),
+        new MediumCard(ReleaseMedium.Session, "SESSIONS", Icons.Material.Filled.Mic, Color.Secondary),
+        new MediumCard(ReleaseMedium.Mix, "MIXES", Icons.Material.Filled.GraphicEq, Color.Tertiary),
+    };
+
+    // Medium → release count (null while loading or on failure). Each medium's count is one cheap paged
+    // read (pageSize 1) for its TotalCount, run concurrently.
+    private readonly Dictionary<ReleaseMedium, int?> _counts = new();
+    private readonly HashSet<ReleaseMedium> _loading = Cards.Select(c => c.Medium).ToHashSet();
 
     protected override async Task OnInitializedAsync()
     {
-        // Three independent reads run concurrently. Each loader calls StateHasChanged in its
-        // finally block so its card updates as soon as its own fetch returns.
-        await Task.WhenAll(LoadTrackCount(), LoadAlbumCount(), LoadGenreCount());
+        // Each loader calls StateHasChanged in its finally block so its card updates as soon as its own
+        // fetch returns, rather than blocking on the slowest of the three.
+        await Task.WhenAll(Cards.Select(c => LoadCountAsync(c.Medium)));
     }
 
-    private async Task LoadTrackCount()
+    private async Task LoadCountAsync(ReleaseMedium medium)
     {
         try
         {
-            var result = await CmsTrackService.GetTrackCountAsync();
-            _trackCount = result.Success ? result.Value : null;
+            // pageSize 1 — we only need TotalCount, not the rows. Sort column is required by the API but
+            // immaterial to the count.
+            var result = await CmsReleaseService.GetPagedAsync(
+                medium, page: 1, pageSize: 1, sortColumn: "Title", sortDescending: false);
+            _counts[medium] = result.Success && result.Value is not null ? result.Value.TotalCount : null;
             if (!result.Success)
             {
-                Logger.LogWarning("Dashboard track count failed: {Error}",
-                    result.Messages.FirstOrDefault()?.Message ?? "Unknown error");
+                Logger.LogWarning("Dashboard {Medium} count failed: {Error}",
+                    medium, result.Messages.FirstOrDefault()?.Message ?? "Unknown error");
             }
         }
         finally
         {
-            _tracksLoading = false;
+            _loading.Remove(medium);
             StateHasChanged();
         }
     }
 
-    private async Task LoadAlbumCount()
-    {
-        try
-        {
-            var result = await CmsTrackService.GetReleasesAsync();
-            _albumCount = result.Success && result.Value is not null ? result.Value.Count : null;
-            if (!result.Success)
-            {
-                Logger.LogWarning("Dashboard album summaries failed: {Error}",
-                    result.Messages.FirstOrDefault()?.Message ?? "Unknown error");
-            }
-        }
-        finally
-        {
-            _albumsLoading = false;
-            StateHasChanged();
-        }
-    }
-
-    private async Task LoadGenreCount()
-    {
-        try
-        {
-            var result = await CmsTrackService.GetGenreSummariesAsync();
-            _genreCount = result.Success && result.Value is not null ? result.Value.Count : null;
-            if (!result.Success)
-            {
-                Logger.LogWarning("Dashboard genre summaries failed: {Error}",
-                    result.Messages.FirstOrDefault()?.Message ?? "Unknown error");
-            }
-        }
-        finally
-        {
-            _genresLoading = false;
-            StateHasChanged();
-        }
-    }
-
-    private RenderFragment SummaryCard(string label, string icon, Color color, bool loading, int? count) => __builder =>
+    private RenderFragment SummaryCard(MediumCard card) => __builder =>
     {
+        var loading = _loading.Contains(card.Medium);
+        var count = _counts.GetValueOrDefault(card.Medium);
         <MudCard Elevation="8" Style="height: 100%;">
             <MudCardContent>
                 <MudStack AlignItems="AlignItems.Center" Spacing="2" Class="py-4">
-                    <MudIcon Icon="@icon" Color="@color" Size="Size.Large" />
+                    <MudIcon Icon="@card.Icon" Color="@card.Color" Size="Size.Large" />
                     @if (loading)
                     {
-                        <MudProgressCircular Color="@color" Indeterminate="true" Size="Size.Small" />
+                        <MudProgressCircular Color="@card.Color" Indeterminate="true" Size="Size.Small" />
                     }
                     else
                     {
-                        <MudText Typo="Typo.h3" Color="@color">@(count?.ToString() ?? "—")</MudText>
+                        <MudText Typo="Typo.h3" Color="@card.Color">@(count?.ToString() ?? "—")</MudText>
                     }
-                    <MudText Typo="Typo.subtitle1" Class="mud-text-secondary text-uppercase">@label</MudText>
+                    <MudText Typo="Typo.subtitle1" Class="mud-text-secondary text-uppercase">@card.Label</MudText>
                 </MudStack>
             </MudCardContent>
             <MudCardActions Class="justify-center pb-4">
-                <MudButton Variant="Variant.Text" Color="@color" EndIcon="@Icons.Material.Filled.ArrowForward"
-                           OnClick="@(() => Nav.NavigateTo("/tracks"))">
+                <MudButton Variant="Variant.Text" Color="@card.Color" EndIcon="@Icons.Material.Filled.ArrowForward"
+                           OnClick="@(() => Nav.NavigateTo(ReleasesHref(card.Medium)))">
                     View
                 </MudButton>
             </MudCardActions>
         </MudCard>
     };
+
+    // Deep-link to the Releases page with this medium's tab pre-selected. Mirrors the ?medium= seed the
+    // Add Track buttons use; the Releases page reads it to set the active tab.
+    private static string ReleasesHref(ReleaseMedium medium) =>
+        $"/releases?medium={medium.ToString().ToLowerInvariant()}";
 }

DeepDrftManager/Components/Pages/Tracks/BatchEdit.razor

@@ -8,14 +8,13 @@
 @attribute [Authorize]
 
 @inject ICmsTrackService CmsTrackService
-@inject CmsTrackBrowserViewModel VM
 @inject AuthenticationStateProvider AuthStateProvider
 @inject NavigationManager Navigation
 @inject ISnackbar Snackbar
 @inject IDialogService DialogService
 @inject ILogger<BatchEdit> Logger
 
-<PageTitle>Edit Release — DeepDrft CMS</PageTitle>
+<PageTitle>Edit Release — Deep DRFT Management</PageTitle>
 
 <MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
     <MudText Typo="Typo.h4" GutterBottom="true">Edit Release</MudText>
@@ -60,14 +59,19 @@
            single-track medium, mirroring BatchUpload's same-named collapse. Cut keeps the full list. *@
         <MudGrid>
             <MudItem xs="12" md="5">
+                @* ExistingTrackCount counts edit-session persisted rows (Id.HasValue), not authoritative
+                   live release count — acceptable because this gate only hides a UI control; the
+                   TrySoftDeleteEmptyReleaseAsync backstop remains the authoritative guard. *@
                 <BatchTrackList Tracks="_tracks"
                                 @bind-SelectedIndex="_selectedIndex"
                                 Disabled="_saving"
                                 AllowNewTracks="@(_medium == ReleaseMedium.Cut)"
+                                ExistingTrackCount="@_tracks.Count(t => t.Id.HasValue)"
                                 OnWavFilesSelected="HandleWavFilesSelected"
                                 OnMoveUp="MoveUp"
                                 OnMoveDown="MoveDown"
-                                OnRemove="RemoveRow" />
+                                OnRemove="RemoveRow"
+                                OnReplaceFileSelected="HandleReplaceFileSelected" />
             </MudItem>
 
             <MudItem xs="12" md="7">
@@ -87,7 +91,7 @@
 
         <MudStack Row="true" Justify="Justify.FlexEnd" Spacing="2" Class="mt-4">
             <MudButton Variant="Variant.Text"
-                       OnClick="@(() => Navigation.NavigateTo("/tracks/albums"))"
+                       OnClick="@(() => Navigation.NavigateTo("/releases"))"
                        Disabled="_saving">
                 Cancel
             </MudButton>
@@ -110,8 +114,8 @@
 </MudContainer>
 
 @code {
-    // 1 GB ceiling matches DeepDrftAPI's per-request limit on api/track/upload.
-    private const long MaxUploadBytes = 1_073_741_824L;
+    // ~1.86 GB ceiling matches DeepDrftAPI's per-request limit on api/track/upload.
+    private const long MaxUploadBytes = 2_000_000_000L;
 
     // Release-title addressing (Album-mode batch Edit): loads the whole release by title.
     [Parameter] public string AlbumName { get; set; } = string.Empty;
@@ -142,6 +146,9 @@
     private string _releaseDate = string.Empty;
     private ReleaseType _releaseType = ReleaseType.Single;
     private ReleaseMedium _medium = ReleaseMedium.Cut;
+    // The id of the release being edited. New tracks added in this session attach to it via the upload
+    // service's releaseId (ATTACH) path, so they are not rejected as a pre-existing-(title,artist) duplicate.
+    private long? _releaseId;
 
     // The medium selector drives ReleaseType visibility and is persisted on save: every UpdateAsync /
     // UploadTrackAsync call below passes _medium, and PUT api/track/meta resets ReleaseType to its
@@ -210,6 +217,10 @@
         }
 
         var release = tracks[0].Release;
+        // The release being edited already exists, so any new track added here ATTACHES to it (the upload
+        // service's releaseId path) rather than taking the CREATE path, which would reject it as a
+        // duplicate (title, artist). Fall back to the track's own ReleaseId if the nav is not populated.
+        _releaseId = release?.Id ?? tracks[0].ReleaseId;
         _albumName = albumName;
         _artist = release?.Artist ?? string.Empty;
         _genre = release?.Genre ?? string.Empty;
@@ -323,6 +334,85 @@
         if (_selectedIndex >= _tracks.Count) _selectedIndex = _tracks.Count - 1;
     }
 
+    private async Task HandleReplaceFileSelected((int Index, IBrowserFile File) picked)
+    {
+        var (index, file) = picked;
+        if (index < 0 || index >= _tracks.Count) return;
+
+        var row = _tracks[index];
+        if (!row.Id.HasValue)
+        {
+            // Defensive: replace is only offered on persisted rows. A new row would have no track to
+            // swap against — it takes the upload path on save instead.
+            return;
+        }
+
+        if (!file.Name.EndsWith(".wav", StringComparison.OrdinalIgnoreCase))
+        {
+            Snackbar.Add($"'{file.Name}' is not a .wav file.", Severity.Warning);
+            return;
+        }
+
+        var confirmed = await DialogService.ShowMessageBox(
+            "Replace audio",
+            $"Replace the audio for '{row.TrackName}' with '{file.Name}'? " +
+            "Metadata stays the same; the waveform is regenerated for the new audio.",
+            yesText: "Replace", cancelText: "Cancel");
+        if (confirmed != true) return;
+
+        row.Status = BatchRowStatus.Uploading;
+        row.UploadedBytes = 0;
+        row.TotalBytes = file.Size;
+        row.ErrorMessage = null;
+        StateHasChanged();
+
+        try
+        {
+            await using var wavStream = file.OpenReadStream(MaxUploadBytes);
+
+            var lastPercent = -1;
+            var progress = new Progress<long>(written =>
+            {
+                row.UploadedBytes = written;
+                if (row.UploadPercent != lastPercent)
+                {
+                    lastPercent = row.UploadPercent;
+                    StateHasChanged();
+                }
+            });
+
+            var result = await CmsTrackService.ReplaceTrackAudioAsync(
+                row.Id.Value, wavStream, file.Size, file.Name, file.ContentType, progress);
+
+            if (!result.Success)
+            {
+                var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                row.Status = BatchRowStatus.Failed;
+                row.ErrorMessage = error;
+                Snackbar.Add($"Replace failed: {error}", Severity.Error);
+            }
+            else
+            {
+                // Reset to Queued (not Done): a Done row is skipped by SaveAsync, but the admin may
+                // still want to save pending metadata edits. The audio swap is already persisted.
+                row.Status = BatchRowStatus.Queued;
+                row.OriginalFileName = file.Name;
+                Snackbar.Add($"Replaced audio for '{row.TrackName}'.", Severity.Success);
+            }
+        }
+        catch (Exception ex)
+        {
+            Logger.LogError(ex, "Replace audio failed for track id {Id}", row.Id);
+            row.Status = BatchRowStatus.Failed;
+            row.ErrorMessage = "Replace failed — please try again.";
+            Snackbar.Add("Replace failed — please try again.", Severity.Error);
+        }
+        finally
+        {
+            StateHasChanged();
+        }
+    }
+
     private void RemoveCover()
     {
         // Defer the actual clear to save: pass "" to UpdateAsync's tri-state imagePath. Nulling
@@ -476,9 +566,26 @@
                     {
                         // New track — upload, then link cover art with a follow-up update (same
                         // two-step pattern as BatchUpload; the upload endpoint takes no imagePath).
-                        await using var wavStream = row.WavFile!.OpenReadStream(MaxUploadBytes);
+                        row.UploadedBytes = 0;
+                        row.TotalBytes = row.WavFile!.Size;
+                        await using var wavStream = row.WavFile.OpenReadStream(MaxUploadBytes);
+
+                        // Re-render only on whole-percent change so a large upload paints ~100 frames,
+                        // not thousands. Progress<T> marshals back onto the renderer dispatcher.
+                        var lastPercent = -1;
+                        var progress = new Progress<long>(written =>
+                        {
+                            row.UploadedBytes = written;
+                            if (row.UploadPercent != lastPercent)
+                            {
+                                lastPercent = row.UploadPercent;
+                                StateHasChanged();
+                            }
+                        });
+
                         var uploadResult = await CmsTrackService.UploadTrackAsync(
                             wavStream,
+                            row.WavFile.Size,
                             row.WavFile.Name,
                             row.WavFile.ContentType,
                             row.TrackName,
@@ -491,7 +598,9 @@
                             createdByUserId,
                             _releaseType,
                             trackNumber,
-                            _medium);
+                            _medium,
+                            _releaseId,
+                            progress);
 
                         if (!uploadResult.Success || uploadResult.Value is null)
                         {
@@ -546,15 +655,10 @@
                 StateHasChanged();
             }
 
-            // Either branch changed catalogue data, so the browse caches are stale regardless of
-            // whether every track saved. Invalidate before navigating (or staying) so the /tracks
-            // album and genre lists re-fetch.
-            VM.Invalidate();
-
             if (failed == 0)
             {
                 Snackbar.Add($"Saved {succeeded} track(s).", Severity.Success);
-                Navigation.NavigateTo("/tracks/albums");
+                Navigation.NavigateTo("/releases");
             }
             else
             {

DeepDrftManager/Components/Pages/Tracks/BatchRowModel.cs

@@ -27,6 +27,17 @@ public class BatchRowModel
     public BatchRowStatus Status { get; set; } = BatchRowStatus.Queued;
 
     public string? ErrorMessage { get; set; }
+
+    /// <summary>Bytes pushed to the wire so far for this row's in-flight upload. Reset per attempt.</summary>
+    public long UploadedBytes { get; set; }
+
+    /// <summary>Total payload bytes for this row (the WAV file size), the progress denominator.</summary>
+    public long TotalBytes { get; set; }
+
+    /// <summary>Upload completion as a 0–100 percent, or 0 when the total is unknown.</summary>
+    public int UploadPercent => TotalBytes > 0
+        ? (int)Math.Clamp(UploadedBytes * 100 / TotalBytes, 0, 100)
+        : 0;
 }
 
 public enum BatchRowStatus { Queued, Uploading, Done, Failed }

DeepDrftManager/Components/Pages/Tracks/BatchTrackDetail.razor

@@ -21,7 +21,7 @@ else
         {
             <MudField Label="Original File" Variant="Variant.Outlined" InnerPadding="false">
                 <MudText Typo="Typo.body2">@(string.IsNullOrEmpty(SelectedTrack.OriginalFileName) ? "—" : SelectedTrack.OriginalFileName)</MudText>
-                <MudText Typo="Typo.caption" Color="Color.Default">Existing track — audio is not editable.</MudText>
+                <MudText Typo="Typo.caption" Color="Color.Default">Use the Replace audio action in the list to swap this track's audio.</MudText>
             </MudField>
         }
         else

DeepDrftManager/Components/Pages/Tracks/BatchTrackList.razor

@@ -34,13 +34,45 @@
                                        Disabled="@(index == Tracks.Count - 1 || Disabled)"
                                        OnClick="@(() => OnMoveDown.InvokeAsync(index))"
                                        aria-label="Move track down" />
-                        <MudIconButton Icon="@Icons.Material.Filled.Delete"
-                                       Color="Color.Error"
-                                       Size="Size.Small"
-                                       Disabled="@Disabled"
-                                       OnClick="@(() => OnRemove.InvokeAsync(index))"
-                                       aria-label="Remove track" />
+                        @* Replace audio: existing (persisted) rows only. New rows still pick their WAV
+                           via the file input above, so a replace control there would be redundant. A
+                           native <label for> drives a per-row hidden InputFile — clicking the icon
+                           opens that row's picker with zero JS (no eval, no programmatic .click()). *@
+                        @if (row.Id.HasValue)
+                        {
+                            <label for="@ReplaceInputId(index)" @onclick:stopPropagation="true"
+                                   style="display: inline-flex; @(Disabled ? "pointer-events: none; opacity: 0.5;" : "cursor: pointer;")">
+                                <MudIcon Icon="@Icons.Material.Filled.SwapHoriz"
+                                         Color="Color.Primary"
+                                         Size="Size.Small"
+                                         aria-label="Replace audio" />
+                            </label>
+                            <InputFile id="@ReplaceInputId(index)"
+                                       OnChange="@(e => OnReplaceFileSelected.InvokeAsync((index, e.File)))"
+                                       accept=".wav,audio/wav,audio/x-wav"
+                                       disabled="@Disabled"
+                                       style="display: none;" />
+                        }
+                        @* Remove: hidden for the sole remaining persisted track so a release can never
+                           be track-deleted down to zero (that path soft-deletes the whole release). New
+                           rows are always removable — dropping one only discards a pending upload. *@
+                        @if (!(row.Id.HasValue && ExistingTrackCount <= 1))
+                        {
+                            <MudIconButton Icon="@Icons.Material.Filled.Delete"
+                                           Color="Color.Error"
+                                           Size="Size.Small"
+                                           Disabled="@Disabled"
+                                           OnClick="@(() => OnRemove.InvokeAsync(index))"
+                                           aria-label="Remove track" />
+                        }
                     </MudStack>
+                    @if (row.Status == BatchRowStatus.Uploading)
+                    {
+                        <MudProgressLinear Color="Color.Info"
+                                           Value="@row.UploadPercent"
+                                           Class="mx-2 mb-2"
+                                           aria-label="@($"Uploading {row.TrackName}")" />
+                    }
                 </div>
             }
         </MudList>
@@ -53,11 +85,28 @@
     [Parameter] public EventCallback<int> SelectedIndexChanged { get; set; }
     [Parameter] public bool Disabled { get; set; }
     [Parameter] public bool AllowNewTracks { get; set; } = true;
+
+    /// <summary>
+    /// Count of existing (persisted, Id-bearing) tracks in the list. When this is 1, the remove
+    /// control on the sole persisted row is suppressed so a release cannot be track-deleted to zero
+    /// (replace + release-level delete remain). New unsaved rows are excluded from this count.
+    /// </summary>
+    [Parameter] public int ExistingTrackCount { get; set; }
+
     [Parameter] public EventCallback<IReadOnlyList<IBrowserFile>> OnWavFilesSelected { get; set; }
     [Parameter] public EventCallback<int> OnMoveUp { get; set; }
     [Parameter] public EventCallback<int> OnMoveDown { get; set; }
     [Parameter] public EventCallback<int> OnRemove { get; set; }
 
+    /// <summary>
+    /// Raised when the admin picks a replacement WAV for an existing row, carrying the list index and
+    /// the chosen file. Only fired for persisted (Id-bearing) rows.
+    /// </summary>
+    [Parameter] public EventCallback<(int Index, IBrowserFile File)> OnReplaceFileSelected { get; set; }
+
+    // Stable per-row DOM id linking the swap-icon <label> to its hidden InputFile.
+    private static string ReplaceInputId(int index) => $"replace-audio-input-{index}";
+
     private const int MaxFilesPerPick = 50;
 
     private Task SelectRow(int index) => SelectedIndexChanged.InvokeAsync(index);

DeepDrftManager/Components/Pages/Tracks/BatchUpload.razor

@@ -11,9 +11,8 @@
 @inject NavigationManager Navigation
 @inject ISnackbar Snackbar
 @inject ILogger<BatchUpload> Logger
-@inject CmsTrackBrowserViewModel VM
 
-<PageTitle>Upload Release — DeepDrft CMS</PageTitle>
+<PageTitle>Upload Release — Deep DRFT Management</PageTitle>
 
 <MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
     <MudText Typo="Typo.h4" GutterBottom="true">Upload Release</MudText>
@@ -64,6 +63,12 @@
                 {
                     @* Track name is derived from the Release Name for Session/Mix — no separate input. *@
                     <MudText Typo="Typo.caption">Selected: @(_tracks[0].WavFile?.Name ?? "—")</MudText>
+                    @if (_tracks[0].Status == BatchRowStatus.Uploading)
+                    {
+                        <MudProgressLinear Color="Color.Info"
+                                           Value="@_tracks[0].UploadPercent"
+                                           aria-label="Uploading track" />
+                    }
                 }
             </MudStack>
         </MudPaper>
@@ -81,7 +86,7 @@
 
     <MudStack Row="true" Justify="Justify.FlexEnd" Spacing="2" Class="mt-4">
         <MudButton Variant="Variant.Text"
-                   OnClick="@(() => Navigation.NavigateTo("/tracks"))"
+                   OnClick="@(() => Navigation.NavigateTo("/releases"))"
                    Disabled="_uploading">
             Cancel
         </MudButton>
@@ -103,9 +108,9 @@
 </MudContainer>
 
 @code {
-    // 1 GB ceiling matches DeepDrftAPI's per-request limit on api/track/upload; the
+    // ~1.86 GB ceiling matches DeepDrftAPI's per-request limit on api/track/upload; the
     // streaming path means the limit caps the request, not in-memory buffering.
-    private const long MaxUploadBytes = 1_073_741_824L;
+    private const long MaxUploadBytes = 2_000_000_000L;
 
     private List<BatchRowModel> _tracks = new();
     private int _selectedIndex = -1;
@@ -124,6 +129,11 @@
     // Set true once the admin has acknowledged the missing-hero warning, so a second submit proceeds.
     private bool _heroWarningAcknowledged;
 
+    // Captured once at component initialization on the live interactive circuit, while the token
+    // is known-good, so a mid-session token expiry at submit time cannot discard a long-composed
+    // release. Only assigned when the id parses successfully.
+    private long? _createdByUserId;
+
     private string _albumName = string.Empty;
     private string _artist = string.Empty;
     private string _genre = string.Empty;
@@ -151,6 +161,19 @@
         }
     }
 
+    protected override async Task OnInitializedAsync()
+    {
+        // Capture the user id once at load, while the token is known-good. The CMS host runs with
+        // prerender: false (InteractiveServer), so this is the single init pass — auth state is
+        // fully available. The page is [Authorize]-gated, so the parse should always succeed.
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        var userIdValue = authState.User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (long.TryParse(userIdValue, out var userId))
+        {
+            _createdByUserId = userId;
+        }
+    }
+
     // Switching to a single-track medium collapses any multi-track selection to the first row so the
     // single-track invariant holds before submit. The predicate reads the same MediumRules cardinality
     // declaration the upload service enforces, so the form and the domain cannot drift.
@@ -270,13 +293,12 @@
             }
         }
 
-        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
-        var userIdValue = authState.User.FindFirstValue(ClaimTypes.NameIdentifier);
-        if (!long.TryParse(userIdValue, out var createdByUserId))
+        if (_createdByUserId is not long createdByUserId)
         {
-            // The page is gated by [Authorize] under the Admin role, so a missing or
-            // unparseable id here is a configuration bug, not normal client state.
-            Logger.LogError("Authenticated user has no parseable NameIdentifier claim: {Value}", userIdValue);
+            // _createdByUserId is set at component initialization from the authenticated principal.
+            // A null here means the id was unavailable even at load — a genuine configuration bug,
+            // since the page is [Authorize]-gated.
+            Logger.LogError("User id was not captured at initialization — NameIdentifier claim missing or unparseable.");
             _errorMessage = "Your session is missing a valid identifier. Please sign in again.";
             return;
         }
@@ -293,6 +315,29 @@
             return;
         }
 
+        // Pre-flight duplicate guard (primary block): the upload form creates new releases only, so a
+        // (title, artist) that already exists in the catalogue is refused BEFORE any bytes transfer —
+        // the admin is not surprised at the end of a long upload. The server backstops this on the
+        // create path, but checking here keeps the failure fast and visible. The values passed match
+        // exactly what the upload sends (untrimmed _albumName/_artist) so the pre-flight and the server
+        // agree on the match. A check failure (API unreachable) blocks rather than proceeding blind.
+        var duplicateCheck = await CmsTrackService.GetExistingReleaseAsync(_albumName, _artist);
+        if (!duplicateCheck.Success)
+        {
+            var checkError = duplicateCheck.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _errorMessage = $"Could not verify the release name: {checkError}";
+            Snackbar.Add(_errorMessage, Severity.Error);
+            return;
+        }
+
+        if (duplicateCheck.Value is { } existing)
+        {
+            _errorMessage = $"A release titled '{existing.Title}' by {existing.Artist} already exists. "
+                + "The upload form creates new releases only — use the edit tools to change an existing one.";
+            Snackbar.Add(_errorMessage, Severity.Error);
+            return;
+        }
+
         // For single-track media (Session/Mix) the track name is derived from the Release Name —
         // no separate Track Name input is shown. Sync here so the stored name always matches.
         if (MediumRules.CardinalityOf(_medium).IsSingleTrack && _tracks.Count > 0)
@@ -322,6 +367,11 @@
             }
 
             int succeeded = 0, failed = 0;
+            // Within-batch attach: row 1 creates the release (no releaseId → CREATE path); once it
+            // succeeds we carry its ReleaseId into rows 2..N so they ATTACH to the just-created release
+            // rather than tripping the server's pre-existing-duplicate block. Only a multi-track Cut
+            // reaches row 2 (single-track media collapse to one row).
+            long? batchReleaseId = null;
             for (int i = 0; i < _tracks.Count; i++)
             {
                 var row = _tracks[i];
@@ -330,14 +380,33 @@
                 row.Status = BatchRowStatus.Uploading;
                 StateHasChanged();
 
+                row.UploadedBytes = 0;
+                row.TotalBytes = row.WavFile!.Size;
+
                 try
                 {
                     // OpenReadStream streams chunks from the browser via the SignalR circuit; the
-                    // service wraps it in StreamContent so the whole file is never materialised in
-                    // memory before DeepDrftAPI receives it.
-                    await using var wavStream = row.WavFile!.OpenReadStream(MaxUploadBytes);
+                    // service wraps it in ProgressStreamContent so the whole file is never materialised
+                    // in memory before DeepDrftAPI receives it, and reports bytes-on-the-wire back here.
+                    await using var wavStream = row.WavFile.OpenReadStream(MaxUploadBytes);
+
+                    // Progress ticks fire ~once per 80 KB; re-render only when the whole-percent changes
+                    // so a half-gig upload paints ~100 frames, not thousands. Progress<T> marshals the
+                    // callback onto the component's renderer dispatcher, so StateHasChanged is safe here.
+                    var lastPercent = -1;
+                    var progress = new Progress<long>(written =>
+                    {
+                        row.UploadedBytes = written;
+                        if (row.UploadPercent != lastPercent)
+                        {
+                            lastPercent = row.UploadPercent;
+                            StateHasChanged();
+                        }
+                    });
+
                     var result = await CmsTrackService.UploadTrackAsync(
                         wavStream,
+                        row.WavFile.Size,
                         row.WavFile.Name,
                         row.WavFile.ContentType,
                         row.TrackName,
@@ -350,7 +419,9 @@
                         createdByUserId,
                         _releaseType,
                         trackNumber,
-                        _medium);
+                        _medium,
+                        batchReleaseId,
+                        progress);
 
                     if (!result.Success || result.Value is null)
                     {
@@ -362,6 +433,15 @@
                     }
                     else
                     {
+                        // Capture the release id created by the first successful row so subsequent rows
+                        // attach to it (the within-batch multi-track Cut path). Only set once — later
+                        // rows must not overwrite it. A null ReleaseId here (loose track) leaves it null,
+                        // which is correct: a release-less upload has no within-batch release to attach to.
+                        if (batchReleaseId is null && result.Value.ReleaseId is { } createdReleaseId)
+                        {
+                            batchReleaseId = createdReleaseId;
+                        }
+
                         // The upload endpoint does not accept an imagePath, so link the cover art with
                         // a follow-up metadata update — same two-step pattern BatchEdit uses.
                         if (_imagePath is { } imgPath)
@@ -458,12 +538,17 @@
             if (failed == 0)
             {
                 Snackbar.Add($"Uploaded {succeeded} track(s).", Severity.Success);
-                VM.Invalidate();
-                Navigation.NavigateTo("/tracks");
+                Navigation.NavigateTo("/releases");
             }
             else
             {
-                Snackbar.Add($"Uploaded {succeeded} track(s); {failed} failed — review errors below.", Severity.Warning);
+                // Surface the actual reason, not just counts — a server rejection (duplicate, cardinality)
+                // relays a human-readable message via row.ErrorMessage. Show the first failure's reason so
+                // the admin sees WHY without scanning the rows; the per-row errors remain as detail.
+                var firstError = _tracks.FirstOrDefault(t => t.Status == BatchRowStatus.Failed)?.ErrorMessage;
+                var reason = string.IsNullOrWhiteSpace(firstError) ? "review errors below" : firstError;
+                _errorMessage = succeeded == 0 ? reason : $"{succeeded} uploaded; {failed} failed: {reason}";
+                Snackbar.Add($"Uploaded {succeeded} track(s); {failed} failed — {reason}", Severity.Warning);
                 // Stay on page so the admin can see the failed rows.
             }
         }

DeepDrftManager/Components/Pages/Tracks/CmsAlbumBrowser.razor

@@ -114,10 +114,71 @@ else
                                 <HeaderContent>
                                     <MudTh Style="width: 1%; white-space: nowrap;">#</MudTh>
                                     <MudTh>Track Name</MudTh>
+                                    @* Per-track waveform-datum status + generate (migrated from the retired
+                                       CmsTrackGrid). The expanded child row is the releases view's only
+                                       per-track surface, so the unique per-track Profile / High-res columns
+                                       live here. *@
+                                    <MudTh Style="width: 1%; white-space: nowrap;">Profile</MudTh>
+                                    <MudTh Style="width: 1%; white-space: nowrap;">High-res</MudTh>
+                                    @* Info column: per-track EntryKey + OriginalFileName tooltip (migrated
+                                       from the retired CmsTrackGrid's .cms-track-info monospace block). *@
+                                    <MudTh Style="width: 1%;"></MudTh>
                                 </HeaderContent>
                                 <RowTemplate>
                                     <MudTd DataLabel="#">@track.TrackNumber</MudTd>
                                     <MudTd DataLabel="Track Name">@track.TrackName</MudTd>
+                                    <MudTd DataLabel="Profile">
+                                        <MudStack Row="true" AlignItems="AlignItems.Center" Spacing="1">
+                                            @if (HasProfile(track.EntryKey))
+                                            {
+                                                <MudTooltip Text="Profile generated">
+                                                    <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small" />
+                                                </MudTooltip>
+                                            }
+                                            <MudTooltip Text="@(HasProfile(track.EntryKey) ? "Regenerate profile" : "Generate profile")">
+                                                <MudIconButton Icon="@Icons.Material.Filled.GraphicEq"
+                                                               Size="Size.Small"
+                                                               Color="Color.Secondary"
+                                                               Disabled="@_generating.Contains(track.EntryKey)"
+                                                               OnClick="@(() => GenerateProfileAsync(track))" />
+                                            </MudTooltip>
+                                        </MudStack>
+                                    </MudTd>
+                                    <MudTd DataLabel="High-res">
+                                        <MudStack Row="true" AlignItems="AlignItems.Center" Spacing="1">
+                                            @if (HasHighRes(track.EntryKey))
+                                            {
+                                                <MudTooltip Text="High-res datum generated">
+                                                    <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small" />
+                                                </MudTooltip>
+                                            }
+                                            <MudTooltip Text="@(HasHighRes(track.EntryKey) ? "Regenerate high-res datum" : "Generate high-res datum")">
+                                                <MudIconButton Icon="@Icons.Material.Filled.Waves"
+                                                               Size="Size.Small"
+                                                               Color="Color.Secondary"
+                                                               Disabled="@_generatingHighRes.Contains(track.EntryKey)"
+                                                               OnClick="@(() => GenerateHighResAsync(track))" />
+                                            </MudTooltip>
+                                        </MudStack>
+                                    </MudTd>
+                                    @* Per-track info tooltip (restored from the retired CmsTrackGrid's
+                                       .cms-track-info monospace block): EntryKey + OriginalFileName. *@
+                                    <MudTd>
+                                        <MudTooltip Placement="Placement.Left">
+                                            <TooltipContent>
+                                                <MudText Typo="Typo.caption" Style="font-family: monospace;">@track.EntryKey</MudText>
+                                                @if (!string.IsNullOrWhiteSpace(track.OriginalFileName))
+                                                {
+                                                    <MudText Typo="Typo.caption" Style="font-family: monospace;">@track.OriginalFileName</MudText>
+                                                }
+                                            </TooltipContent>
+                                            <ChildContent>
+                                                <MudIconButton Icon="@Icons.Material.Outlined.Info"
+                                                               Size="Size.Small"
+                                                               Color="Color.Default" />
+                                            </ChildContent>
+                                        </MudTooltip>
+                                    </MudTd>
                                 </RowTemplate>
                             </MudTable>
                         }
@@ -133,6 +194,26 @@ else
     [Parameter] public bool IsLoading { get; set; }
     [Parameter] public EventCallback OnReleasesChanged { get; set; }
 
+    /// <summary>
+    /// Fires after any per-row waveform generate (profile or high-res) succeeds. The parent page
+    /// wires this to its own <c>RefreshWaveformStatusAsync</c> so its missing-count badges stay
+    /// current after an individual-row generate inside an expanded album row.
+    /// </summary>
+    [Parameter] public EventCallback OnWaveformGenerated { get; set; }
+
+    /// <summary>
+    /// Clears the cached per-track waveform status so the next row expand re-fetches fresh data
+    /// from the API. Called by the parent page after a catalogue-wide bulk run so already-expanded
+    /// rows reflect the new state on the next expand interaction.
+    /// </summary>
+    public Task InvalidateWaveformStatusAsync()
+    {
+        _profileStatus = null;
+        _highResStatus = null;
+        StateHasChanged();
+        return Task.CompletedTask;
+    }
+
     // Zero or more dedicated, header-labelled special-action columns (Session hero upload, Mix waveform
     // generate), each rendered as its own header cell + per-row cell between the Tracks and Actions
     // columns. The ALL and Cut tabs leave this empty and render exactly as before — only the standard
@@ -181,6 +262,103 @@ else
             [ReleaseMedium.Mix]     = "DJ Mix",
         };
 
+    // EntryKey → HasProfile / HasHighRes for the expanded-row per-track waveform columns (migrated from
+    // the retired CmsTrackGrid). Loaded once per grid instance on first row expand; a per-row generate
+    // flips a single entry to true. Null until first loaded.
+    private Dictionary<string, bool>? _profileStatus;
+    private Dictionary<string, bool>? _highResStatus;
+    private readonly HashSet<string> _generating = new();
+    private readonly HashSet<string> _generatingHighRes = new();
+
+    private bool HasProfile(string entryKey) =>
+        _profileStatus is not null && _profileStatus.TryGetValue(entryKey, out var has) && has;
+
+    private bool HasHighRes(string entryKey) =>
+        _highResStatus is not null && _highResStatus.TryGetValue(entryKey, out var has) && has;
+
+    // Fetch the catalogue-wide waveform status once and cache it. The admin catalogue is small (one unpaged
+    // call covers it), and per-track status only matters for rows the admin actually expands.
+    private async Task EnsureWaveformStatusAsync()
+    {
+        if (_profileStatus is not null) return;
+
+        var result = await CmsTrackService.GetWaveformStatusAsync();
+        if (result.Success && result.Value is not null)
+        {
+            _profileStatus = result.Value.ToDictionary(s => s.EntryKey, s => s.HasProfile);
+            _highResStatus = result.Value.ToDictionary(s => s.EntryKey, s => s.HasHighRes);
+        }
+        else
+        {
+            // Leave both empty (not null) so we do not re-fetch on every expand after a transient failure;
+            // the next OnReleasesChanged refresh path will rebuild the grid and retry.
+            _profileStatus = new Dictionary<string, bool>();
+            _highResStatus = new Dictionary<string, bool>();
+        }
+    }
+
+    private async Task GenerateProfileAsync(TrackDto track)
+    {
+        _generating.Add(track.EntryKey);
+        StateHasChanged();
+        try
+        {
+            var result = await CmsTrackService.GenerateWaveformProfileAsync(track.EntryKey);
+            if (result.Success)
+            {
+                (_profileStatus ??= new())[track.EntryKey] = true;
+                Snackbar.Add($"Generated profile for '{track.TrackName}'.", Severity.Success);
+                await OnWaveformGenerated.InvokeAsync();
+            }
+            else
+            {
+                var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                Snackbar.Add($"Generate failed for '{track.TrackName}': {error}", Severity.Error);
+            }
+        }
+        catch (Exception ex)
+        {
+            Logger.LogError(ex, "Waveform generation failed for {EntryKey}", track.EntryKey);
+            Snackbar.Add($"Generate failed for '{track.TrackName}' — please try again.", Severity.Error);
+        }
+        finally
+        {
+            _generating.Remove(track.EntryKey);
+            StateHasChanged();
+        }
+    }
+
+    private async Task GenerateHighResAsync(TrackDto track)
+    {
+        _generatingHighRes.Add(track.EntryKey);
+        StateHasChanged();
+        try
+        {
+            var result = await CmsTrackService.GenerateHighResWaveformAsync(track.EntryKey);
+            if (result.Success)
+            {
+                (_highResStatus ??= new())[track.EntryKey] = true;
+                Snackbar.Add($"Generated high-res datum for '{track.TrackName}'.", Severity.Success);
+                await OnWaveformGenerated.InvokeAsync();
+            }
+            else
+            {
+                var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+                Snackbar.Add($"High-res generate failed for '{track.TrackName}': {error}", Severity.Error);
+            }
+        }
+        catch (Exception ex)
+        {
+            Logger.LogError(ex, "High-res waveform generation failed for {EntryKey}", track.EntryKey);
+            Snackbar.Add($"High-res generate failed for '{track.TrackName}' — please try again.", Severity.Error);
+        }
+        finally
+        {
+            _generatingHighRes.Remove(track.EntryKey);
+            StateHasChanged();
+        }
+    }
+
     private async Task ToggleExpand(AlbumRow row)
     {
         row.IsExpanded = !row.IsExpanded;
@@ -189,6 +367,9 @@ else
             row.IsLoading = true;
             StateHasChanged();
             row.Tracks = await LoadTracksAsync(row.Release.Title);
+            // The per-track Profile / High-res columns need waveform status for the rows just loaded.
+            // Loaded once for the catalogue on first expand and cached for this grid instance.
+            await EnsureWaveformStatusAsync();
             row.IsLoading = false;
         }
     }

DeepDrftManager/Components/Pages/Tracks/CmsAllReleasesGrid.razor

@@ -8,9 +8,11 @@
    own data load so a host (TrackList today, the 8.A tab strip later) renders it with no parameters and
    no VM plumbing. Re-loads on first render and re-fetches after a row mutation so the list stays in
    sync with the catalogue. *@
-<CmsAlbumBrowser Releases="_releases"
+<CmsAlbumBrowser @ref="_albumBrowser"
+                 Releases="_releases"
                  IsLoading="_loading"
-                 OnReleasesChanged="OnGridReleasesChanged" />
+                 OnReleasesChanged="OnGridReleasesChanged"
+                 OnWaveformGenerated="OnWaveformGenerated" />
 
 @code {
     // Fires after a row mutation (delete) so a host can invalidate sibling caches derived from the same
@@ -18,9 +20,23 @@
     // notification, not the data source. Optional: an embed that has no sibling state leaves it unset.
     [Parameter] public EventCallback OnReleasesChanged { get; set; }
 
+    /// <summary>
+    /// Forwarded from the inner <see cref="CmsAlbumBrowser"/>: fires after any per-row waveform
+    /// generate succeeds so the parent page can refresh its catalogue-wide missing-count badges.
+    /// </summary>
+    [Parameter] public EventCallback OnWaveformGenerated { get; set; }
+
+    private CmsAlbumBrowser? _albumBrowser;
     private IReadOnlyList<ReleaseDto> _releases = Array.Empty<ReleaseDto>();
     private bool _loading = true;
 
+    /// <summary>
+    /// Clears the inner grid's cached per-track waveform status so the next row expand re-fetches.
+    /// Called by the parent page after a catalogue-wide bulk run.
+    /// </summary>
+    public Task InvalidateWaveformStatusAsync() =>
+        _albumBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask;
+
     protected override Task OnInitializedAsync() => ReloadAsync();
 
     private async Task OnGridReleasesChanged()

DeepDrftManager/Components/Pages/Tracks/CmsCutBrowser.razor

@@ -6,17 +6,34 @@
    tab carries expand-tracks, delete, the Type chip, and per-row edit identically to the ALL tab — no
    forked grid. Cuts have no medium-specific action, so no SpecialColumns are supplied; the grid renders
    its shared edit/delete only. Embedded as tab content only; no standalone @page route. *@
-<CmsAlbumBrowser Releases="Releases"
+<CmsAlbumBrowser @ref="_albumBrowser"
+                 Releases="Releases"
                  IsLoading="Loading"
-                 OnReleasesChanged="ReloadAsync" />
+                 OnReleasesChanged="ReloadAsync"
+                 OnWaveformGenerated="OnWaveformGenerated" />
 
 @code {
+    /// <summary>
+    /// Forwarded from the inner <see cref="CmsAlbumBrowser"/>: fires after any per-row waveform
+    /// generate succeeds so the parent page can refresh its catalogue-wide missing-count badges.
+    /// </summary>
+    [Parameter] public EventCallback OnWaveformGenerated { get; set; }
+
+    private CmsAlbumBrowser? _albumBrowser;
+
     protected override ReleaseMedium Medium => ReleaseMedium.Cut;
     protected override string MediumNoun => "cuts";
 
     protected override CutRow ToRow(ReleaseDto release) => new() { Release = release };
     protected override ReleaseDto ReleaseOf(CutRow row) => row.Release;
 
+    /// <summary>
+    /// Clears the inner grid's cached per-track waveform status so the next row expand re-fetches.
+    /// Called by the parent page after a catalogue-wide bulk run.
+    /// </summary>
+    public Task InvalidateWaveformStatusAsync() =>
+        _albumBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask;
+
     public sealed class CutRow
     {
         public required ReleaseDto Release { get; set; }

DeepDrftManager/Components/Pages/Tracks/CmsGenreBrowser.razor

@@ -1,52 +0,0 @@
-@using DeepDrftModels.DTOs
-
-@if (IsLoading)
-{
-    <MudProgressCircular Indeterminate="true" Class="mt-4" />
-}
-else if (Genres.Count == 0)
-{
-    <MudText Typo="Typo.body1" Class="mt-4">No genres found.</MudText>
-}
-else
-{
-    <MudGrid Spacing="3" Class="mt-2">
-        @foreach (var genre in Genres)
-        {
-            var isExpanded = ExpandedGenre == genre.Genre;
-            <MudItem xs="12" sm="6" md="4">
-                <MudCard Elevation="@(isExpanded ? 4 : 1)"
-                         Style="cursor: pointer;"
-                         @onclick="@(() => ToggleGenre(genre.Genre))">
-                    <div class="@SwatchClass(isExpanded)"></div>
-                    <MudCardContent>
-                        <MudText Typo="Typo.h6">@genre.Genre</MudText>
-                        <MudText Typo="Typo.body2" Class="mud-text-secondary">@genre.TrackCount track(s)</MudText>
-                    </MudCardContent>
-                </MudCard>
-            </MudItem>
-        }
-    </MudGrid>
-
-    @if (ExpandedGenre is not null)
-    {
-        <MudDivider Class="my-4" />
-        <MudText Typo="Typo.h6" Class="mb-2">@ExpandedGenre</MudText>
-        <CmsTrackGrid @key="ExpandedGenre" GenreFilter="@ExpandedGenre" ShowAddButton="false" />
-    }
-}
-
-@code {
-    [Parameter] public IReadOnlyList<GenreSummaryDto> Genres { get; set; } = Array.Empty<GenreSummaryDto>();
-    [Parameter] public bool IsLoading { get; set; }
-    [Parameter] public string? ExpandedGenre { get; set; }
-    [Parameter] public EventCallback<string?> OnExpandedGenreChanged { get; set; }
-
-    // The view model owns the toggle (selecting the open genre collapses it), so we pass the raw
-    // clicked genre rather than pre-computing the next state here — keeps the toggle logic single-sourced.
-    private async Task ToggleGenre(string genre) =>
-        await OnExpandedGenreChanged.InvokeAsync(genre);
-
-    private static string SwatchClass(bool isExpanded) =>
-        isExpanded ? "cms-genre-swatch cms-genre-swatch--active" : "cms-genre-swatch";
-}

DeepDrftManager/Components/Pages/Tracks/CmsGenreBrowser.razor.css

@@ -1,10 +0,0 @@
-.cms-genre-swatch {
-    width: 100%;
-    height: 80px;
-    background-color: var(--mud-palette-action-default-hover);
-    transition: background-color 0.2s ease;
-}
-
-.cms-genre-swatch--active {
-    background-color: var(--mud-palette-primary-hover);
-}

DeepDrftManager/Components/Pages/Tracks/CmsMixBrowser.razor

@@ -18,14 +18,14 @@
 }
 else
 {
-    <PageTitle>Mixes — DeepDrft CMS</PageTitle>
+    <PageTitle>Mixes — Deep DRFT Management</PageTitle>
 
     <MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
         <MudButton Variant="Variant.Text"
                    StartIcon="@Icons.Material.Filled.ArrowBack"
-                   Href="/tracks/archive"
+                   Href="/releases"
                    Class="mb-4">
-            Back to Release Archive
+            Back to Releases
         </MudButton>
 
         <MudText Typo="Typo.h4" GutterBottom="true">Mixes</MudText>
@@ -41,9 +41,24 @@ else
     /// </summary>
     [Parameter] public bool Embedded { get; set; }
 
+    /// <summary>
+    /// Forwarded from the inner <see cref="CmsAlbumBrowser"/>: fires after any per-row waveform
+    /// generate succeeds so the parent page can refresh its catalogue-wide missing-count badges.
+    /// </summary>
+    [Parameter] public EventCallback OnWaveformGenerated { get; set; }
+
+    private CmsAlbumBrowser? _albumBrowser;
+
     protected override ReleaseMedium Medium => ReleaseMedium.Mix;
     protected override string MediumNoun => "mixes";
 
+    /// <summary>
+    /// Clears the inner grid's cached per-track waveform status so the next row expand re-fetches.
+    /// Called by the parent page after a catalogue-wide bulk run.
+    /// </summary>
+    public Task InvalidateWaveformStatusAsync() =>
+        _albumBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask;
+
     protected override MixRow ToRow(ReleaseDto release) => new()
     {
         Release = release,
@@ -56,9 +71,11 @@ else
     // both branches above render the same markup without duplication. The Mix declares one dedicated
     // "Waveform" special-action column; the grid renders it between Tracks and Actions, handing the cell
     // each release, and RowFor recovers the matching MixRow's generate state.
-    private RenderFragment GridContent => @<CmsAlbumBrowser Releases="Releases"
+    private RenderFragment GridContent => @<CmsAlbumBrowser @ref="_albumBrowser"
+                                                           Releases="Releases"
                                                            IsLoading="Loading"
                                                            OnReleasesChanged="ReloadAsync"
+                                                           OnWaveformGenerated="OnWaveformGenerated"
                                                            SpecialColumns="_specialColumns" />;
 
     // Allocated once per component instance in OnInitialized (field initializers cannot reference
@@ -77,33 +94,35 @@ else
         @{ var row = RowFor(release); }
         @if (row is not null)
         {
-            @if (row.HasWaveform)
-            {
-                <MudTooltip Text="Waveform generated">
-                    <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small" />
-                </MudTooltip>
-            }
-            else
-            {
-                <MudTooltip Text="No waveform — incomplete">
-                    <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Warning" Size="Size.Small" />
-                </MudTooltip>
-            }
-            <MudButton Variant="Variant.Outlined"
-                       Size="Size.Small"
-                       StartIcon="@Icons.Material.Filled.GraphicEq"
-                       Disabled="@row.IsGenerating"
-                       OnClick="@(() => GenerateWaveformAsync(row))">
-                @if (row.IsGenerating)
+            <MudStack Row="true" AlignItems="AlignItems.Center" Spacing="1">
+                @if (row.HasWaveform)
                 {
-                    <MudProgressCircular Class="mr-2" Size="Size.Small" Indeterminate="true" />
-                    <span>Generating…</span>
+                    <MudTooltip Text="Waveform generated">
+                        <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small" />
+                    </MudTooltip>
                 }
                 else
                 {
-                    <span>@(row.HasWaveform ? "Regenerate" : "Generate")</span>
+                    <MudTooltip Text="No waveform — incomplete">
+                        <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Warning" Size="Size.Small" />
+                    </MudTooltip>
                 }
-            </MudButton>
+                <MudButton Variant="Variant.Outlined"
+                           Size="Size.Small"
+                           StartIcon="@Icons.Material.Filled.GraphicEq"
+                           Disabled="@row.IsGenerating"
+                           OnClick="@(() => GenerateWaveformAsync(row))">
+                    @if (row.IsGenerating)
+                    {
+                        <MudProgressCircular Class="mr-2" Size="Size.Small" Indeterminate="true" />
+                        <span>Generating…</span>
+                    }
+                    else
+                    {
+                        <span>@(row.HasWaveform ? "Regenerate" : "Generate")</span>
+                    }
+                </MudButton>
+            </MudStack>
         }
     </text>;
 

DeepDrftManager/Components/Pages/Tracks/CmsSessionBrowser.razor

@@ -19,14 +19,14 @@
 }
 else
 {
-    <PageTitle>Sessions — DeepDrft CMS</PageTitle>
+    <PageTitle>Sessions — Deep DRFT Management</PageTitle>
 
     <MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
         <MudButton Variant="Variant.Text"
                    StartIcon="@Icons.Material.Filled.ArrowBack"
-                   Href="/tracks/archive"
+                   Href="/releases"
                    Class="mb-4">
-            Back to Release Archive
+            Back to Releases
         </MudButton>
 
         <MudText Typo="Typo.h4" GutterBottom="true">Sessions</MudText>
@@ -42,9 +42,24 @@ else
     /// </summary>
     [Parameter] public bool Embedded { get; set; }
 
+    /// <summary>
+    /// Forwarded from the inner <see cref="CmsAlbumBrowser"/>: fires after any per-row waveform
+    /// generate succeeds so the parent page can refresh its catalogue-wide missing-count badges.
+    /// </summary>
+    [Parameter] public EventCallback OnWaveformGenerated { get; set; }
+
+    private CmsAlbumBrowser? _albumBrowser;
+
     protected override ReleaseMedium Medium => ReleaseMedium.Session;
     protected override string MediumNoun => "sessions";
 
+    /// <summary>
+    /// Clears the inner grid's cached per-track waveform status so the next row expand re-fetches.
+    /// Called by the parent page after a catalogue-wide bulk run.
+    /// </summary>
+    public Task InvalidateWaveformStatusAsync() =>
+        _albumBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask;
+
     protected override SessionRow ToRow(ReleaseDto release) => new()
     {
         Release = release,
@@ -57,9 +72,11 @@ else
     // both branches above render the same markup without duplication. The Session declares one dedicated
     // "Hero" special-action column; the grid renders it between Tracks and Actions, handing the cell each
     // release, and RowFor recovers the matching SessionRow's upload state.
-    private RenderFragment GridContent => @<CmsAlbumBrowser Releases="Releases"
+    private RenderFragment GridContent => @<CmsAlbumBrowser @ref="_albumBrowser"
+                                                           Releases="Releases"
                                                            IsLoading="Loading"
                                                            OnReleasesChanged="ReloadAsync"
+                                                           OnWaveformGenerated="OnWaveformGenerated"
                                                            SpecialColumns="_specialColumns" />;
 
     // Allocated once per component instance in OnInitialized (field initializers cannot reference
@@ -68,13 +85,16 @@ else
 
     protected override void OnInitialized()
     {
-        _specialColumns = new[] { new SpecialActionColumn("Hero", HeroCell) };
+        _specialColumns = new[]
+        {
+            new SpecialActionColumn("Hero", HeroThumbCell),
+            new SpecialActionColumn("", HeroButtonCell),
+        };
         base.OnInitialized();
     }
 
-    // Per-row cell for the dedicated "Hero" column: thumbnail preview plus set/replace upload button with
-    // progress. Recovers the typed SessionRow via RowFor; skips rendering for a release not on the page.
-    private RenderFragment<ReleaseDto> HeroCell => release =>@<text>
+    // Per-row cell for the "Hero" thumbnail column: just the image preview div.
+    private RenderFragment<ReleaseDto> HeroThumbCell => release =>@<text>
         @{ var row = RowFor(release); }
         @if (row is not null)
         {
@@ -86,6 +106,14 @@ else
             {
                 <div class="cms-album-thumb cms-album-thumb--fallback"></div>
             }
+        }
+    </text>;
+
+    // Per-row cell for the "Hero Image" upload button column: set/replace upload button with progress.
+    private RenderFragment<ReleaseDto> HeroButtonCell => release =>@<text>
+        @{ var row = RowFor(release); }
+        @if (row is not null)
+        {
             <MudFileUpload T="IBrowserFile"
                            Accept="image/*"
                            FilesChanged="@(file => UploadHeroAsync(row, file))"

DeepDrftManager/Components/Pages/Tracks/CmsTrackGrid.razor

@@ -1,258 +0,0 @@
-@using System.Net
-@using DeepDrftManager.Services
-@using DeepDrftModels.DTOs
-@inject ICmsTrackService CmsTrackService
-@inject IDialogService DialogService
-@inject ISnackbar Snackbar
-@inject ILogger<CmsTrackGrid> Logger
-@inject NavigationManager NavigationManager
-
-@if (ShowAddButton)
-{
-    <MudStack Row="true" Justify="Justify.FlexEnd" Class="mb-2">
-        <MudButton Variant="Variant.Filled"
-                   Color="Color.Primary"
-                   StartIcon="@Icons.Material.Filled.Add"
-                   Href="/tracks/upload">
-            Add Track
-        </MudButton>
-    </MudStack>
-}
-
-<MudTable T="TrackDto"
-          @ref="_table"
-          ServerData="LoadServerData"
-          Hover="true"
-          Striped="true"
-          Dense="true"
-          Bordered="false"
-          FixedHeader="true"
-          RowsPerPage="@PageSize"
-          AllowUnsorted="false">
-    <NoRecordsContent>
-        <MudText Typo="Typo.body1">No tracks found.</MudText>
-    </NoRecordsContent>
-    <LoadingContent>
-        <MudText Typo="Typo.body1">Loading tracks…</MudText>
-    </LoadingContent>
-    <HeaderContent>
-        <MudTh Style="width: 1%; white-space: nowrap;">Track #</MudTh>
-        <MudTh Style="width: 1%; white-space: nowrap;">Art</MudTh>
-        <MudTh><MudTableSortLabel SortLabel="TrackName" T="TrackDto" InitialDirection="SortDirection.Ascending">Track Name</MudTableSortLabel></MudTh>
-        <MudTh><MudTableSortLabel SortLabel="Artist" T="TrackDto">Artist</MudTableSortLabel></MudTh>
-        <MudTh><MudTableSortLabel SortLabel="Album" T="TrackDto">Album</MudTableSortLabel></MudTh>
-        <MudTh><MudTableSortLabel SortLabel="Genre" T="TrackDto">Genre</MudTableSortLabel></MudTh>
-        <MudTh><MudTableSortLabel SortLabel="ReleaseDate" T="TrackDto">Release Date</MudTableSortLabel></MudTh>
-        <MudTh Style="width: 1%; white-space: nowrap;">Waveform</MudTh>
-        <MudTh Style="width: 1%; white-space: nowrap;">Actions</MudTh>
-    </HeaderContent>
-    <RowTemplate>
-        <MudTd DataLabel="Track #">@context.TrackNumber</MudTd>
-        <MudTd DataLabel="Art">
-            @if (!string.IsNullOrEmpty(context.Release?.ImagePath))
-            {
-                <div class="cms-track-thumb"
-                     style="background-image: url('@ThumbUrl(context.Release.ImagePath)');"></div>
-            }
-            else
-            {
-                <div class="cms-track-thumb cms-track-thumb--fallback"></div>
-            }
-        </MudTd>
-        <MudTd DataLabel="Track Name">@context.TrackName</MudTd>
-        <MudTd DataLabel="Artist">@(context.Release?.Artist ?? "—")</MudTd>
-        <MudTd DataLabel="Album">@(context.Release?.Title ?? "—")</MudTd>
-        <MudTd DataLabel="Genre">@(context.Release?.Genre ?? "—")</MudTd>
-        <MudTd DataLabel="Release Date">@(context.Release?.ReleaseDate?.ToString("d MMMM, yyyy") ?? "—")</MudTd>
-        <MudTd DataLabel="Waveform">
-            @if (HasProfile(context.EntryKey))
-            {
-                <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small" />
-            }
-            else
-            {
-                <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Warning" Size="Size.Small" />
-            }
-        </MudTd>
-        <MudTd DataLabel="Actions">
-            <MudTooltip Text="Edit">
-                <MudIconButton Icon="@Icons.Material.Filled.Edit"
-                               Size="Size.Small"
-                               Color="Color.Primary"
-                               Href="@($"/tracks/{context.Id}/edit")" />
-            </MudTooltip>
-            <MudTooltip Text="Delete">
-                <MudIconButton Icon="@Icons.Material.Filled.Delete"
-                               Size="Size.Small"
-                               Color="Color.Error"
-                               OnClick="@(() => ConfirmAndDelete(context))" />
-            </MudTooltip>
-            <MudTooltip>
-                <TooltipContent>
-                    <div class="cms-track-info">
-                        <div>Entry: @context.EntryKey</div>
-                        <div>File: @(context.OriginalFileName ?? "—")</div>
-                    </div>
-                </TooltipContent>
-                <ChildContent>
-                    <MudIconButton Icon="@Icons.Material.Outlined.Info" Size="Size.Small" />
-                </ChildContent>
-            </MudTooltip>
-            @if (!HasProfile(context.EntryKey))
-            {
-                <MudTooltip Text="Generate Waveform">
-                    <MudIconButton Icon="@Icons.Material.Filled.GraphicEq"
-                                   Size="Size.Small"
-                                   Color="Color.Secondary"
-                                   Disabled="@(_bulkRunning || _generating.Contains(context.EntryKey))"
-                                   OnClick="@(() => GenerateOneAsync(context))" />
-                </MudTooltip>
-            }
-        </MudTd>
-    </RowTemplate>
-    <PagerContent>
-        <MudTablePager PageSizeOptions="new[] { 10, 20, 50 }" />
-    </PagerContent>
-</MudTable>
-
-@code {
-    [Parameter] public string? AlbumFilter { get; set; }
-    [Parameter] public string? GenreFilter { get; set; }
-    [Parameter] public bool ShowAddButton { get; set; } = true;
-    [Parameter] public int PageSize { get; set; } = 20;
-    [Parameter] public EventCallback OnTracksChanged { get; set; }
-    [Parameter] public EventCallback OnStatusLoaded { get; set; }
-
-    private MudTable<TrackDto>? _table;
-
-    // EntryKey → HasProfile. Loaded once on init; per-row generate flips a single entry to true.
-    private Dictionary<string, bool> _waveformStatus = new();
-    private readonly HashSet<string> _generating = new();
-
-    // The parent owns "Generate All Missing"; while it runs it disables this grid's per-row buttons.
-    private bool _bulkRunning;
-
-    protected override async Task OnInitializedAsync()
-    {
-        await RefreshWaveformStatusAsync();
-    }
-
-    private bool HasProfile(string entryKey) =>
-        _waveformStatus.TryGetValue(entryKey, out var hasProfile) && hasProfile;
-
-    // Relative path — resolves against the Manager's own origin, proxied by ImageProxyController.
-    private static string ThumbUrl(string imagePath) =>
-        $"/api/image/{Uri.EscapeDataString(imagePath)}";
-
-    /// <summary>Number of tracks with a missing waveform profile — drives the parent's bulk button label.</summary>
-    public int GetMissingCount() => _waveformStatus.Count(kv => !kv.Value);
-
-    /// <summary>
-    /// Reload the full waveform-status map. Called on init and by the parent after a bulk generate so
-    /// the per-row icons reflect the new state.
-    /// </summary>
-    public async Task RefreshWaveformStatusAsync()
-    {
-        var result = await CmsTrackService.GetWaveformStatusAsync();
-        _waveformStatus = result.Success && result.Value is not null
-            ? result.Value.ToDictionary(s => s.EntryKey, s => s.HasProfile)
-            : new Dictionary<string, bool>();
-
-        StateHasChanged();
-        await OnStatusLoaded.InvokeAsync();
-    }
-
-    /// <summary>Set by the parent while its bulk generate runs so per-row buttons disable.</summary>
-    public void SetBulkRunning(bool running)
-    {
-        _bulkRunning = running;
-        StateHasChanged();
-    }
-
-    private async Task<TableData<TrackDto>> LoadServerData(TableState state, CancellationToken cancellationToken)
-    {
-        var pageNumber = state.Page + 1; // MudTable is 0-based, service is 1-based.
-        var sortColumn = string.IsNullOrEmpty(state.SortLabel) ? "TrackName" : state.SortLabel;
-        var sortDescending = state.SortDirection == SortDirection.Descending;
-
-        var result = await CmsTrackService.GetPagedAsync(
-            pageNumber, state.PageSize, sortColumn, sortDescending,
-            AlbumFilter, GenreFilter, cancellationToken);
-
-        if (!result.Success || result.Value is null)
-        {
-            var errorText = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
-            Snackbar.Add($"Failed to load tracks: {errorText}", Severity.Error);
-            return new TableData<TrackDto> { Items = Array.Empty<TrackDto>(), TotalItems = 0 };
-        }
-
-        var page = result.Value;
-        return new TableData<TrackDto>
-        {
-            Items = page.Items,
-            TotalItems = page.TotalCount
-        };
-    }
-
-    private async Task ConfirmAndDelete(TrackDto track)
-    {
-        var confirmed = await DialogService.ShowMessageBox(
-            title: "Delete track",
-            markupMessage: new MarkupString($"Delete <strong>{WebUtility.HtmlEncode(track.TrackName)}</strong> by {WebUtility.HtmlEncode(track.Release?.Artist ?? "Unknown")}? This removes both the metadata row and the underlying audio entry."),
-            yesText: "Delete",
-            cancelText: "Cancel");
-
-        if (confirmed != true) return;
-
-        try
-        {
-            var result = await CmsTrackService.DeleteTrackAsync(track.Id);
-            if (result.Success)
-            {
-                Snackbar.Add($"Deleted '{track.TrackName}'.", Severity.Success);
-                if (_table is not null) await _table.ReloadServerData();
-                await OnTracksChanged.InvokeAsync();
-            }
-            else
-            {
-                var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
-                Snackbar.Add($"Delete failed: {error}", Severity.Error);
-            }
-        }
-        catch (Exception ex)
-        {
-            Logger.LogError(ex, "Delete failed for track {TrackId}", track.Id);
-            Snackbar.Add("Delete failed — please try again.", Severity.Error);
-        }
-    }
-
-    private async Task GenerateOneAsync(TrackDto track)
-    {
-        _generating.Add(track.EntryKey);
-        StateHasChanged();
-        try
-        {
-            var result = await CmsTrackService.GenerateWaveformProfileAsync(track.EntryKey);
-            if (result.Success)
-            {
-                _waveformStatus[track.EntryKey] = true;
-                Snackbar.Add($"Generated profile for '{track.TrackName}'.", Severity.Success);
-            }
-            else
-            {
-                var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
-                Snackbar.Add($"Generate failed for '{track.TrackName}': {error}", Severity.Error);
-            }
-        }
-        catch (Exception ex)
-        {
-            Logger.LogError(ex, "Waveform generation failed for {EntryKey}", track.EntryKey);
-            Snackbar.Add($"Generate failed for '{track.TrackName}' — please try again.", Severity.Error);
-        }
-        finally
-        {
-            _generating.Remove(track.EntryKey);
-            StateHasChanged();
-        }
-    }
-}

DeepDrftManager/Components/Pages/Tracks/CmsTrackGrid.razor.css

@@ -1,17 +0,0 @@
-.cms-track-thumb {
-    width: 40px;
-    height: 40px;
-    border-radius: 4px;
-    background-size: cover;
-    background-position: center;
-    flex-shrink: 0;
-}
-
-.cms-track-thumb--fallback {
-    background-color: var(--mud-palette-action-default-hover);
-}
-
-.cms-track-info {
-    font-family: monospace;
-    text-align: left;
-}

DeepDrftManager/Components/Pages/Tracks/Releases.razor

@@ -0,0 +1,294 @@
+@page "/releases"
+@page "/tracks"
+@page "/tracks/albums"
+@page "/tracks/archive"
+@using DeepDrftManager.Services
+@using DeepDrftModels.DTOs
+@using DeepDrftModels.Enums
+@inject ICmsTrackService CmsTrackService
+@inject ISnackbar Snackbar
+@inject ILogger<Releases> Logger
+@inject NavigationManager NavigationManager
+@attribute [Authorize]
+
+<PageTitle>Releases — Deep DRFT Management</PageTitle>
+
+<MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
+    <MudStack Row="true" AlignItems="AlignItems.Center" Justify="Justify.SpaceBetween" Class="mb-4">
+        <MudText Typo="Typo.h3">Releases</MudText>
+
+        @* Catalogue-wide waveform backfill (migrated from the retired /tracks view). Both buttons act over
+           every track's waveform status — independent of any single grid — so the page owns the status map
+           directly: it computes the missing counts and re-fetches after a run. No grid reference involved. *@
+        <MudStack Row="true" AlignItems="AlignItems.Center" Spacing="2">
+            <MudButton Variant="Variant.Outlined"
+                       Color="Color.Primary"
+                       StartIcon="@Icons.Material.Filled.AutoFixHigh"
+                       Disabled="@(_bulkRunning || _highResBulkRunning || MissingProfileCount == 0)"
+                       OnClick="GenerateAllMissingAsync">
+                @if (_bulkRunning)
+                {
+                    <MudProgressCircular Class="mr-2" Size="Size.Small" Indeterminate="true" />
+                    <span>Generating @_bulkDone / @_bulkTotal…</span>
+                }
+                else
+                {
+                    <span>Generate All Profiles (@MissingProfileCount)</span>
+                }
+            </MudButton>
+            <MudButton Variant="Variant.Outlined"
+                       Color="Color.Primary"
+                       StartIcon="@Icons.Material.Filled.Waves"
+                       Disabled="@(_bulkRunning || _highResBulkRunning || MissingHighResCount == 0)"
+                       OnClick="GenerateAllMissingHighResAsync">
+                @if (_highResBulkRunning)
+                {
+                    <MudProgressCircular Class="mr-2" Size="Size.Small" Indeterminate="true" />
+                    <span>Backfilling @_highResBulkDone / @_highResBulkTotal…</span>
+                }
+                else
+                {
+                    <span>Backfill High-res (@MissingHighResCount)</span>
+                }
+            </MudButton>
+        </MudStack>
+    </MudStack>
+
+    @* Medium tab strip: an ALL tab plus one explicit MudTabPanel per ReleaseMedium, ALL left-most. Each
+       panel is hand-declared in markup (not enum-driven) so @ref captures of the per-tab grid components
+       are possible. Adding a future medium requires a hand-added MudTabPanel; its position in markup must
+       match ReleaseMedium enum order, since the ?medium= deep-link seed and ActiveMedium getter are
+       position-based (panel 0 = ALL, panels 1.. = enum values in order). *@
+    @* Medium-aware Add Track: the button reflects the active tab and pre-selects the upload form to that
+       tab's medium via a single query-param (?medium=…); the ALL tab defaults to Cut. The medium is a seed
+       only — the upload form's selector stays user-changeable after landing. *@
+    <MudStack Row="true" Justify="Justify.FlexEnd" Class="mb-2">
+        <MudButton Variant="Variant.Filled"
+                   Color="Color.Primary"
+                   StartIcon="@Icons.Material.Filled.Add"
+                   Href="@AddTrackHref(ActiveMedium)">
+            Add Track
+        </MudButton>
+    </MudStack>
+
+    <MudTabs Elevation="0" Rounded="true" ApplyEffectsToContainer="true" PanelClass="pt-4"
+             @bind-ActivePanelIndex="_activeTabIndex">
+        <MudTabPanel Text="ALL">
+            <CmsAllReleasesGrid @ref="_allGrid"
+                                OnWaveformGenerated="RefreshWaveformStatusAsync" />
+        </MudTabPanel>
+        <MudTabPanel Text="@MediumTabLabels[ReleaseMedium.Cut]">
+            <CmsCutBrowser @ref="_cutBrowser"
+                           OnWaveformGenerated="RefreshWaveformStatusAsync" />
+        </MudTabPanel>
+        <MudTabPanel Text="@MediumTabLabels[ReleaseMedium.Session]">
+            <CmsSessionBrowser @ref="_sessionBrowser"
+                               Embedded="true"
+                               OnWaveformGenerated="RefreshWaveformStatusAsync" />
+        </MudTabPanel>
+        <MudTabPanel Text="@MediumTabLabels[ReleaseMedium.Mix]">
+            <CmsMixBrowser @ref="_mixBrowser"
+                           Embedded="true"
+                           OnWaveformGenerated="RefreshWaveformStatusAsync" />
+        </MudTabPanel>
+    </MudTabs>
+</MudContainer>
+
+@code {
+    // Active tab. Panel 0 is ALL; panels 1.. map to Enum.GetValues<ReleaseMedium>() in order. Seeded
+    // from the ?medium= query param so the catalogue cards can deep-link straight to a medium's tab.
+    private int _activeTabIndex;
+
+    // Optional deep-link target from the catalogue cards (?medium=session selects the Sessions tab) and the
+    // seed for the Add Track button on the ALL tab. Read once on init; the user can switch tabs freely after.
+    [SupplyParameterFromQuery(Name = "medium")] public string? MediumParam { get; set; }
+
+    // The medium the Add Track button pre-selects for the active tab. ALL (panel 0) defaults to Cut; each
+    // medium tab maps to its enum value by position, so a fourth medium tab gets a correct Add Track for
+    // free — no markup fork.
+    private ReleaseMedium ActiveMedium =>
+        _activeTabIndex <= 0 ? ReleaseMedium.Cut : Enum.GetValues<ReleaseMedium>()[_activeTabIndex - 1];
+
+    // Single query-param convention: the upload page reads ?medium=… and seeds its selector (which stays
+    // user-changeable). Always explicit, including ALL→cut, so the link is unambiguous.
+    private static string AddTrackHref(ReleaseMedium medium) =>
+        $"/tracks/upload?medium={medium.ToString().ToLowerInvariant()}";
+
+    // Medium → tab label. The one place medium display text lives for the tab strip. The ALL tab is
+    // rendered separately (it is not a medium). Tabs are explicit markup so @ref captures work.
+    private static readonly IReadOnlyDictionary<ReleaseMedium, string> MediumTabLabels =
+        new Dictionary<ReleaseMedium, string>
+        {
+            [ReleaseMedium.Cut] = "CUTS",
+            [ReleaseMedium.Session] = "SESSIONS",
+            [ReleaseMedium.Mix] = "MIXES",
+        };
+
+    // @ref handles for the per-tab grids. Used to (a) invalidate their cached per-track waveform status
+    // after a page-level bulk run, and (b) to wire OnWaveformGenerated so per-row generates bubble up
+    // and refresh the page-level missing-count badges. Tabs are now explicit markup rather than the
+    // former enum-driven MediumGrid() switch so @ref captures are possible.
+    private CmsAllReleasesGrid? _allGrid;
+    private CmsCutBrowser? _cutBrowser;
+    private CmsSessionBrowser? _sessionBrowser;
+    private CmsMixBrowser? _mixBrowser;
+
+    // EntryKey → HasProfile / HasHighRes, loaded once on init so the bulk buttons can show accurate missing
+    // counts without depending on any rendered grid. Re-fetched after each bulk run so the counts settle.
+    private IReadOnlyList<WaveformStatusDto> _waveformStatus = Array.Empty<WaveformStatusDto>();
+
+    private int MissingProfileCount => _waveformStatus.Count(s => !s.HasProfile);
+    private int MissingHighResCount => _waveformStatus.Count(s => !s.HasHighRes);
+
+    // Local state for the parent-owned "Generate All Profiles" bulk run.
+    private bool _bulkRunning;
+    private int _bulkTotal;
+    private int _bulkDone;
+
+    // Local state for the "Backfill High-res" bulk run. Independent of the profile bulk above.
+    private bool _highResBulkRunning;
+    private int _highResBulkTotal;
+    private int _highResBulkDone;
+
+    protected override async Task OnInitializedAsync()
+    {
+        // Seed the active tab from ?medium= so a catalogue card deep-links straight to its medium. Panel 0
+        // is ALL; a recognised medium maps to its 1-based position. Unrecognised/absent falls through to ALL.
+        if (!string.IsNullOrWhiteSpace(MediumParam)
+            && Enum.TryParse<ReleaseMedium>(MediumParam, ignoreCase: true, out var medium)
+            && Enum.IsDefined(medium))
+        {
+            _activeTabIndex = Array.IndexOf(Enum.GetValues<ReleaseMedium>(), medium) + 1;
+        }
+
+        await RefreshWaveformStatusAsync();
+    }
+
+    private async Task RefreshWaveformStatusAsync()
+    {
+        var result = await CmsTrackService.GetWaveformStatusAsync();
+        _waveformStatus = result.Success && result.Value is not null
+            ? result.Value
+            : Array.Empty<WaveformStatusDto>();
+        StateHasChanged();
+    }
+
+    // Invalidates the cached per-track waveform status on all embedded grids so the next row expand
+    // re-fetches fresh data. Called after each catalogue-wide bulk run so already-expanded rows
+    // reflect the new waveform state on the next expand interaction.
+    private async Task InvalidateAllGridsAsync()
+    {
+        var tasks = new[]
+        {
+            _allGrid?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask,
+            _cutBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask,
+            _sessionBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask,
+            _mixBrowser?.InvalidateWaveformStatusAsync() ?? Task.CompletedTask,
+        };
+        await Task.WhenAll(tasks);
+    }
+
+    /// <summary>
+    /// Backfill every track missing a waveform profile, one request at a time so a large backfill does not
+    /// flood the API with concurrent WAV decodes. On completion, re-reads the status map so the missing
+    /// count settles.
+    /// </summary>
+    private async Task GenerateAllMissingAsync()
+    {
+        var missing = _waveformStatus.Where(s => !s.HasProfile).ToList();
+        if (missing.Count == 0)
+        {
+            return;
+        }
+
+        _bulkRunning = true;
+        _bulkTotal = missing.Count;
+        _bulkDone = 0;
+        var failures = 0;
+
+        foreach (var status in missing)
+        {
+            try
+            {
+                var result = await CmsTrackService.GenerateWaveformProfileAsync(status.EntryKey);
+                if (!result.Success)
+                {
+                    failures++;
+                }
+            }
+            catch (Exception ex)
+            {
+                Logger.LogError(ex, "Waveform generation failed for {EntryKey}", status.EntryKey);
+                failures++;
+            }
+            _bulkDone++;
+            StateHasChanged();
+        }
+
+        _bulkRunning = false;
+        await RefreshWaveformStatusAsync();
+        await InvalidateAllGridsAsync();
+
+        var succeeded = missing.Count - failures;
+        if (failures == 0)
+        {
+            Snackbar.Add($"Generated {succeeded} profile(s).", Severity.Success);
+        }
+        else
+        {
+            Snackbar.Add($"Generated {succeeded} profile(s); {failures} failed.", Severity.Warning);
+        }
+    }
+
+    /// <summary>
+    /// Backfill the per-track high-res visualizer datum for every track missing one, one request at a time
+    /// so a large backfill does not flood the API with concurrent WAV decodes. Re-runnable (a second run
+    /// re-reads status and only retries what is still missing). On completion, re-reads the status map.
+    /// </summary>
+    private async Task GenerateAllMissingHighResAsync()
+    {
+        var missing = _waveformStatus.Where(s => !s.HasHighRes).ToList();
+        if (missing.Count == 0)
+        {
+            return;
+        }
+
+        _highResBulkRunning = true;
+        _highResBulkTotal = missing.Count;
+        _highResBulkDone = 0;
+        var failures = 0;
+
+        foreach (var status in missing)
+        {
+            try
+            {
+                var result = await CmsTrackService.GenerateHighResWaveformAsync(status.EntryKey);
+                if (!result.Success)
+                {
+                    failures++;
+                }
+            }
+            catch (Exception ex)
+            {
+                Logger.LogError(ex, "High-res waveform generation failed for {EntryKey}", status.EntryKey);
+                failures++;
+            }
+            _highResBulkDone++;
+            StateHasChanged();
+        }
+
+        _highResBulkRunning = false;
+        await RefreshWaveformStatusAsync();
+        await InvalidateAllGridsAsync();
+
+        var succeeded = missing.Count - failures;
+        if (failures == 0)
+        {
+            Snackbar.Add($"Backfilled {succeeded} high-res datum(s).", Severity.Success);
+        }
+        else
+        {
+            Snackbar.Add($"Backfilled {succeeded} high-res datum(s); {failures} failed.", Severity.Warning);
+        }
+    }
+}

DeepDrftManager/Components/Pages/Tracks/TrackList.razor

@@ -1,251 +0,0 @@
-@page "/tracks"
-@page "/tracks/albums"
-@page "/tracks/genres"
-@page "/tracks/archive"
-@using DeepDrftManager.Services
-@using DeepDrftModels.Enums
-@inject CmsTrackBrowserViewModel VM
-@inject ICmsTrackService CmsTrackService
-@inject ISnackbar Snackbar
-@inject ILogger<TrackList> Logger
-@inject NavigationManager NavigationManager
-@attribute [Authorize]
-
-<PageTitle>Tracks — DeepDrft CMS</PageTitle>
-
-<MudContainer MaxWidth="MaxWidth.Large" Class="mt-8">
-    <MudStack Row="true" AlignItems="AlignItems.Center" Justify="Justify.SpaceBetween" Class="mb-4">
-        <MudText Typo="Typo.h3">Tracks</MudText>
-
-        @if (VM.Mode == BrowseMode.Tracks)
-        {
-            <MudButton Variant="Variant.Outlined"
-                       Color="Color.Primary"
-                       StartIcon="@Icons.Material.Filled.AutoFixHigh"
-                       Disabled="@(_bulkRunning || (_grid?.GetMissingCount() ?? 0) == 0)"
-                       OnClick="GenerateAllMissingAsync">
-                @if (_bulkRunning)
-                {
-                    <MudProgressCircular Class="mr-2" Size="Size.Small" Indeterminate="true" />
-                    <span>Generating @_bulkDone / @_bulkTotal…</span>
-                }
-                else
-                {
-                    <span>Generate All Missing (@(_grid?.GetMissingCount() ?? 0))</span>
-                }
-            </MudButton>
-        }
-    </MudStack>
-
-    @* Top-level browse dimension. The former three-way toggle (Tracks / Releases / Release Archive)
-       collapsed to two (§8.A): "Releases" now hosts the in-page medium tab strip below, subsuming both
-       the old Releases grid (as the ALL tab) and the retired Release Archive cards. *@
-    <MudToggleGroup T="BrowseMode"
-                    Value="VM.Mode"
-                    ValueChanged="OnModeChanged"
-                    SelectionMode="SelectionMode.SingleSelection"
-                    Color="Color.Primary"
-                    Size="Size.Small"
-                    Class="mb-4">
-        <MudToggleItem Value="BrowseMode.Tracks">Tracks</MudToggleItem>
-        <MudToggleItem Value="BrowseMode.Albums">Releases</MudToggleItem>
-    </MudToggleGroup>
-
-    @if (VM.Mode == BrowseMode.Tracks)
-    {
-        <CmsTrackGrid @ref="_grid" ShowAddButton="true" PageSize="20" OnStatusLoaded="StateHasChanged" />
-    }
-    else if (VM.Mode == BrowseMode.Albums)
-    {
-        @* The Release Archive tab strip (§8.A): an ALL tab plus one tab per ReleaseMedium, ALL left-most.
-           The medium tabs are enum-driven — a fourth medium adds a tab automatically; only a label-lookup
-           entry (MediumTabLabels) and a content arm (MediumGrid) are needed, no markup fork. Selecting a
-           tab swaps the grid below in place; no navigation to a separate page occurs. *@
-        @* Medium-aware Add Track (§8.E): the button lives in the tab-strip chrome (not inside any grid
-           component — 8.C owns those) and reflects the active tab. It pre-selects the upload form to the
-           tab's medium via a single query-param (?medium=…); the ALL tab defaults to Cut. The medium is a
-           seed only — the upload form's selector stays user-changeable after landing. *@
-        <MudStack Row="true" Justify="Justify.FlexEnd" Class="mb-2">
-            <MudButton Variant="Variant.Filled"
-                       Color="Color.Primary"
-                       StartIcon="@Icons.Material.Filled.Add"
-                       Href="@AddTrackHref(ActiveMedium)">
-                Add Track
-            </MudButton>
-        </MudStack>
-
-        <MudTabs Elevation="0" Rounded="true" ApplyEffectsToContainer="true" PanelClass="pt-4"
-                 @bind-ActivePanelIndex="_activeTabIndex">
-            <MudTabPanel Text="ALL">
-                <CmsAllReleasesGrid OnReleasesChanged="OnAlbumsChanged" />
-            </MudTabPanel>
-            @foreach (var medium in Enum.GetValues<ReleaseMedium>())
-            {
-                <MudTabPanel Text="@MediumTabLabels[medium]">
-                    @MediumGrid(medium)
-                </MudTabPanel>
-            }
-        </MudTabs>
-    }
-    else
-    {
-        @* Genre browse keeps its route (/tracks/genres) but lost its tab to Release Archive (§3.1).
-           Reachable by direct URL; no longer in the toggle group. *@
-        <CmsGenreBrowser Genres="VM.Genres"
-                         IsLoading="VM.GenresLoading"
-                         ExpandedGenre="@VM.ExpandedGenre"
-                         OnExpandedGenreChanged="OnExpandedGenreChanged" />
-    }
-</MudContainer>
-
-@code {
-    private CmsTrackGrid? _grid;
-
-    // Active Release-Archive tab. Panel 0 is ALL; panels 1.. map to Enum.GetValues<ReleaseMedium>() in
-    // order. Drives the medium-aware Add Track button (§8.E).
-    private int _activeTabIndex;
-
-    // The medium the Add Track button pre-selects for the active tab. ALL (panel 0) defaults to Cut
-    // (Daniel, 2026-06-13); each medium tab maps to its enum value by position, so a fourth medium tab
-    // gets a correct Add Track for free — no markup fork.
-    private ReleaseMedium ActiveMedium =>
-        _activeTabIndex <= 0 ? ReleaseMedium.Cut : Enum.GetValues<ReleaseMedium>()[_activeTabIndex - 1];
-
-    // Single query-param convention: the upload page reads ?medium=… and seeds its selector (which stays
-    // user-changeable). Always explicit, including ALL→cut, so the link is unambiguous.
-    private static string AddTrackHref(ReleaseMedium medium) =>
-        $"/tracks/upload?medium={medium.ToString().ToLowerInvariant()}";
-
-    // Medium → tab label. The one place medium display text lives for the tab strip; a future medium adds
-    // one entry here and surfaces a tab automatically. Mirrors the extension discipline the retired
-    // ReleaseArchiveBrowser used for its cards. The ALL tab is rendered separately (it is not a medium).
-    private static readonly IReadOnlyDictionary<ReleaseMedium, string> MediumTabLabels =
-        new Dictionary<ReleaseMedium, string>
-        {
-            [ReleaseMedium.Cut] = "CUTS",
-            [ReleaseMedium.Session] = "SESSIONS",
-            [ReleaseMedium.Mix] = "MIXES",
-        };
-
-    // Medium → embedded grid. Each medium's grid is its own component (Cut has no per-row action; Session
-    // carries hero upload; Mix carries waveform generation), so the content dispatch is a per-medium
-    // mapping by nature — but it is a single switch returning a fragment, not a markup fork. The browsers
-    // render Embedded so their standalone page chrome (container, title, back button) is suppressed here.
-    private RenderFragment MediumGrid(ReleaseMedium medium) => medium switch
-    {
-        ReleaseMedium.Cut => @<CmsCutBrowser />,
-        ReleaseMedium.Session => @<CmsSessionBrowser Embedded="true" />,
-        ReleaseMedium.Mix => @<CmsMixBrowser Embedded="true" />,
-        _ => @<MudText Typo="Typo.body1" Class="mt-4">No grid for this medium.</MudText>
-    };
-
-    // The all-releases grid refreshes its own list after a delete; this notification lets us invalidate
-    // the VM's genre cache so genre counts reflect the deletion on the next switch into Genre mode.
-    private void OnAlbumsChanged()
-    {
-        VM.Invalidate();
-        StateHasChanged();
-    }
-
-    // Local state for the parent-owned "Generate All Missing" bulk run.
-    private bool _bulkRunning;
-    private int _bulkTotal;
-    private int _bulkDone;
-
-    protected override async Task OnInitializedAsync()
-    {
-        // /tracks/archive and /tracks/albums both land on the Releases view (the tab strip); the old
-        // separate Archive mode is retired (§8.A) but the route stays reachable rather than 404ing.
-        var uri = NavigationManager.Uri;
-        var initial =
-            uri.Contains("/tracks/albums", StringComparison.OrdinalIgnoreCase) ? BrowseMode.Albums
-            : uri.Contains("/tracks/archive", StringComparison.OrdinalIgnoreCase) ? BrowseMode.Albums
-            : uri.Contains("/tracks/genres", StringComparison.OrdinalIgnoreCase) ? BrowseMode.Genres
-            : BrowseMode.Tracks;
-        await VM.SwitchModeAsync(initial);
-    }
-
-    private async Task OnModeChanged(BrowseMode mode)
-    {
-        await VM.SwitchModeAsync(mode);
-        var path = mode switch
-        {
-            BrowseMode.Albums => "/tracks/albums",
-            BrowseMode.Genres => "/tracks/genres",
-            _ => "/tracks"
-        };
-        NavigationManager.NavigateTo(path, replace: true);
-        StateHasChanged();
-    }
-
-    private void OnExpandedGenreChanged(string? genre)
-    {
-        VM.SetExpandedGenre(genre);
-        StateHasChanged();
-    }
-
-    /// <summary>
-    /// Backfill every track missing a waveform profile, one request at a time so a large backfill
-    /// does not flood the API with concurrent WAV decodes. On completion, refreshes the grid's
-    /// status map so the per-row icons reflect the new state.
-    /// </summary>
-    private async Task GenerateAllMissingAsync()
-    {
-        var statusResult = await CmsTrackService.GetWaveformStatusAsync();
-        if (!statusResult.Success || statusResult.Value is null)
-        {
-            var error = statusResult.Messages.FirstOrDefault()?.Message ?? "Unknown error";
-            Snackbar.Add($"Failed to load waveform status: {error}", Severity.Error);
-            return;
-        }
-
-        var missing = statusResult.Value.Where(s => !s.HasProfile).ToList();
-        if (missing.Count == 0)
-        {
-            return;
-        }
-
-        _bulkRunning = true;
-        _bulkTotal = missing.Count;
-        _bulkDone = 0;
-        _grid?.SetBulkRunning(true);
-        var failures = 0;
-
-        foreach (var status in missing)
-        {
-            try
-            {
-                var result = await CmsTrackService.GenerateWaveformProfileAsync(status.EntryKey);
-                if (!result.Success)
-                {
-                    failures++;
-                }
-            }
-            catch (Exception ex)
-            {
-                Logger.LogError(ex, "Waveform generation failed for {EntryKey}", status.EntryKey);
-                failures++;
-            }
-            _bulkDone++;
-            StateHasChanged();
-        }
-
-        _bulkRunning = false;
-        _grid?.SetBulkRunning(false);
-
-        if (_grid is not null)
-        {
-            await _grid.RefreshWaveformStatusAsync();
-        }
-
-        var succeeded = missing.Count - failures;
-        if (failures == 0)
-        {
-            Snackbar.Add($"Generated {succeeded} profile(s).", Severity.Success);
-        }
-        else
-        {
-            Snackbar.Add($"Generated {succeeded} profile(s); {failures} failed.", Severity.Warning);
-        }
-    }
-}

DeepDrftManager/Components/RedirectToCatalogue.razor

@@ -0,0 +1,10 @@
+@inject NavigationManager NavigationManager
+
+@code {
+
+    protected override void OnInitialized()
+    {
+        NavigationManager.NavigateTo("/catalogue", forceLoad: false, replace: true);
+    }
+
+}

DeepDrftManager/Components/Routes.razor

@@ -2,8 +2,8 @@
         AdditionalAssemblies="new[] { typeof(AuthBlocksWeb._Imports).Assembly }"
         NotFoundPage="typeof(NotFound)">
     <Found Context="routeData">
-        <AuthorizeRouteView RouteData="routeData" 
-                            DefaultLayout="typeof(Layout.CmsLayout)">
+        <AuthorizeRouteView RouteData="routeData"
+                            DefaultLayout="@_currentLayout">
             <NotAuthorized Context="authState">
                 @if (authState.User.Identity?.IsAuthenticated == true)
                 {
@@ -18,3 +18,20 @@
         <FocusOnNavigate RouteData="routeData" Selector="h1" />
     </Found>
 </Router>
+
+@code {
+    [CascadingParameter] private Task<AuthenticationState>? AuthenticationState { get; set; }
+
+    private Type _currentLayout = typeof(Layout.CmsHomeLayout);
+
+    protected override async Task OnParametersSetAsync()
+    {
+        if (AuthenticationState is not null)
+        {
+            var authState = await AuthenticationState;
+            _currentLayout = authState.User.Identity?.IsAuthenticated == true
+                ? typeof(Layout.CmsLayout)
+                : typeof(Layout.CmsHomeLayout);
+        }
+    }
+}

DeepDrftManager/DeepDrftManager.csproj

@@ -8,7 +8,7 @@
 
   <ItemGroup>
     <PackageReference Include="MudBlazor" Version="8.15.0" />
-    <PackageReference Include="Cerebellum.AuthBlocks.Web" Version="10.3.33" />
+    <PackageReference Include="Cerebellum.AuthBlocks.Web" Version="10.3.39" />
   </ItemGroup>
 
   <ItemGroup>
@@ -17,3 +17,4 @@
   </ItemGroup>
 
 </Project>
+

DeepDrftManager/Program.cs

@@ -27,9 +27,6 @@ builder.Services.AddScoped<ICmsTrackService, CmsTrackService>();
 // DeepDrftAPI api/release family. Same no-in-process-data-layer posture as ICmsTrackService.
 builder.Services.AddScoped<ICmsReleaseService, CmsReleaseService>();
 
-// Per-circuit browse state for the /tracks page (mode toggle + album/genre datasets).
-builder.Services.AddScoped<CmsTrackBrowserViewModel>();
-
 // AuthBlocksWeb: server-side cascading auth state plus the JWT client services used by the
 // /account/login + /account/logout Razor pages that ship in the AuthBlocksWeb RCL.
 // The auth API lives on DeepDrftAPI, so pass its URL — not Manager's own Kestrel URL.
@@ -44,8 +41,10 @@ builder.Services.AddHttpClient("DeepDrft.Content", client =>
     client.BaseAddress = new Uri(contentApiUrl);
 });
 
-// Named HttpClient for ApiKey-protected Content API calls (CmsTrackService's vault delete).
-// API key baked into the default request headers so callers need not add it manually.
+// Named HttpClient for ApiKey-protected Content API calls (CmsTrackService's non-upload operations:
+// delete, paged list, metadata read/write, waveform jobs, releases, genres).
+// Timeout left at the default 100s — these are short request/response pairs and an infinite timeout
+// would hang an InteractiveServer circuit forever on a dead connection.
 var contentApiKey = builder.Configuration["Api:ContentApiKey"]
     ?? throw new InvalidOperationException("Api:ContentApiKey is required");
 builder.Services.AddHttpClient("DeepDrft.Content.Cms", client =>
@@ -54,6 +53,17 @@ builder.Services.AddHttpClient("DeepDrft.Content.Cms", client =>
     client.DefaultRequestHeaders.Add("ApiKey", contentApiKey);
 });
 
+// Dedicated upload client — inherits the API key but removes the whole-request timeout.
+// Large WAV uploads (several hundred MB) outrun the 100s default. The upload path enforces an
+// idle/heartbeat deadline instead (body-streaming phase via ProgressStreamContent) plus a separate
+// response-wait budget (CmsTrackService), so the client itself must not impose a total cap.
+builder.Services.AddHttpClient("DeepDrft.Content.Cms.Upload", client =>
+{
+    client.BaseAddress = new Uri(contentApiUrl);
+    client.DefaultRequestHeaders.Add("ApiKey", contentApiKey);
+    client.Timeout = Timeout.InfiniteTimeSpan;
+});
+
 // Reverse-proxy support (nginx in production).
 builder.Services.Configure<ForwardedHeadersOptions>(options =>
 {

DeepDrftManager/Services/CmsTrackBrowserViewModel.cs

@@ -1,76 +0,0 @@
-using DeepDrftModels.DTOs;
-
-namespace DeepDrftManager.Services;
-
-/// <summary>The browse dimensions for the /tracks page.</summary>
-public enum BrowseMode
-{
-    Tracks,
-
-    /// <summary>The release view — hosts the medium tab strip (ALL · CUTS · SESSIONS · MIXES, §8.A).</summary>
-    Albums,
-
-    Genres,
-}
-
-/// <summary>
-/// Holds the /tracks browser's current mode plus the album- and genre-mode datasets. Scoped per
-/// circuit. Album and genre lists are fetched lazily on first switch into their mode and cached for
-/// the circuit's lifetime; Track mode owns its own paging inside <c>CmsTrackGrid</c> and needs no
-/// state here.
-/// </summary>
-public class CmsTrackBrowserViewModel
-{
-    private readonly ICmsTrackService _trackService;
-
-    public CmsTrackBrowserViewModel(ICmsTrackService trackService)
-    {
-        _trackService = trackService;
-    }
-
-    public BrowseMode Mode { get; private set; } = BrowseMode.Tracks;
-
-    // Genre mode.
-    public IReadOnlyList<GenreSummaryDto> Genres { get; private set; } = Array.Empty<GenreSummaryDto>();
-    public bool GenresLoading { get; private set; }
-    public string? ExpandedGenre { get; private set; }
-
-    /// <summary>
-    /// Switch the active mode, lazily loading the genre dataset on first entry into Genre mode and
-    /// collapsing any expanded genre row. Track mode and the all-releases grid (Albums mode) each own
-    /// their own data — the grid loads itself (see <c>CmsAllReleasesGrid</c>) — so no fetch happens for
-    /// either here.
-    /// </summary>
-    public async Task SwitchModeAsync(BrowseMode mode)
-    {
-        Mode = mode;
-        ExpandedGenre = null; // collapse on mode switch
-
-        if (mode == BrowseMode.Genres && Genres.Count == 0 && !GenresLoading)
-        {
-            GenresLoading = true;
-            var result = await _trackService.GetGenreSummariesAsync();
-            Genres = result.Success && result.Value is not null
-                ? result.Value
-                : Array.Empty<GenreSummaryDto>();
-            GenresLoading = false;
-        }
-    }
-
-    /// <summary>Toggle the expanded genre row. Selecting the already-expanded genre collapses it.</summary>
-    public void SetExpandedGenre(string? genre)
-    {
-        ExpandedGenre = ExpandedGenre == genre ? null : genre;
-    }
-
-    /// <summary>
-    /// Drop the cached genre dataset so the next <see cref="SwitchModeAsync"/> into Genre mode
-    /// re-fetches from the API. Call after a track or release mutation (edit, delete) since the genre
-    /// summaries are derived from the catalogue and go stale on any such change. The all-releases grid
-    /// owns and refreshes its own data, so it needs no invalidation here.
-    /// </summary>
-    public void Invalidate()
-    {
-        Genres = Array.Empty<GenreSummaryDto>();
-    }
-}

DeepDrftManager/Services/CmsTrackService.cs

@@ -18,21 +18,43 @@ namespace DeepDrftManager.Services;
 public class CmsTrackService : ICmsTrackService
 {
     private const string ContentCmsClientName = "DeepDrft.Content.Cms";
+    private const string UploadClientName = "DeepDrft.Content.Cms.Upload";
     private const string UploadPath = "api/track/upload";
 
+    // Idle/heartbeat window: abort an upload only after this long with zero bytes written to the wire.
+    // The window resets on every progress tick, so a slow-but-moving half-gig upload never trips it;
+    // a genuinely stalled socket does. Governs the BODY-STREAMING phase only.
+    // Operator-tunable via Upload:IdleTimeoutSeconds.
+    private const int DefaultIdleTimeoutSeconds = 90;
+
+    // Response-wait budget: once the request body is fully on the wire the server runs AudioProcessor
+    // decode → vault write → SQL persist. For a multi-GB WAV this can exceed 10 minutes.
+    // The idle heartbeat goes silent after the last byte, so a separate, larger deadline governs the
+    // response-wait phase so a fully-uploaded file is never killed mid-persist.
+    // Operator-tunable via Upload:ResponseTimeoutSeconds.
+    private const int DefaultResponseTimeoutSeconds = 1200; // 20 minutes
+
     private readonly IHttpClientFactory _httpClientFactory;
     private readonly ILogger<CmsTrackService> _logger;
+    private readonly TimeSpan _uploadIdleTimeout;
+    private readonly TimeSpan _uploadResponseTimeout;
 
     public CmsTrackService(
         IHttpClientFactory httpClientFactory,
+        IConfiguration configuration,
         ILogger<CmsTrackService> logger)
     {
         _httpClientFactory = httpClientFactory;
         _logger = logger;
+        var idleSeconds = configuration.GetValue<int?>("Upload:IdleTimeoutSeconds") ?? DefaultIdleTimeoutSeconds;
+        _uploadIdleTimeout = TimeSpan.FromSeconds(idleSeconds > 0 ? idleSeconds : DefaultIdleTimeoutSeconds);
+        var responseSeconds = configuration.GetValue<int?>("Upload:ResponseTimeoutSeconds") ?? DefaultResponseTimeoutSeconds;
+        _uploadResponseTimeout = TimeSpan.FromSeconds(responseSeconds > 0 ? responseSeconds : DefaultResponseTimeoutSeconds);
     }
 
     public async Task<ResultContainer<TrackDto>> UploadTrackAsync(
         Stream wavStream,
+        long contentLength,
         string fileName,
         string contentType,
         string trackName,
@@ -46,14 +68,15 @@ public class CmsTrackService : ICmsTrackService
         ReleaseType releaseType,
         int trackNumber,
         ReleaseMedium medium = ReleaseMedium.Cut,
+        long? releaseId = null,
+        IProgress<long>? progress = null,
         CancellationToken ct = default)
     {
-        // Rebuild the multipart container so the boundary is owned by HttpClient and the
-        // caller-supplied stream (already buffered by the SignalR upload) is the source.
+        // Build the WAV part once; the two-phase send helper owns the cancellation plumbing.
+        using var phase = new UploadPhase(this, ct);
+        var wavContent = phase.WrapContent(wavStream, contentLength, contentType, progress);
+
         using var multipart = new MultipartFormDataContent();
-        var wavContent = new StreamContent(wavStream);
-        wavContent.Headers.ContentType = new MediaTypeHeaderValue(
-            string.IsNullOrWhiteSpace(contentType) ? "audio/wav" : contentType);
         multipart.Add(wavContent, "audioFile", fileName);
         multipart.Add(new StringContent(trackName), "trackName");
         multipart.Add(new StringContent(artist), "artist");
@@ -69,19 +92,14 @@ public class CmsTrackService : ICmsTrackService
         // The upload endpoint binds "medium" to the created release's ReleaseMedium (defaulting to Cut
         // for an unrecognised value). Authoritative only when this upload creates the release.
         multipart.Add(new StringContent(medium.ToString()), "medium");
+        // releaseId present → ATTACH (rows 2..N of a within-batch Cut); absent → CREATE (server rejects a
+        // pre-existing (title, artist) as a duplicate). Only sent when set so the form omits it on row 1.
+        if (releaseId is { } rid) multipart.Add(new StringContent(rid.ToString()), "releaseId");
 
-        var client = _httpClientFactory.CreateClient(ContentCmsClientName);
-        using var request = new HttpRequestMessage(HttpMethod.Post, UploadPath) { Content = multipart };
-
-        HttpResponseMessage response;
-        try
+        var send = await phase.SendAsync(UploadPath, multipart, $"upload of {trackName}");
+        if (send.Response is not { } response)
         {
-            response = await client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, ct);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Content API call failed for upload of {TrackName}", trackName);
-            return ResultContainer<TrackDto>.CreateFailResult("Content API is unreachable.");
+            return ResultContainer<TrackDto>.CreateFailResult(send.FailureMessage!);
         }
 
         using (response)
@@ -125,6 +143,172 @@ public class CmsTrackService : ICmsTrackService
         }
     }
 
+    public async Task<Result> ReplaceTrackAudioAsync(
+        long id,
+        Stream wavStream,
+        long contentLength,
+        string fileName,
+        string contentType,
+        IProgress<long>? progress = null,
+        CancellationToken ct = default)
+    {
+        // Same two-phase send plumbing as UploadTrackAsync — a WAV replace is an equally large body.
+        // The request carries only the audio part; the server resolves the track by route id and
+        // preserves its metadata, so no metadata fields ride along.
+        using var phase = new UploadPhase(this, ct);
+        var wavContent = phase.WrapContent(wavStream, contentLength, contentType, progress);
+
+        using var multipart = new MultipartFormDataContent();
+        multipart.Add(wavContent, "audioFile", fileName);
+
+        var send = await phase.SendAsync($"api/track/{id}/replace-audio", multipart, $"replace of track {id}");
+        if (send.Response is not { } response)
+        {
+            return Result.CreateFailResult(send.FailureMessage!);
+        }
+
+        using (response)
+        {
+            if (response.IsSuccessStatusCode)
+            {
+                return Result.CreatePassResult();
+            }
+
+            if (response.StatusCode == HttpStatusCode.NotFound)
+            {
+                return Result.CreateFailResult("Track not found.");
+            }
+
+            var body = await response.Content.ReadAsStringAsync(ct);
+            var statusCode = (int)response.StatusCode;
+            if (statusCode >= 500)
+            {
+                _logger.LogError("Content API returned {Status} for replace of track {TrackId}: {Body}", statusCode, id, body);
+                return Result.CreateFailResult("Replace failed on the content server. Please try again.");
+            }
+
+            // 4xx: body is user-friendly validation text from DeepDrftAPI — relay as-is.
+            _logger.LogWarning("Content API rejected replace of track {TrackId}: {Status} {Body}", id, statusCode, body);
+            return Result.CreateFailResult(
+                string.IsNullOrWhiteSpace(body) ? $"Replace rejected ({statusCode})." : body);
+        }
+    }
+
+    /// <summary>
+    /// Owns the two-phase cancellation for a large-body multipart send (the original upload and the
+    /// audio replace share it identically):
+    ///
+    ///   BODY-STREAMING phase (while bytes are on the wire): the idle CTS fires if no progress tick
+    ///   arrives within the idle window. Each <see cref="ProgressStreamContent"/> chunk resets it, so a
+    ///   slow-but-moving body never trips it; a genuinely stalled socket does.
+    ///
+    ///   RESPONSE-WAIT phase (after the last byte, while the server persists): the idle heartbeat goes
+    ///   silent, so a separate, larger budget is armed at body-complete and the idle timer is disarmed,
+    ///   guaranteeing a fully-sent body is never killed mid-persist.
+    ///
+    /// The send CTS links both phase tokens plus the caller's token. Single-sourcing this here keeps
+    /// the idle/response-wait behaviour identical across every large-body call.
+    /// </summary>
+    private sealed class UploadPhase : IDisposable
+    {
+        private readonly CmsTrackService _owner;
+        private readonly CancellationToken _callerToken;
+        private readonly CancellationTokenSource _idleCts;
+        private readonly CancellationTokenSource _responseCts;
+        private readonly CancellationTokenSource _sendCts;
+
+        public UploadPhase(CmsTrackService owner, CancellationToken callerToken)
+        {
+            _owner = owner;
+            _callerToken = callerToken;
+            _idleCts = CancellationTokenSource.CreateLinkedTokenSource(callerToken);
+            _idleCts.CancelAfter(owner._uploadIdleTimeout);
+            // responseCts starts disarmed; the body-complete callback arms it.
+            _responseCts = CancellationTokenSource.CreateLinkedTokenSource(callerToken);
+            _sendCts = CancellationTokenSource.CreateLinkedTokenSource(_idleCts.Token, _responseCts.Token);
+        }
+
+        public ProgressStreamContent WrapContent(
+            Stream wavStream, long contentLength, string contentType, IProgress<long>? progress)
+        {
+            var content = new ProgressStreamContent(
+                wavStream,
+                contentLength,
+                written =>
+                {
+                    // One mechanism, three consumers: advance the UI meter, reset the idle heartbeat,
+                    // and on body-complete transition to the response-wait budget.
+                    progress?.Report(written);
+                    if (written < contentLength)
+                    {
+                        _idleCts.CancelAfter(_owner._uploadIdleTimeout);
+                    }
+                    else
+                    {
+                        // Last byte on the wire. Disarm the idle timer and start the response budget.
+                        _idleCts.CancelAfter(Timeout.InfiniteTimeSpan);
+                        _responseCts.CancelAfter(_owner._uploadResponseTimeout);
+                    }
+                });
+            content.Headers.ContentType = new MediaTypeHeaderValue(
+                string.IsNullOrWhiteSpace(contentType) ? "audio/wav" : contentType);
+            return content;
+        }
+
+        public async Task<LargeBodySendResult> SendAsync(
+            string path, HttpContent content, string operationLabel)
+        {
+            // Dedicated upload client (InfiniteTimeSpan) so the two-phase CTS logic is the sole timeout
+            // authority. Non-upload operations use the bounded "DeepDrft.Content.Cms" client.
+            var client = _owner._httpClientFactory.CreateClient(UploadClientName);
+            using var request = new HttpRequestMessage(HttpMethod.Post, path) { Content = content };
+
+            try
+            {
+                var response = await client.SendAsync(
+                    request, HttpCompletionOption.ResponseHeadersRead, _sendCts.Token);
+                return LargeBodySendResult.Ok(response);
+            }
+            catch (OperationCanceledException) when (!_callerToken.IsCancellationRequested)
+            {
+                if (_idleCts.IsCancellationRequested)
+                {
+                    _owner._logger.LogWarning("{Operation} stalled — no progress for {IdleSeconds}s; aborting.",
+                        operationLabel, _owner._uploadIdleTimeout.TotalSeconds);
+                    return LargeBodySendResult.Fail(
+                        $"{operationLabel} stalled — no data transferred for {_owner._uploadIdleTimeout.TotalSeconds:0}s. Please retry.");
+                }
+                _owner._logger.LogWarning("{Operation} timed out waiting for server response after {ResponseSeconds}s.",
+                    operationLabel, _owner._uploadResponseTimeout.TotalSeconds);
+                return LargeBodySendResult.Fail(
+                    $"{operationLabel} timed out waiting for the server to respond after {_owner._uploadResponseTimeout.TotalSeconds:0}s. Please retry.");
+            }
+            catch (Exception ex)
+            {
+                _owner._logger.LogError(ex, "Content API call failed for {Operation}", operationLabel);
+                return LargeBodySendResult.Fail("Content API is unreachable.");
+            }
+        }
+
+        public void Dispose()
+        {
+            _sendCts.Dispose();
+            _responseCts.Dispose();
+            _idleCts.Dispose();
+        }
+    }
+
+    // Outcome of a two-phase send: either a live response the caller must dispose, or a user-facing
+    // failure message. Exactly one is non-null.
+    private readonly struct LargeBodySendResult
+    {
+        public HttpResponseMessage? Response { get; private init; }
+        public string? FailureMessage { get; private init; }
+
+        public static LargeBodySendResult Ok(HttpResponseMessage response) => new() { Response = response };
+        public static LargeBodySendResult Fail(string message) => new() { FailureMessage = message };
+    }
+
     public async Task<Result> DeleteTrackAsync(long id, CancellationToken ct = default)
     {
         var client = _httpClientFactory.CreateClient(ContentCmsClientName);
@@ -294,6 +478,53 @@ public class CmsTrackService : ICmsTrackService
         }
     }
 
+    public async Task<ResultContainer<ReleaseDto?>> GetExistingReleaseAsync(
+        string title, string artist, CancellationToken ct = default)
+    {
+        var client = _httpClientFactory.CreateClient(ContentCmsClientName);
+        var query = $"api/track/release/exists?title={Uri.EscapeDataString(title)}&artist={Uri.EscapeDataString(artist)}";
+
+        HttpResponseMessage response;
+        try
+        {
+            response = await client.GetAsync(query, ct);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Content API call failed for release existence check ({Title}, {Artist})", title, artist);
+            return ResultContainer<ReleaseDto?>.CreateFailResult("Content API is unreachable.");
+        }
+
+        using (response)
+        {
+            // 404 is the not-found (null) case, not a failure — no release matches this (title, artist).
+            if (response.StatusCode == HttpStatusCode.NotFound)
+            {
+                return ResultContainer<ReleaseDto?>.CreatePassResult(null);
+            }
+
+            if (!response.IsSuccessStatusCode)
+            {
+                _logger.LogError("Content API release existence check failed for ({Title}, {Artist}): {Status}",
+                    title, artist, (int)response.StatusCode);
+                return ResultContainer<ReleaseDto?>.CreateFailResult("Failed to check for an existing release.");
+            }
+
+            ReleaseDto? release;
+            try
+            {
+                release = await response.Content.ReadFromJsonAsync<ReleaseDto>(ct);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to deserialize ReleaseDto from release existence check");
+                return ResultContainer<ReleaseDto?>.CreateFailResult("Content API returned an unexpected response.");
+            }
+
+            return ResultContainer<ReleaseDto?>.CreatePassResult(release);
+        }
+    }
+
     private static readonly HashSet<string> KnownImageMimeTypes = new(StringComparer.OrdinalIgnoreCase)
     {
         "image/jpeg", "image/png", "image/gif", "image/webp", "image/svg+xml", "image/bmp"
@@ -501,6 +732,39 @@ public class CmsTrackService : ICmsTrackService
         }
     }
 
+    public async Task<Result> GenerateHighResWaveformAsync(string entryKey, CancellationToken ct = default)
+    {
+        var client = _httpClientFactory.CreateClient(ContentCmsClientName);
+
+        HttpResponseMessage response;
+        try
+        {
+            response = await client.PostAsync($"api/track/{Uri.EscapeDataString(entryKey)}/waveform/high-res", null, ct);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Content API call failed for high-res waveform generation of {EntryKey}", entryKey);
+            return Result.CreateFailResult("Content API is unreachable.");
+        }
+
+        using (response)
+        {
+            if (response.IsSuccessStatusCode)
+            {
+                return Result.CreatePassResult();
+            }
+
+            if (response.StatusCode == HttpStatusCode.NotFound)
+            {
+                return Result.CreateFailResult("Track audio not found.");
+            }
+
+            var body = await response.Content.ReadAsStringAsync(ct);
+            _logger.LogError("Content API high-res waveform generation failed for {EntryKey}: {Status} {Body}", entryKey, (int)response.StatusCode, body);
+            return Result.CreateFailResult("Failed to generate high-res waveform datum.");
+        }
+    }
+
     public async Task<ResultContainer<List<ReleaseDto>>> GetReleasesAsync(CancellationToken ct = default)
     {
         var client = _httpClientFactory.CreateClient(ContentCmsClientName);
@@ -545,50 +809,6 @@ public class CmsTrackService : ICmsTrackService
         }
     }
 
-    public async Task<ResultContainer<List<GenreSummaryDto>>> GetGenreSummariesAsync(CancellationToken ct = default)
-    {
-        var client = _httpClientFactory.CreateClient(ContentCmsClientName);
-
-        HttpResponseMessage response;
-        try
-        {
-            response = await client.GetAsync("api/track/genres", ct);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Content API call failed for genre summaries");
-            return ResultContainer<List<GenreSummaryDto>>.CreateFailResult("Content API is unreachable.");
-        }
-
-        using (response)
-        {
-            if (!response.IsSuccessStatusCode)
-            {
-                _logger.LogError("Content API genre summaries failed: {Status}", (int)response.StatusCode);
-                return ResultContainer<List<GenreSummaryDto>>.CreateFailResult("Failed to load genres.");
-            }
-
-            List<GenreSummaryDto>? genres;
-            try
-            {
-                genres = await response.Content.ReadFromJsonAsync<List<GenreSummaryDto>>(ct);
-            }
-            catch (Exception ex)
-            {
-                _logger.LogError(ex, "Failed to deserialize genre summaries from Content API response");
-                return ResultContainer<List<GenreSummaryDto>>.CreateFailResult("Content API returned an unexpected response.");
-            }
-
-            if (genres is null)
-            {
-                _logger.LogError("Content API returned a null genre summaries list");
-                return ResultContainer<List<GenreSummaryDto>>.CreateFailResult("Content API returned an empty response.");
-            }
-
-            return ResultContainer<List<GenreSummaryDto>>.CreatePassResult(genres);
-        }
-    }
-
     public async Task<ResultContainer<int>> GetTrackCountAsync(CancellationToken ct = default)
     {
         // Re-use the paged endpoint: a single-item page carries the full TotalCount, so no

DeepDrftManager/Services/ICmsTrackService.cs

@@ -21,9 +21,18 @@ public interface ICmsTrackService
     /// <paramref name="medium"/> sets the parent release's <see cref="ReleaseMedium"/> when this upload
     /// creates the release. The medium is authoritative only on creation — adding a track to an existing
     /// release never changes its medium (that is the edit path, <see cref="UpdateAsync"/>).
+    /// <paramref name="contentLength"/> is the total payload size (the browser file's <c>Size</c>); it
+    /// sets Content-Length and is the denominator for <paramref name="progress"/>, which reports cumulative
+    /// bytes pushed to the wire. Each progress tick also resets the idle/heartbeat upload timeout, so a
+    /// stalled connection aborts without a fixed total-duration cap.
+    /// <paramref name="releaseId"/> distinguishes the two rows of a within-batch multi-track Cut: null on
+    /// the first row (CREATE — the server rejects a pre-existing (title, artist) as a duplicate) and the
+    /// id returned by that first row on rows 2..N (ATTACH — the server skips the duplicate check and adds
+    /// the track to the release the batch just created).
     /// </summary>
     Task<ResultContainer<TrackDto>> UploadTrackAsync(
         Stream wavStream,
+        long contentLength,
         string fileName,
         string contentType,
         string trackName,
@@ -37,14 +46,44 @@ public interface ICmsTrackService
         ReleaseType releaseType,
         int trackNumber,
         ReleaseMedium medium = ReleaseMedium.Cut,
+        long? releaseId = null,
+        IProgress<long>? progress = null,
         CancellationToken ct = default);
 
+    /// <summary>
+    /// Upload-form pre-flight: returns the existing release whose exact (title, artist) matches, or null
+    /// when none exists. Backs the duplicate block the form runs BEFORE transferring bytes, so the admin
+    /// is not surprised at the end of a long upload. A 404 from the API is the not-found (null) case, not
+    /// a failure. The match semantics are the API's <c>GetReleaseByTitleAndArtist</c> — the same read the
+    /// server backstop uses — so the pre-flight and the backstop agree.
+    /// </summary>
+    Task<ResultContainer<ReleaseDto?>> GetExistingReleaseAsync(
+        string title, string artist, CancellationToken ct = default);
+
     /// <summary>
     /// Delete a track via the Content API, which removes the SQL row then the vault entry.
     /// Maps a 404 to a "Track not found." failure.
     /// </summary>
     Task<Result> DeleteTrackAsync(long id, CancellationToken ct = default);
 
+    /// <summary>
+    /// Replace an existing track's audio via <c>POST api/track/{id}/replace-audio</c>. Swaps only the
+    /// vault bytes and regenerates the track's waveform data server-side; the track id, vault key,
+    /// release membership, position, and metadata are preserved. Uses the dedicated upload client and
+    /// the same two-phase (idle / response-wait) cancellation as <see cref="UploadTrackAsync"/>, since
+    /// a WAV replace is a large-body upload. <paramref name="contentLength"/> sets Content-Length and is
+    /// the denominator for <paramref name="progress"/>; each progress tick resets the idle heartbeat.
+    /// Maps a 404 to a "Track not found." failure.
+    /// </summary>
+    Task<Result> ReplaceTrackAudioAsync(
+        long id,
+        Stream wavStream,
+        long contentLength,
+        string fileName,
+        string contentType,
+        IProgress<long>? progress = null,
+        CancellationToken ct = default);
+
     /// <summary>
     /// Soft-delete a release record via DELETE api/track/release/{id}. Use when a release
     /// has no live tracks and needs to be removed from the albums browser.
@@ -105,12 +144,17 @@ public interface ICmsTrackService
     /// </summary>
     Task<Result> GenerateWaveformProfileAsync(string entryKey, CancellationToken ct = default);
 
+    /// <summary>
+    /// Trigger high-res visualizer datum generation for a single track via
+    /// <c>POST api/track/{entryKey}/waveform/high-res</c> (phase-12 §5). Re-runnable — recomputes on each
+    /// call. Drives the per-row generate action and the batch backfill. Maps a 404 to a "Track audio not
+    /// found." failure.
+    /// </summary>
+    Task<Result> GenerateHighResWaveformAsync(string entryKey, CancellationToken ct = default);
+
     /// <summary>Returns all releases with track counts from GET api/track/albums.</summary>
     Task<ResultContainer<List<ReleaseDto>>> GetReleasesAsync(CancellationToken ct = default);
 
-    /// <summary>Returns all distinct genres with track counts from GET api/track/genres.</summary>
-    Task<ResultContainer<List<GenreSummaryDto>>> GetGenreSummariesAsync(CancellationToken ct = default);
-
     /// <summary>
     /// Returns the total track count by calling GET api/track/page with pageSize=1 and reading TotalCount.
     /// </summary>

DeepDrftManager/Services/ProgressStreamContent.cs

@@ -0,0 +1,64 @@
+using System.Net;
+
+namespace DeepDrftManager.Services;
+
+/// <summary>
+/// An <see cref="HttpContent"/> that streams a source stream to the wire while reporting cumulative
+/// bytes written after each chunk. This is the single source of truth for both the upload progress
+/// meter and the idle/heartbeat timeout: every reported tick advances the UI <em>and</em> resets the
+/// idle deadline, so one mechanism feeds both concerns.
+/// </summary>
+/// <remarks>
+/// Wrap the audio payload (not the whole multipart container) so <see cref="TryComputeLength"/>
+/// returns the file length and the reported byte counts map directly onto "bytes of this file".
+/// </remarks>
+public sealed class ProgressStreamContent : HttpContent
+{
+    // 80 KB: large enough to keep the socket fed on a healthy link, small enough that a stalled
+    // connection trips the idle window without a multi-MB write swallowing the whole heartbeat budget.
+    private const int CopyBufferSize = 81_920;
+
+    private readonly Stream _source;
+    private readonly long _length;
+    private readonly Action<long> _onBytesWritten;
+
+    /// <param name="source">The payload stream. Read once, sequentially — not seekable-rewound.</param>
+    /// <param name="length">Total bytes the source will yield; sets Content-Length and the meter denominator.</param>
+    /// <param name="onBytesWritten">Invoked after each chunk with the cumulative bytes written so far.</param>
+    public ProgressStreamContent(Stream source, long length, Action<long> onBytesWritten)
+    {
+        _source = source;
+        _length = length;
+        _onBytesWritten = onBytesWritten;
+    }
+
+    // Token-aware overload (.NET 5+): HttpClient calls this on the send path and passes the request's
+    // CancellationToken, so the idle-heartbeat CTS aborts an in-flight read/write promptly — not just
+    // between chunks. The parameterless base override delegates here with CancellationToken.None.
+    protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context, CancellationToken cancellationToken)
+        => CopyAsync(stream, cancellationToken);
+
+    protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context)
+        => CopyAsync(stream, CancellationToken.None);
+
+    private async Task CopyAsync(Stream stream, CancellationToken cancellationToken)
+    {
+        var buffer = new byte[CopyBufferSize];
+        long written = 0;
+        int read;
+        while ((read = await _source.ReadAsync(buffer, cancellationToken)) > 0)
+        {
+            await stream.WriteAsync(buffer.AsMemory(0, read), cancellationToken);
+            written += read;
+            // Report after the bytes are on the wire — a tick means real forward progress, which is
+            // exactly the signal the idle heartbeat must reset on.
+            _onBytesWritten(written);
+        }
+    }
+
+    protected override bool TryComputeLength(out long length)
+    {
+        length = _length;
+        return true;
+    }
+}

DeepDrftManager/appsettings.json

@@ -8,5 +8,9 @@
   "AllowedHosts": "*",
   "ForwardedHeaders": {
     "DisableHttpsRedirection": false
+  },
+  "Upload": {
+    "IdleTimeoutSeconds": 90,
+    "ResponseTimeoutSeconds": 1200
   }
 }

DeepDrftManager/wwwroot/robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

DeepDrftModels/CLAUDE.md

@@ -15,7 +15,8 @@ DeepDrftModels/
 ├── Entities/
 │   └── TrackEntity.cs          # Database entity for tracks
 ├── DTOs/
-│   └── TrackDto.cs             # DTO mirror of TrackEntity
+│   ├── TrackDto.cs             # DTO mirror of TrackEntity
+│   └── HomeStatsDto.cs         # Aggregate figures for the public home hero stat row
 ├── Models/
 │   ├── PagingParameters.cs      # Pagination configuration (base + generic)
 │   └── PagedResult.cs           # Paginated result wrapper
@@ -35,6 +36,7 @@ public string? Album { get; set; }                // Optional album (max 200)
 public string? Genre { get; set; }                // Optional genre (max 100)
 public DateOnly? ReleaseDate { get; set; }        // Optional release date
 public string? ImagePath { get; set; }            // Optional image URL (max 500)
+public double? DurationSeconds { get; set; }      // Audio runtime in seconds (nullable; populated at upload, backfilled for older rows)
 ```
 
 **No `MediaPath` field exists.** That was a legacy name. The field is `EntryKey`.
@@ -47,6 +49,19 @@ Convention: required reference fields use `required` modifier; optional referenc
 
 Mirrors `TrackEntity` structure (identical fields, same nullability). Used where DTO/entity separation is needed for serialisation. In practice, both flow over the wire today, but the separation is available if APIs need to diverge (e.g., hide `Id` in responses).
 
+## HomeStatsDto
+
+Aggregate figures behind the public home hero stat row (`NowPlayingStats`). A single round-trip returns everything the three cards need. Fields:
+
+- `CutTrackCount` (int): total non-deleted tracks on Cut-medium releases.
+- `CutReleaseTypeCounts` (`List<CutReleaseTypeCount>`): per-`ReleaseType` Cut release counts; zero-count types are absent (suppressed server-side).
+- `MixReleaseCount` (int): total non-deleted Mix-medium releases.
+- `MixRuntimeSeconds` (double): sum of `DurationSeconds` across all non-deleted tracks on Mix releases (null durations count as 0). Rendered as `hh:mm` by `RuntimeFormat` on the client.
+- `TotalPlays` (long): site-wide total plays — sum of every `play_counter` row's `PartialCount + SampledCount + CompleteCount`, all-time (Phase 16 §5). Zero until the play-telemetry migration is applied; that is expected, not an error. The Plays card's primary odometer figure.
+- `UniqueListeners` (int): site-wide distinct anonymous listeners — distinct non-null `anon_id` values across all play events, all-time (Phase 16 §3 / D7). Zero until the migration is applied. The Plays card's secondary line ("N listeners").
+
+`CutReleaseTypeCount` is a nested type (`ReleaseType`, `Count` int) defined in the same file.
+
 ## Pagination system
 
 ### PagingParameters (base)

DeepDrftModels/DTOs/HomeStatsDto.cs

@@ -0,0 +1,51 @@
+using DeepDrftModels.Enums;
+
+namespace DeepDrftModels.DTOs;
+
+/// <summary>
+/// Aggregate figures behind the public home hero stat row (NowPlayingStats). A single read returns
+/// everything the three cards need so the client makes one round-trip. The track-domain counts exclude
+/// soft-deleted rows; the play-domain figures (Phase 16) come from the event domain.
+/// </summary>
+public class HomeStatsDto
+{
+    /// <summary>Total non-deleted tracks whose release is the Cut medium. The Studio Cuts card's primary figure.</summary>
+    public int CutTrackCount { get; set; }
+
+    /// <summary>
+    /// Per-ReleaseType counts of non-deleted Cut releases. Only types with at least one release are
+    /// present — a zero-count type is absent from the list (the card suppresses it). The Studio Cuts
+    /// card's secondary breakdown.
+    /// </summary>
+    public List<CutReleaseTypeCount> CutReleaseTypeCounts { get; set; } = [];
+
+    /// <summary>Total non-deleted releases of the Mix medium. The Mixes card's primary figure ("N Sets").</summary>
+    public int MixReleaseCount { get; set; }
+
+    /// <summary>
+    /// Sum of DurationSeconds across all non-deleted tracks on Mix releases. Tracks with a null
+    /// duration (not yet backfilled) contribute 0. The Mixes card's secondary figure, rendered hh:mm.
+    /// </summary>
+    public double MixRuntimeSeconds { get; set; }
+
+    /// <summary>
+    /// Site-wide total plays across all tracks — the sum of every play_counter's bucket columns
+    /// (partial + sampled + complete), all-time (Phase 16 §5). The Plays card's primary odometer figure.
+    /// Reads zero until the play-telemetry migration is applied; that is expected, not an error.
+    /// </summary>
+    public long TotalPlays { get; set; }
+
+    /// <summary>
+    /// Site-wide distinct anonymous listeners — distinct non-null anon_id across all play events,
+    /// all-time (Phase 16 §3 / D7). The Plays card's secondary line ("N listeners"). Over-counts by
+    /// design (one token per browser-install, honestly labelled "listeners").
+    /// </summary>
+    public int UniqueListeners { get; set; }
+}
+
+/// <summary>One row of the Cut release-type breakdown: a ReleaseType and how many Cut releases have it.</summary>
+public class CutReleaseTypeCount
+{
+    public ReleaseType ReleaseType { get; set; }
+    public int Count { get; set; }
+}

DeepDrftModels/DTOs/PlayEventDto.cs

@@ -0,0 +1,18 @@
+using DeepDrftModels.Enums;
+
+namespace DeepDrftModels.DTOs;
+
+/// <summary>
+/// Wire payload for <c>POST api/event/play</c> (Phase 16 §2.2 / §4.3). The client sends only what it
+/// cheaply knows — the track key and the client-computed completion bucket; the server resolves the
+/// release. No duration or raw position is transmitted (a privacy plus — only a coarse bucket leaves
+/// the browser). <see cref="AnonId"/> is reserved for wave 16.3 and stays null in wave 16.1.
+/// </summary>
+public class PlayEventDto
+{
+    public string? TrackEntryKey { get; set; }
+
+    public PlayBucket Bucket { get; set; }
+
+    public string? AnonId { get; set; }
+}

DeepDrftModels/DTOs/ShareEventDto.cs

@@ -0,0 +1,19 @@
+using DeepDrftModels.Enums;
+
+namespace DeepDrftModels.DTOs;
+
+/// <summary>
+/// Wire payload for <c>POST api/event/share</c> (Phase 16 §2.2 / §4.3). The popover knows the target
+/// and channel at the point of the action, so the payload is self-describing — no server-side resolution.
+/// <see cref="AnonId"/> is reserved for wave 16.3 and stays null in wave 16.1.
+/// </summary>
+public class ShareEventDto
+{
+    public ShareTargetType TargetType { get; set; }
+
+    public string? TargetKey { get; set; }
+
+    public ShareChannel Channel { get; set; }
+
+    public string? AnonId { get; set; }
+}

DeepDrftModels/DTOs/TrackDto.cs

@@ -16,6 +16,7 @@ public class TrackDto : BaseModel
     public string TrackName { get; set; } = string.Empty;
     public string? OriginalFileName { get; set; }
     public int TrackNumber { get; set; } = 1;
+    public double? DurationSeconds { get; set; }
     public long? ReleaseId { get; set; }
     public ReleaseDto? Release { get; set; }
 }

DeepDrftModels/DTOs/WaveformStatusDto.cs

@@ -1,10 +1,11 @@
 namespace DeepDrftModels.DTOs;
 
 /// <summary>
-/// Per-track waveform profile status for the CMS PreProcessing panel. Tells admins which tracks
-/// already carry a stored loudness profile and which predate the WaveformSeeker feature and need
-/// backfilling. <see cref="HasProfile"/> is the existence check; <see cref="EntryKey"/> is the
-/// vault key used to trigger generation for a missing profile.
+/// Per-track waveform datum status for the CMS PreProcessing panel. Tells admins which tracks already
+/// carry each stored datum and which need backfilling. <see cref="HasProfile"/> is the 512-bucket
+/// player-bar profile; <see cref="HasHighRes"/> is the duration-derived high-res visualizer datum
+/// (phase-12 §5 — every track now carries one). <see cref="EntryKey"/> is the vault key used to trigger
+/// generation for either missing datum.
 /// </summary>
 public class WaveformStatusDto
 {
@@ -12,4 +13,5 @@ public class WaveformStatusDto
     public string EntryKey { get; set; } = string.Empty;
     public string TrackName { get; set; } = string.Empty;
     public bool HasProfile { get; set; }
+    public bool HasHighRes { get; set; }
 }

DeepDrftModels/DeepDrftModels.csproj

@@ -7,8 +7,8 @@
     </PropertyGroup>
 
     <ItemGroup>
-      <PackageReference Include="Cerebellum.NetBlocks" Version="10.3.30" />
-      <PackageReference Include="Cerebellum.BlazorBlocks.Models" Version="10.3.30" />
+      <PackageReference Include="Cerebellum.NetBlocks" Version="10.3.32" />
+      <PackageReference Include="Cerebellum.BlazorBlocks.Models" Version="10.3.35" />
     </ItemGroup>
 
 </Project>

DeepDrftModels/Entities/PlayCounter.cs

@@ -0,0 +1,28 @@
+namespace DeepDrftModels.Entities;
+
+/// <summary>
+/// Incremental rollup of play counts per track (Phase 16 §4.1 / D6). One row per track, bumped inside
+/// the same transaction that appends the <see cref="PlayEvent"/> — no background aggregation job. The
+/// home card and per-target reads sum these instead of <c>COUNT(*)</c>-ing the event log on every
+/// landing. Release totals are <em>derived</em> (D4) by summing the counters of the release's tracks,
+/// so there is no separate release-counter row — this keeps the rollup normalized at one row per track.
+/// </summary>
+public class PlayCounter
+{
+    public long Id { get; set; }
+
+    /// <summary>The track these counts belong to (SQL id). Unique — one counter row per track.</summary>
+    public long TrackId { get; set; }
+
+    /// <summary>Count of plays that ended in the <c>Partial</c> bucket (&lt; 30%).</summary>
+    public long PartialCount { get; set; }
+
+    /// <summary>Count of plays that ended in the <c>Sampled</c> bucket (30%–80%).</summary>
+    public long SampledCount { get; set; }
+
+    /// <summary>Count of plays that ended in the <c>Complete</c> bucket (&gt; 80%).</summary>
+    public long CompleteCount { get; set; }
+
+    /// <summary>Total plays for the track — the sum of the three bucket counts (headline figure).</summary>
+    public long TotalPlays => PartialCount + SampledCount + CompleteCount;
+}

DeepDrftModels/Entities/PlayEvent.cs

@@ -0,0 +1,36 @@
+using DeepDrftModels.Enums;
+
+namespace DeepDrftModels.Entities;
+
+/// <summary>
+/// Append-only log row for one recorded play (Phase 16 §4.2). Written once at session close, after the
+/// engagement floor is crossed; never updated or deleted. Deliberately NOT a <c>BaseEntity</c>: events
+/// have no soft-delete lifecycle, no <c>UpdatedAt</c> — they are immutable facts. The release link is
+/// resolved server-side from the track key at write time (§2.3 / D4) and stored here so release-total
+/// plays are a cheap sum over this column.
+/// </summary>
+public class PlayEvent
+{
+    public long Id { get; set; }
+
+    /// <summary>The played track's vault entry key (the only target the client sends).</summary>
+    public required string TrackEntryKey { get; set; }
+
+    /// <summary>
+    /// The owning release's SQL id, resolved from <see cref="TrackEntryKey"/> at write time. Null when
+    /// the track is loose (no release) or the key did not resolve to a live track at write time.
+    /// </summary>
+    public long? ReleaseId { get; set; }
+
+    /// <summary>The completion bucket computed client-side from the high-water fraction (§1a / D1).</summary>
+    public PlayBucket Bucket { get; set; }
+
+    /// <summary>
+    /// Anonymous listener token (Phase 16 §3, wave 16.3). Reserved nullable; nothing writes it in wave
+    /// 16.1 — the client sends none and the column stays NULL. Wave 16.3 lights it up for the
+    /// distinct-listener count.
+    /// </summary>
+    public string? AnonId { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+}

DeepDrftModels/Entities/ShareEvent.cs

@@ -0,0 +1,34 @@
+using DeepDrftModels.Enums;
+
+namespace DeepDrftModels.Entities;
+
+/// <summary>
+/// Append-only log row for one recorded share (Phase 16 §4.2). Written once per share action that
+/// survives the per-(target,channel) client debounce; never updated or deleted. Like <see cref="PlayEvent"/>
+/// it is deliberately NOT a <c>BaseEntity</c> — an immutable fact with no soft-delete lifecycle. Shares
+/// carry their target directly (the popover knows track vs. release), so no server-side resolution step.
+/// </summary>
+public class ShareEvent
+{
+    public long Id { get; set; }
+
+    /// <summary>Whether the share targets a track or a release.</summary>
+    public ShareTargetType TargetType { get; set; }
+
+    /// <summary>
+    /// The shared target's key: a track's vault <c>EntryKey</c> or a release's public <c>EntryKey</c>,
+    /// selected by <see cref="TargetType"/>. Stored as the opaque key, not resolved to a SQL id — the
+    /// share metric is a simple per-target tally and needs no join in wave 16.1.
+    /// </summary>
+    public required string TargetKey { get; set; }
+
+    /// <summary>The channel the share was performed through (link vs. embed).</summary>
+    public ShareChannel Channel { get; set; }
+
+    /// <summary>
+    /// Anonymous listener token (Phase 16 §3, wave 16.3). Reserved nullable; unused in wave 16.1.
+    /// </summary>
+    public string? AnonId { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+}

DeepDrftModels/Entities/TrackEntity.cs

@@ -15,6 +15,10 @@ public class TrackEntity : BaseEntity, IEntity
     public required string TrackName { get; set; }
     public string? OriginalFileName { get; set; }
     public int TrackNumber { get; set; } = 1;
+    // Audio runtime in seconds, extracted by the processor at upload (AudioBinary.Duration) and
+    // persisted here so aggregate queries (e.g. total mix runtime) read it from SQL rather than the
+    // vault. Nullable: rows that predate this column are valid until the one-time backfill populates them.
+    public double? DurationSeconds { get; set; }
     public long? ReleaseId { get; set; }
     public ReleaseEntity? Release { get; set; }
 }

DeepDrftModels/Enums/PlayBucket.cs

@@ -0,0 +1,26 @@
+using System.Text.Json.Serialization;
+
+namespace DeepDrftModels.Enums;
+
+/// <summary>
+/// Completion bucket for a recorded play (Phase 16 §1a / D1). The three buckets are exhaustive and
+/// non-overlapping, classified by the high-water playback fraction reached before the session closed:
+/// <c>Partial</c> [0, 30%), <c>Sampled</c> [30%, 80%], <c>Complete</c> (80%, 100%]. The headline
+/// "Plays" figure is the sum of all three — every started listen that crosses the engagement floor
+/// is a play; the buckets are the texture beneath it.
+///
+/// Serialized as its string name on the wire — the converter on the type makes the
+/// client to proxy to API JSON contract string-based regardless of host serializer config.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<PlayBucket>))]
+public enum PlayBucket
+{
+    /// <summary>Reached &lt; 30% of duration — a skip or a brief partial listen (still past the floor).</summary>
+    Partial,
+
+    /// <summary>Reached 30%–80% of duration — a real listen that was neither a skip nor a finish.</summary>
+    Sampled,
+
+    /// <summary>Reached &gt; 80% of duration — effectively a finished listen.</summary>
+    Complete
+}

DeepDrftModels/Enums/ShareChannel.cs

@@ -0,0 +1,33 @@
+using System.Text.Json.Serialization;
+
+namespace DeepDrftModels.Enums;
+
+/// <summary>
+/// The channel a share was performed through (Phase 16 §1b). Today both originate from
+/// <c>SharePopover</c>'s clipboard actions; a future native/Web-Share button would add a channel
+/// without reshaping the metric. Serialized as its string name on the wire.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<ShareChannel>))]
+public enum ShareChannel
+{
+    /// <summary>Copy-link — the canonical track or release URL placed on the clipboard.</summary>
+    Link,
+
+    /// <summary>Copy-embed — the <c>&lt;iframe&gt;</c> snippet for the single-track FramePlayer.</summary>
+    Embed
+}
+
+/// <summary>
+/// What a share targets (Phase 16 §1b). Tracks and releases are both shareable; the popover knows
+/// which it is at the point of the action, so no server-side resolution is needed for shares.
+/// Serialized as its string name on the wire.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<ShareTargetType>))]
+public enum ShareTargetType
+{
+    /// <summary>The share targets a single track, addressed by its vault <c>EntryKey</c>.</summary>
+    Track,
+
+    /// <summary>The share targets a release, addressed by its public <c>EntryKey</c>.</summary>
+    Release
+}

DeepDrftPublic.Client/CLAUDE.md

@@ -10,39 +10,72 @@ All interactive UI for the site. Blazor WebAssembly. Pages, controls, the stream
 
 ## Actual structure
 
-- `Pages/`: Routable components. `Home.razor` (hero/about), `TracksView.razor` (track gallery with pagination/sorting), `TrackDetail.razor` (single-track detail view with cover, metadata, play affordance), `SessionDetail.razor` (session detail — hero-dominant overlay composition rendered via `<ReleaseHeroOverlay>`: large background hero image with darkening gradient shim, cover thumbnail + title + play button overlaid near the hero's bottom, genre/date/share overlaid at the top; uses `MudContainer MaxWidth="Large"`; **does not compose `ReleaseDetailScaffold`** — `PlayTrack` is wired directly in its own `@code` block), `MixDetail.razor` (mix detail — composes `ReleaseDetailScaffold` with `TopRowCenter` controls + `TopRightAction` lava-lamp; hero+meta rendered via `<ReleaseHeroOverlay Class="mix-hero">` in the scaffold's `Hero` slot with `ShowHeader="false"` suppressing the duplicate masthead; square ~600px cover-as-background with metadata overlaid). **No demo pages** (`Counter.razor`, `Weather.razor` do not exist).
-- `Layout/`: `MainLayout.razor` (root layout, wraps in `AudioPlayerProvider`, hosts theme switcher), `DeepDrftMenu.razor` (branded menu bar), `NavMenu.razor` (nav list), `Pages.cs` (centralised nav index — `MenuPages` for header, `AllPages` for exhaustive list).
+- `Pages/`: Routable components. `Home.razor` (hero/about), `SessionDetail.razor` (session detail — hero-dominant overlay composition rendered via `<ReleaseHeroOverlay>`: large background hero image with darkening gradient shim, cover thumbnail + title + play button overlaid near the hero's bottom, genre/date/share overlaid at the top; uses `MudContainer MaxWidth="Large"` with `.dd-detail-fill` so the ambient visualizer reads full-screen and the footer is pushed below the fold; **does not compose `ReleaseDetailScaffold`** — `PlayTrack` is wired directly in its own `@code` block; mounts `<WaveformVisualizer>` ambient engine + `<WaveformVisualizerControlPopover>` directly; **Phase 20:** top action row carries `<TheaterModeToggle Available="ShowTheaterToggle" />` immediately left of the lava-lamp popover in a `.dd-detail-top-actions` cluster — the toggle only appears when this page's release is the one currently playing (`ShowTheaterToggle` from `ReleaseDetailBase` folds in the subsystem gate + release-playing check); hero overlay and `<ReleaseDescription>` are wrapped in a `.dd-theater-collapsible` / `.dd-theater-collapsible-inner` pair that gets `.dd-theater-collapsed` when `IsContentHidden` is true — eased collapse via `grid-template-rows: 1fr → 0fr` + `opacity` + `visibility` (no hard `@if` pop); renders `<ReleaseDescription>` below the hero for the release's description blurb), `MixDetail.razor` (mix detail — composes `ReleaseDetailScaffold` with `TopRightAction` lava-lamp `<WaveformVisualizerControlPopover>`; hero+meta rendered via `<ReleaseHeroOverlay Class="mix-hero">` in the scaffold's `Hero` slot with `ShowHeader="false"` suppressing the duplicate masthead; square ~600px cover-as-background with metadata overlaid; full-bleed `<WaveformVisualizer>` is the mode-A centerpiece mounted by the page directly; the foreground container carries `.dd-detail-fill`; renders `<ReleaseDescription>` below the hero for the release's description blurb; **Phase 20:** `TopRightAction` slot holds `<TheaterModeToggle Available="ShowTheaterToggle" />` + lava-lamp popover in a `.dd-detail-top-actions` cluster — toggle only appears when this Mix is the playing release; hero overlay and description are wrapped in `.dd-theater-collapsible` / `.dd-theater-collapsed` eased collapse driven by `IsContentHidden`), `CutDetail.razor` (album detail — composes `ReleaseDetailScaffold` with the `Ambient` slot carrying `<WaveformVisualizer>` + `<WaveformVisualizerControlPopover>` for mode-B ambient layer; the scaffold is wrapped in a `.dd-detail-fill` div; renders `<ReleaseDescription>` below the hero for the release's description blurb; each track row carries a per-track `<SharePopover EntryKey="@track.EntryKey" />` aligned far-right as the last flex child of `.cut-detail-track-row`; **Phase 20:** `TopRightAction` slot holds `<TheaterModeToggle Available="ShowTheaterToggle" />` + lava-lamp popover in a `.dd-detail-top-actions` cluster — toggle only appears when this Cut is the playing release; header and track-list body are each wrapped in a `.dd-theater-collapsible` / `.dd-theater-collapsed` eased collapse driven by `IsContentHidden`, replacing the prior hard `@if`), `FramePlayer.razor` (embeddable iframe player at `/FramePlayer`, uses `EmbedLayout`; two mutually-exclusive modes via query params: `TrackEntryKey` stages a single track as before; `ReleaseEntryKey` resolves the release's ordered tracks via `FramePlayerViewModel`, stages track 0 via `PlayerService.StageTrack`, and arms the queue via `Queue.Arm` — no JS interop in either path, so both run safely during prerender; the first play gesture in `AudioPlayerBar` routes through `Queue.Start()` which streams the current track and clears the armed state; release embeds expose queue skip-prev/next navigation in the player bar while single-track embeds show none; track-title links open in a new tab so the iframe keeps playing). **No demo pages** (`Counter.razor`, `Weather.razor` do not exist).
+- `Layout/`: `MainLayout.razor` (root layout, wraps in `AudioPlayerProvider`, hosts theme switcher), `DeepDrftMenu.razor` (branded menu bar), `NavMenu.razor` (nav list), `Pages.cs` (centralised nav index — `MenuPages` for header, `AllPages` for exhaustive list), `DeepDrftFooter.razor` (site footer — logo, nav links, copyright; contains a "Privacy" button that opens a screen-centered tinted modal via `MudOverlay` (`DarkBackground="true"`, `Modal="true"`) carrying the anonymous-listener privacy note; trigger-button styling in the co-located `DeepDrftFooter.razor.css`, overlay chrome in the global `deepdrft-styles.css`; follows the `QueueOverlay`/`WaveformVisualizerControlPopover` `MudOverlay` idiom — scrim-click closes, panel stops propagation).
 - `Controls/`: Reusable components.
   - `TrackCard.razor`: Individual track display (image, name, artist, album, genre, release date). Play/pause icon controlled via `IsPaused` parameter.
   - `TracksGallery.razor`: Responsive grid of `TrackCard` items (MudBlazor `MudGrid` with breakpoints). Fully controlled by parent; derives active-track state from cascaded player service.
   - `AppNavLink.razor`: Nav link with active-page highlight.
   - `AudioPlayerProvider.razor`: Cascading host for `IStreamingPlayerService`. Everything inside it gets the player via `[CascadingParameter]`.
-  - `StreamNowButton.razor`: Reusable streaming-trigger button. Fetches a random track, warms the AudioContext (Safari gesture requirement), and starts streaming via `IStreamingPlayerService`. Accepts `ButtonClass` and `ButtonLabel` for distinct visual presentations; `OnStreamStarted` EventCallback for post-stream side effects (e.g., mobile menu close).
-  - `AudioPlayerBar.razor`: Dock UI at the bottom (play/pause/seek/volume).
-  - `AudioPlayerBar/PlayerControls.razor`: Play/pause/stop buttons in the transport zone. Renders via `<PlayStateIcon>`.
+  - `StreamNowButton.razor`: Reusable streaming-trigger button. Fetches a random track, warms the AudioContext (Safari gesture requirement), and starts streaming — routes through `IQueueService.PlayTrack` (deque PLAY semantics) when the queue cascade is present, falls back to `IStreamingPlayerService.SelectTrackStreaming` when absent. Accepts `ButtonClass` and `ButtonLabel` for distinct visual presentations; `OnStreamStarted` EventCallback for post-stream side effects (e.g., mobile menu close).
+  - `AudioPlayerBar.razor`: Dock UI at the bottom (play/pause/seek/volume). In Fixed (embed) mode, renders an always-shown read-only queue panel below the controls when `ShowFixedPanel && _fixedPanelOpen` (release embeds only; single-track embeds stay panel-free). The Queue button in Fixed mode toggles `_fixedPanelOpen` and triggers a `postHeight` call via `embed-frame.ts` so the host page can resize the outer iframe. TypeScript counterpart for the resize handshake: `DeepDrftPublic/Interop/embed/embed-frame.ts` — reads `EmbedId` from `window.location.search`, exports `postHeight(element)` which measures the player element and posts `{type:"deepdrft-embed-resize", height, embedId?}` to `window.parent`; no-ops when not framed (compiled output gitignored). **Phase 20:** injects `WaveformVisualizerControlState` and subscribes to `Changed` (added alongside the existing `IPlayerService.StateChanged` subscription — same reference-guard + dispose pattern); mounts `<NowShowingPanel Release="CurrentTrack.Release" />` above the transport controls when `CurrentTrack?.Release is not null` — the panel is kept **always mounted** whenever a release is playing and wrapped in the shared `.dd-theater-collapsible` / `.dd-theater-collapsible-inner` pair; it gets `.dd-theater-collapsed` when Theater Mode is OFF, so the bar grows/shrinks via the same eased collapse that the detail-page content regions use rather than popping via `@if` (Phase 20 Wave 2).
+  - `AudioPlayerBar/PlayerControls.razor`: Play/pause/stop buttons in the transport zone. Renders via `<PlayStateIcon>`. In embedded (`Fixed`) mode, skip-previous and skip-next render when `!Fixed || HasPrevious || HasNext` — so a release embed (which has a queue) shows forward/back navigation while a single-track embed (no queue) hides them; the Stop button is hidden in all embed contexts (`!Fixed` only).
+  - `AudioPlayerBar/TrackMetaLabel.razor`: Now-playing track-title + artist row. Takes `[Parameter] bool Fixed` (passed from `AudioPlayerBar.razor`). When `Fixed` (embedded iframe), the track-title anchor renders with `target="_blank" rel="noopener noreferrer"` so clicking it opens the release detail page in a new tab; the docked (non-embedded) player keeps same-tab nav. When no release is attached the title renders unlinked in both modes.
+  - `AudioPlayerBar/NowShowingPanel.razor`: Phase 20 "now showing" presentational band rendered by `AudioPlayerBar` **only when** `VisualizerControlState.TheaterMode && CurrentTrack?.Release is not null`. Carries the release identity the hidden detail page would otherwise show: cover art thumbnail (`deepdrft-track-detail-cover-art` / `deepdrft-gradient-soft-secondary` placeholder), release title linked via `ReleaseRoutes.DetailHref(Release)`, and a release-mode `SharePopover` (`ReleaseEntryKey` + `ReleaseMedium`) wrapped in `.dd-accent-icon`. `[Parameter, EditorRequired] ReleaseDto Release` — non-null by the bar's mount gate. Purely presentational: owns no player logic, no Theater state, and no data fetch. Layout CSS lives in `AudioPlayerBar.razor.css` (`.now-showing` / `.now-showing-cover` / `.now-showing-cover-art` / `.now-showing-cover-placeholder` / `.now-showing-title-link` / `.now-showing-title` / `.now-showing-share`); all surface/text binds `--deepdrft-page-*` theme-aware aliases — no new dark overrides.
   - `AudioPlayerBar/PlayStateIcon.razor`: Icon button encapsulating service subscription + transport-state icon selection. Injects `IPlayerService`, subscribes to `StateChanged`, calls `PlaybackIcons.Resolve()` to determine icon and active state.
   - `AudioPlayerBar/LevelMeterFab.razor`: Floating-action button replacing the static FAB in the minimized dock. Renders a continuous vertical fill inside the music-note silhouette that tracks live audio level (0–100%), with fixed three-zone gradient (green 0–60%, yellow 60–85%, orange 85–100%). Note silhouette always visible at 25% opacity; idle when paused/stopped. Reuses spectrum-callback infrastructure.
   - `SpectrumVisualizer.razor`: Bar-graph spectrum display, driven by `getSpectrumData` JS callback.
   - `ReleaseHeroOverlay.razor`: Shared presentational overlay shell consumed by both `SessionDetail` and `MixDetail`. Renders a background-image hero region with genre/date/share overlaid at the top and title/artist/play at the bottom. Parameters: `HeroImageKey`, `PlaceholderIcon`, `CoverThumbKey` (optional cover thumb in bottom row), `Title`, `Artist`, `Genre`, `ReleaseDate`, `ShareContent` (slot), `PlayContent` (slot), `Class` (per-page aspect/sizing override). Owns no player logic or data fetch; each consuming page passes its own play and share slots. Overlay shell is plain `<div>`s; background-image surface is a `<div class="release-hero-img">` (no `MudPaper`).
-  - `MixVisualizerControls.razor`: Eight-knob RadialKnob control bar for the Mix detail lava-lamp visualizer. Controls (in order): waveform scroll speed, color gradient rotation speed, lava gravity, lava heat, fluid amount, fluid viscosity (cohesion), collision strength, waveform width. `[Parameter] bool Visible` — the host always renders this component and feeds the lava-lamp toggle into `Visible`; the knobs are `@if`-gated on `Visible` while the container holds a reserved `min-height` so content below never pops when the lamp toggles. Owns no JS interop: mutates the injected `MixVisualizerControlState` and raises `Changed`; the backdrop bridge (`MixWaveformVisualizer`) subscribes and pushes each changed dial to the WebGL module. No control is a seek surface (read-only contract).
+  - `ReleaseDescription.razor`: Shared presentational blurb block for release detail pages. Renders a header row (mono uppercase eyebrow label "Notes" in `.deepdrft-release-description-label` + thin horizontal divider in `.deepdrft-release-description-rule`, inside `.deepdrft-release-description-header`) above the release's short `Description` paragraph (`.deepdrft-release-description-text`, display-serif weight 300), all wrapped in `.deepdrft-release-description`, placed just below the hero/header. The header row mirrors the home page's `.section-label`/`.divider-line` motif. Purely presentational — owns no data fetch or player wiring. A null/whitespace `Description` renders nothing at all (no block, no divider, no whitespace artifact; the guard lives here so every consumer gets it for free). Parameter: `Description` (`string?`).
+  - `WaveformVisualizer.razor`: The single WebGL2 lava-lamp visualizer engine. Hosts the waveform of whatever track is currently playing/selected. Three hosting modes: mode A (Mix detail — full-bleed centerpiece), mode B (Cut/Session detail — ambient layer behind hero+content via `ReleaseDetailScaffold`'s `Ambient` slot), mode C (NowPlaying hero panel — full-bleed background for the home hero's right side, mounted by `NowPlaying.razor` inside `.np-visualizer-bg`). `[Parameter] bool Fill` switches from fixed-viewport positioning to container-relative sizing (CSS-only; the renderer is identical in both modes). The bridge resolves the current track's `EntryKey` and re-fetches the high-res datum on track change. Subscribes to `WaveformVisualizerControlState.Changed` and pushes each updated dial to the WebGL module via JS interop. Follows the live playing track (keys on host `TrackId` match OR shared host `ReleaseEntryKey`).
+  - `WaveformVisualizerControls.razor`: The waveform visualizer control panel (content hosted by `WaveformVisualizerControlPopover`). Phase 15 re-layout: a deterministic **three-row sectioned layout** encoding the visualizer's two subsystems. Row 1 (MODE, always visible): two iconographic lamp toggles (lava on/off, waveform on/off) left-aligned + collisions knob (conditional — only when both subsystems on) + color knob pinned far-right. Row 2 (LAVA, visible only when `LavaEnabled`): "LAVA:" section label + Gravity / Heat / FluidAmount / FluidViscosity knobs. Row 3 (WAVE, visible only when `WaveformEnabled`): "WAVE:" section label + scroll-speed `MudSlider` (not a knob) + width knob pinned far-right. Total: two lamp toggles, seven `RadialKnob`s, one `MudSlider`. Colour principle: lamp toggles / knob arcs / slider are green (`Color.Primary` — interactive); section labels / knob caption icons are light (static). Each control has a playful `MudTooltip`. `[Parameter] bool PanelChrome` scopes panel chrome (NowPlayingCard look — square corners, lighter-navy, thin border) to the popover mount; chrome classes live in the global `deepdrft-styles.css` (CSS isolation cannot reach portaled overlay content). `[Parameter] bool Visible` gates the rows via `@if` while the container holds reserved min-height. Owns no JS interop: mutates the injected `WaveformVisualizerControlState` and raises `Changed`. No control is a seek surface (read-only contract).
+  - `WaveformVisualizerControlPopover.razor`: Pairs the lava-lamp icon button with `WaveformVisualizerControls` as a **screen-centered tinted modal** (Phase 15). The primitive is `MudOverlay` (`DarkBackground="true"`, `Modal="true"`) — **not** `MudPopover`; `AnchorOrigin`/`TransformOrigin` parameters do not exist (a centered modal has no anchor). Clicking the lava-lamp icon opens the overlay; clicking the scrim closes it (knob-drag-safe: `RadialKnob`'s `position:fixed` capture div sits above the scrim during a drag, so releasing outside the panel never fires the close handler). The panel stops click propagation so an inside click is not a dismissal. `[Parameter] Size IconSize` controls the trigger-icon size (default `Large`). This is the unit every host places — one icon anywhere gives the full control panel centered on screen, regardless of where the icon sits. Placed identically on Mix, Cut, Session, and the NowPlaying hero panel (full parity; in NowPlaying it sits in `.np-visualizer-controls` at the panel's top-right corner, not inside `NowPlayingCard`).
+  - `TheaterModeToggle.razor`: Phase 20 Theater-Mode toggle button. Visible only when `Available && (State.LavaEnabled || State.WaveformEnabled)` — no visualizer subsystem active → no theater to enter; `Available` is false when this page's release is not the one currently playing (Phase 20 Wave 2). Disabled until interactive (`!RendererInfo.IsInteractive`), same guard as Play and the lava-lamp trigger. On click: flips `WaveformVisualizerControlState.TheaterMode` and calls `NotifyChanged()`. Shows an on/off `aria-pressed` active state. Glyph: Material `Theaters`. `.dd-accent-icon` container gives the green-accent glyph in both themes with zero new CSS — same treatment as `WaveformVisualizerControlPopover`. Subscribes to `State.Changed` in `OnInitialized` and unsubscribes on `Dispose` to re-render when another observer (e.g. `CoerceTheaterMode()`) flips the state. `[Parameter] Size IconSize` (default `Large`) matches the adjacent lava-lamp trigger. `[Parameter] bool Available` (default `true`) — the page passes its `ShowTheaterToggle` predicate here so the toggle is scoped to the playing release; surfaces with no release-scoping pass the default `true`. Placed **immediately left** of the lava-lamp popover on all three detail pages inside a `.dd-detail-top-actions` cluster.
+  - `WaveformZoomMapping.cs`: Maps the `WaveformVisualizerControlState.Resolution` fraction to an integer zoom level for the WebGL renderer.
+  - `NowPlayingCard.razor`: Home-page text panel showing the currently playing track (label, title, sub-line). Renders label/"Now Playing" dot, track name, and artist·release sub-line from the cascaded `IStreamingPlayerService`. Subscribes to `IPlayerService.StateChanged` in `OnParametersSet` (reference-guarded, idempotent) and unsubscribes on dispose to re-render on track/state change. No visualizer or popover; those moved to `NowPlaying.razor`.
+  - `NowPlayingStats.razor`: Home hero stat row. Three cards: Studio Cuts (total Cut-medium track count + zero-suppressed per-`ReleaseType` Cut release breakdown), Mixes (`MixReleaseCount` labelled "Sets" + `hh:mm` total mix runtime via `RuntimeFormat`), and Plays (live `TotalPlays` odometer in `.hero-stat-odometer` + `UniqueListeners` "N listeners" secondary line via `.hero-stat-sub` — Phase 16 wave 16.5). All three cards read from the same `HomeStatsDto` round-trip; no extra fetch path. Fetches via `IStatsDataService` on init; bridges the prerender fetch across the WASM seam with `PersistentComponentState` (persists only on a successful load, matching the medium-browse bridge pattern). Implements `IDisposable` to release the `PersistingComponentStateSubscription`.
+  - `NowPlaying.razor`: Owns the home hero's right-side panel (`.now-playing-panel` — the outer wrapper formerly called `.hero-right` in `Home.razor`). Mounts `<WaveformVisualizer Fill="true">` as a full-bleed background inside `.np-visualizer-bg`, `<WaveformVisualizerControlPopover>` in `.np-visualizer-controls` (top-right corner), the three pulsing `.circle-deco` rings, and the content layer (hosts `<NowPlayingCard>` + `<NowPlayingStats>`). `Home.razor`'s `MudItem` renders `<NowPlaying />` directly with no wrapper. Subscribes to `IPlayerService.StateChanged` in `OnParametersSet` (reference-guarded, idempotent) and unsubscribes on dispose — needed because the player cascade is `IsFixed` (the provider's own re-render does not reach `NowPlaying`), so the subscription is the only way to re-render and re-propagate `ReleaseEntryKey`/`TrackId`/`TrackEntryKey` into `<WaveformVisualizer>` when the playing track changes.
+  - `QueueList.razor`: Shared presentational queue-list component (Phase 17 wave 17.1). Renders `Items` as an ordered list with the current track marked; `Editable` flag gates drag-reorder handles (drag handle icon + `MudDropContainer`/`MudDropZone` for reorder) and per-row remove controls. The remove (×) control is suppressed on the currently-playing row (`Editable && !isCurrent`) — the current track cannot be removed via the UI (wave 17.2; reorder of the current row is still permitted). When not editable, renders a plain `<div>` — the read-only state for the embed's fixed-order shared queue. Reorder, remove, and row-jump are surfaced to the parent as `EventCallback<(int FromIndex, int ToIndex)> OnReorder`, `EventCallback<int> OnRemove`, and `EventCallback<int> OnJump`; the component calls no `IQueueService` method itself (purely presentational, no data fetch, no player wiring). Both view modes (docked overlay 17.2, embedded panel 17.3) consume this single component differing only in hosting context and the `Editable` flag. Runs during prerender without JS interop (drag work is client-only and inert when no drag occurs).
+  - `QueueOverlay.razor`: Screen-centered tinted modal hosting the docked-player editable queue (Phase 17 wave 17.2). Borrows the `WaveformVisualizerControlPopover` `MudOverlay` idiom (`DarkBackground="true"`, `Modal="true"`): the panel stops click propagation; scrim-click closes the overlay; drag-safe (the panel's capture div sits above the scrim during a drag so releasing outside the panel never fires the close handler). Auto-closes when a removal empties the queue. Hosts `QueueList` in `Editable="true"` mode. Opened/closed by the Queue toggle button in `PlayerTransportZone` (shown only when `!Fixed && Items.Count > 0`; `QueueMusic` glyph, active state when open).
+  - `AddToQueueButton.razor`: Append-only Add-to-Queue button shared across detail-page play sites (Phase 17 wave 17.4). Two modes: track mode (calls `IQueueService.Enqueue` with a single `TrackDto`) and release mode (calls `IQueueService.EnqueueRange` with an ordered track list). Material `PlaylistAdd` glyph; tooltip "Add to queue" (track mode) / "Add release to queue" (release mode). Reads the cascaded `IQueueService`; disabled until interactive or when the cascade is absent. Append-only — does not play, does not navigate. Placed at: `CutDetail` header (release mode, `TrackNumber`-ordered list), `CutDetail` track rows (track mode), `SessionDetail` hero play (track mode), `MixDetail` hero play (track mode). Excluded from `StreamNowButton` (OQ9) and `ReleaseGallery` cards (OQ10, deferred).
+  - `ReleaseDetailScaffold.razor`: Shared scaffold for release detail pages. Gained an optional `Ambient` `RenderFragment` slot (Phase 12) — a full-bleed layer rendered behind the main content. Absent slot = no regression. Cut mounts `<WaveformVisualizer>` + `<WaveformVisualizerControlPopover>` here; Mix uses its own full-bleed mount outside the scaffold. The scaffold's default masthead PLAY (`PlayTrack`) routes through `IQueueService.PlayTrack` (deque PLAY semantics — prepends the track to the queue front) when the queue cascade is present, falling back to `IStreamingPlayerService.SelectTrackStreaming` when absent; toggle-pause is handled directly via `IStreamingPlayerService.TogglePlayPause` when this track is already active.
+  - `SharePopover.razor`: Share affordance serving both track and release surfaces from one clipboard/popover-chrome source. **Track mode** (`EntryKey` set): copies the track's canonical URL and offers an iframe embed snippet pointing at `FramePlayer?TrackEntryKey=…`. **Release mode** (`ReleaseEntryKey` + `ReleaseMedium` set): copies the release's canonical detail URL (via `ReleaseRoutes.DetailHref`) and offers an iframe embed snippet pointing at `FramePlayer?ReleaseEntryKey=…`, which queues and auto-advances through the release's tracks on first play. Both modes offer the embed affordance — release mode no longer suppresses it. The iframe snippet is built by `EmbedSnippetBuilder`. A transient "Copied!" confirmation resets after a short delay.
+  - `SeoHead.razor`: Purely presentational SEO head emitter (Phase 22). Renders a `<PageTitle>` + `<HeadContent>` block from a single `SeoModel` parameter — standard meta (description, robots), canonical, Open Graph, Twitter Card, and schema.org JSON-LD. Owns no data fetch; each page wires it in one line and supplies the model from its already-bridged ViewModel state. Wired on Home, About, Cut/Session/Mix detail (incl. not-found branches → `noindex`), browse views, and the 404 page.
 - `Helpers/`: Utilities and mapper functions.
   - `PlaybackIcons.cs`: Static `Resolve(isPlaying, isPaused, trackId, currentTrackId)` method — the sole glyph-mapping source for transport icons across all surfaces. Returns `(Icon, IsActive, IsPaused)` tuple.
+  - `RuntimeFormat.cs`: Static `ToHoursMinutes(double totalSeconds)` helper. Formats a seconds value as `h:mm` (hours not zero-padded, minutes always two digits). Negative / non-finite inputs return `"0:00"`. Used by `NowPlayingStats` for the mix runtime figure.
+  - `EmbedSnippetBuilder.cs`: Static helper that builds the iframe embed snippet the share popover copies. Two targets diverge in height and content (Phase 17 wave 17.3): `ForTrack(baseUri, trackEntryKey)` → compact `<iframe>` at 196 px (no queue panel, no script, unchanged from before 17.3). `ForRelease(baseUri, releaseEntryKey)` → taller `<iframe>` at 384 px plus a host-side `<script>` resize listener; mints a fresh random token per call (8 hex chars from `Guid.NewGuid().ToString("N")[..8]`) used as the iframe id (`deepdrft-embed-{token}`) and threaded into the iframe src as `&EmbedId={token}` — the in-iframe `embed-frame.ts` reads this token and includes it in `postMessage` payloads so the host listener can route resize messages to the correct iframe when multiple release embeds share a host page. The script matches on `embedId` and applies `iframe.style.height`; degrades safely (panel still works inside the iframe) if the host strips the script. Pure string composition — unit-testable without rendering. TypeScript counterpart: `DeepDrftPublic/Interop/embed/embed-frame.ts` (compiled output gitignored).
 - `Services/`: Audio player + dark-mode services.
   - `IPlayerService` / `IStreamingPlayerService`: Contracts exposed to UI.
   - `AudioPlayerService`: Abstract base (lifecycle, initialise, select track, play/pause/stop/seek/volume).
   - `StreamingAudioPlayerService`: Production implementation. Chunked stream from `TrackMediaClient`, adaptive 16–64 KB buffer, early-playback, **seek-beyond-buffer** via offset request to the content API.
   - `AudioInteropService`: JS interop wrapper over `window.DeepDrftAudio`. Manages `DotNetObjectReference` lifetimes for progress, end-of-playback, spectrum callbacks.
   - Dark-mode services: `DarkModeServiceBase` (cookie name constant), `DarkModeCookieService` (JS cookie read/write).
-  - `MixVisualizerControlState`: Scoped session-persistent holder for the Mix visualizer's **eight** control positions: `ScrollSpeed`, `GradientRotationSpeed`, `LavaGravity`, `LavaHeat`, `FluidAmount` (wax count/volume), `FluidViscosity` (cohesion — the second half of the Phase 10 "bubbles" split; `BlobDensity` is gone), `CollisionStrength`, `WaveformWidth`. Each has a matching `Default*` const. `Changed` event is the decoupling seam — controls mutate state + raise `Changed`; the bridge (`MixWaveformVisualizer`) subscribes and pushes the affected uniform. Scoped DI so state survives SPA nav within a session and resets on fresh page load.
+  - `WaveformVisualizerControlState`: Scoped session-persistent holder for the visualizer's **eight** continuous control positions, **two subsystem on/off toggles** (Phase 15), and one **Theater-Mode flag** (Phase 20): `ScrollSpeed`, `GradientRotationSpeed`, `LavaGravity`, `LavaHeat`, `FluidAmount` (wax count/volume), `FluidViscosity` (cohesion — the second half of the Phase 10 "bubbles" split; `BlobDensity` is gone), `CollisionStrength`, `WaveformWidth`, `LavaEnabled` (bool, default `true`), `WaveformEnabled` (bool, default `true`), `TheaterMode` (bool, default `false` — `DefaultTheaterMode`). Each has a matching `Default*` const. `Changed` event is the decoupling seam — controls mutate state + raise `Changed`; the bridge (`WaveformVisualizer`) subscribes and pushes the affected uniform or subsystem-enable; the Theater observers (the three detail pages and `AudioPlayerBar`) subscribe to react to `TheaterMode`. **`CoerceTheaterMode()`**: enforces the invariant that Theater Mode cannot remain on when both subsystems are off — called from `WaveformVisualizerControls.ToggleLava`/`ToggleWaveform` **before** `NotifyChanged()` so all observers see a consistent, coerced state in the same `Changed` cycle. `TheaterMode` is a page-chrome presentation flag; the visualizer bridge ignores it. Scoped DI so state survives SPA nav within a session and resets on fresh page load. **Phase 20 Wave 2 — playing-release predicates** live in `ReleaseDetailBase` / `CutDetailBase` (not in this state holder): `IsThisReleasePlaying` (`PlayerService?.CurrentTrack?.Release?.EntryKey == EntryKey`), `IsContentHidden` (`TheaterMode && IsThisReleasePlaying`), `ShowTheaterToggle` (`(LavaEnabled || WaveformEnabled) && IsThisReleasePlaying`). Both base classes also subscribe to `IStreamingPlayerService.StateChanged` (idempotent, reference-guarded, disposed) so the predicates re-evaluate live when playback moves between releases.
+  - `PlayTracker`: Per-session play-session tracker (Phase 16 wave 16.1). Opens on playback start, advances a high-water position on each progress tick (from `StreamingAudioPlayerService` — not the HTTP layer, so seek-beyond-buffer re-fetches are the same play), closes on track-switch / stop / organic-end / page-unload. Engagement floor: ≥3 s OR ≥5% of duration. Three-bucket classification (`partial`/`sampled`/`complete`). Emits at most one event per session via `IPlayEventSink`. No player or JS dependency — testable against a fake sink.
+  - `ShareTracker`: Per-session share tracker (Phase 16 wave 16.1). Called by `SharePopover` after a successful clipboard write; applies a 60-second per-(target, channel) debounce. Sends via `BeaconInterop`. Scoped so debounce memory resets on fresh page load. **Wave 16.3:** injects `IAnonIdProvider`; attaches `_anonId.Current` to `ShareEventDto.AnonId` (omitted when null).
+  - `BeaconInterop`: `navigator.sendBeacon` JS interop wrapper (Phase 16 wave 16.1). Fires JSON payloads to `api/event/{play,share}` fire-and-forget. Also wires a page-unload handler that flushes any pending play event when the page is torn down.
+  - `BeaconPlayEventSink`: Production `IPlayEventSink` (Phase 16 wave 16.1). Serializes the play classification and fires it via `BeaconInterop` to `api/event/play`. Synchronous (`EmitPlay` cannot await — it is called from the player close path and the page-unload handler). **Wave 16.3:** injects `IAnonIdProvider`; reads `_anonId.Current` synchronously at emit time and sets `PlayEventDto.AnonId` (omitted when null via `WhenWritingNull`).
+  - `IAnonIdProvider` / `AnonIdProvider`: Wave 16.3 anonymous-listener id seam. `IAnonIdProvider` exposes `string? Current` (synchronous cached read, safe on the unload path) and `ValueTask EnsureLoadedAsync()` (warms the cache from `localStorage` via `window.DeepDrftAnonId.get` JS interop — idempotent, never throws). `AnonIdProvider` is the production implementation; degrades to null when `localStorage` is unavailable (private mode / blocked storage). The token itself outlives the session in `localStorage`; the in-process cache is scoped (resets on fresh page load). Callers warm the cache when going interactive, then read `Current` synchronously on the close/unload path with no extra JS hop. TypeScript interop: `DeepDrftPublic/Interop/telemetry/anonid.ts` (mints GUID on first visit, returns null without throwing when storage is unavailable).
+  - `IQueueService` / `QueueService`: **Two-level deque** orchestrator above the single-slot player. The deque has two entry ends. **PLAY (manual)** enters the FRONT: `PlayTrack(track)` and `PlayRelease(tracks, startIndex)` prepend the played track/release in order, **remove the previously-current track**, make the new front current, start streaming it, and leave whatever sat after the old current intact behind the prepend (a whole release prepends in order in one op). The detail pages (Cut header/row, Session/Mix hero) and `StreamNowButton` route their PLAY through these. **Add-to-queue** enters the BACK: `Enqueue`/`EnqueueRange` append to the end without interrupting the current track (`AddToQueueButton`). `Next`/`Previous` advance or step back, walking `CurrentIndex` and leaving played tracks behind so `Previous` can reach them; `JumpTo(index)` moves the pointer to a queued row and streams it once (the playlist panel's row-jump — it does NOT prepend or stream the intervening rows). **End-of-track:** auto-advance (`TrackEnded`) advances when there is a next track; when the **last** track ends naturally the queue **empties** and goes dormant (bug #2) rather than stranding the finished track. `Clear` empties the queue. **Bug #3 (dormant-seed):** the first `Enqueue`/`EnqueueRange` into a dormant queue while a track is already playing externally (via the attached player, not through the queue) seeds the head with that now-playing track and then appends — yielding `[now-playing, added]` (even when adding the same track). The queue learns the externally-playing track through the existing `Attach(player)` seam (`_player.CurrentTrack`) — no new dependency, no `IServiceProvider`. **Armed-idle state** (prerender-safe release embeds): `Arm(tracks)` replaces the queue at index 0 with no JS interop; `IsArmed` signals armed-but-not-streaming; `Start()` streams the current track and clears `IsArmed`. `AudioPlayerBar` reads `IsArmed` to route the embed's first play gesture through `Start()`. `QueueChanged` fires on all list/position changes; cascaded via `AudioPlayerProvider`. `Move`/`RemoveAt` are interop-free reorder/remove mutations that adjust `CurrentIndex` and never re-stream. `ClearUpcoming()` keeps the current track and drops the up-next. **Bug #4 (reactivity):** `AudioPlayerBar.QueueItems` caches `QueueService.Items` as a `_queueItemsCache` snapshot (the service exposes its backing list by reference); the cache is invalidated and set to `null` in `OnQueueChanged`, so every real mutation hands `QueueList` a new list reference while frequent progress-tick re-renders reuse the cached one without allocating. `QueueList.OnParametersSet` calls `_dropContainer?.Refresh()` so the `MudDropContainer` re-reads the new list and the open panel re-flows immediately. **Bug #1 (label):** the docked `QueueOverlay` panel header reads **"Playlist"** (the current track stays listed). `PlayRelease` materializes `tracks.ToList()` before mutating so it can never alias the service's own `Items` list.
 - `Clients/`: HTTP API clients (both target DeepDrftAPI).
   - `TrackClient`: SQL metadata API. Uses named `IHttpClientFactory` client `"DeepDrft.API"`. Sends `page` param (not `pageNumber`). Deserializes response as bare `PagedResult<TrackDto>` (not wrapped in ApiResultDto envelope).
   - `TrackMediaClient`: Content API. Uses named `IHttpClientFactory` client `"DeepDrft.Content"`. Methods like `GetAudioStreamAsync(trackId, byteOffset?)` → `Stream` with optional Range header support for seek-beyond-buffer.
+  - `StatsClient`: Home stats API. Uses named `IHttpClientFactory` client `"DeepDrft.API"`. Single method `GetHomeStats()` → `ApiResult<HomeStatsDto>` (calls `GET api/stats/home`; response is a bare DTO, no `ApiResultDto` envelope). Registered scoped; consumed via `IStatsDataService`.
+- `Services/ITrackDataService`: Contract used by the visualizer bridge and other consumers. Includes `GetTrackWaveform(entryKey)` → high-res `WaveformProfileDto` (calls `GET api/track/{entryKey}/waveform/high-res`); used by `WaveformVisualizer` to re-fetch the datum on track change.
+- `Services/IStatsDataService` / `StatsClientDataService`: Home-stats read abstraction. `IStatsDataService.GetHomeStats()` → `ApiResult<HomeStatsDto>`. `StatsClientDataService` is the single implementation (delegates to `StatsClient`); registered scoped. Components inject `IStatsDataService` so they do not branch on render mode — mirrors `IReleaseDataService`.
 - `ViewModels/`: Component state.
   - `TracksViewModel`: Scoped. Holds current page, page size, sort column, descending flag. `SetPage(pageNumber)` calls `TrackClient.GetPageAsync` and updates. Registered in `Startup.ConfigureDomainServices`.
   - `TrackDetailViewModel`: Scoped. Holds loaded track, loading flag, not-found flag. `Load(entryKey)` fetches via `ITrackDataService` and resets all flags per call (prevents cross-navigation bleed). Registered in `Startup.ConfigureDomainServices`.
+  - `FramePlayerViewModel`: Scoped. Resolves the ordered track list for a release embed (`FramePlayer?ReleaseEntryKey=…`). `Load(releaseEntryKey)` calls `IReleaseDataService.GetByEntryKey` → `release.Id` → `ITrackDataService.GetPage(sortColumn:"TrackNumber", releaseId:…)`, mirroring `CutDetailViewModel.Load` exactly so an embedded release queues the same ordered list the Cut detail page plays. Owns no playback or staging — `FramePlayer.razor` uses the loaded `Tracks` to stage and arm. Registered scoped in `Startup.ConfigureDomainServices`.
 - `Common/`: Shared utilities.
   - `DarkModeSettings.cs`: `[PersistentState]`-annotated class (single source of truth for dark mode in the client). Registered scoped.
-  - `DDIcons.cs`: Hand-rolled SVG icons (gas-lamp lit/unlit for dark mode toggle).
+  - `ReleaseRoutes.cs`: Static helper. `DetailHref(long id, ReleaseMedium)` returns the canonical public detail route for a release; consumed by Archive, AlbumsView, player bar, and TrackRedirect (11.B).
+  - `SeoModel.cs`: Typed per-page SEO input (Phase 22). Named factories: `ForRelease` (medium-dispatched — Cut → `MusicAlbum`, Session → `MusicAlbum`/`LiveAlbum`, Mix → `MusicRecording`), `ForHome`, `ForAbout`, `ForBrowse`, `ForNotFound`. Encodes the medium→schema.org mapping in one place. `SeoModel.Robots` overrides the environment-default (see `SeoEnvironment`).
+  - `SeoJsonLd.cs`: Typed schema.org JSON-LD builders (Phase 22). Types: `MusicGroup` (home/about, with `sameAs: ["https://instagram.com/deepdrft.music"]`), `MusicAlbum`/`LiveAlbum` (cuts/sessions, with ordered `MusicRecording` track list and per-release `byArtist`), `MusicRecording` (mixes, with ISO-8601 `duration`), `CollectionPage` (browse). All serialized output is inline-safe-escaped (`<`/`>`/`&` → `\uXXXX`) to prevent script-breakout from CMS-authored text.
+  - `SeoOptions.cs`: Site-wide SEO config (Phase 22). `BaseUrl` (`https://deepdrft.com`), title suffix (`Deep DRFT`, middot separator), default OG image seam (uses `ImageProxyController` route), IG handle in `sameAs`, no Twitter handle. Registered via the static `Startup` seam (both server and WASM `Program.cs`). `BaseUrl` is config, not `window.location` — no `window` at server prerender, and the origin cannot be derived reliably behind the nginx proxy.
+  - `SeoUrls.cs`: URL helpers for canonical and `og:image` construction from `SeoOptions.BaseUrl` (Phase 22).
+  - `SeoEnvironment.cs`: Scoped `[PersistentState]` bridge for the server environment flag (Phase 22). Seeded in `DeepDrftPublic/Components/App.razor` from `IWebHostEnvironment.IsProduction()` — mirrors the `DarkModeSettings` bridge pattern. Default robots is `index,follow` only in Production; `noindex,nofollow` in every non-production environment so the beta/staging site stays uncrawled. Explicit per-page `SeoModel.Robots` overrides this default. Fail-safe default is `noindex`.
 - `Program.cs`: WASM entry point. Calls `Startup.ConfigureApiHttpClient`, `ConfigureContentServices`, `ConfigureDomainServices`.
 - `_Imports.razor`: Global using statements and component imports.
 
@@ -98,10 +131,12 @@ New modules in `DeepDrftPublic/Interop/audio/`:
 - `DarkModeServiceBase`: Holds the cookie name constant (`"darkMode"`).
 - `DarkModeCookieService`: Reads/writes the cookie via JS (`document.cookie` interop). Calls `DarkModeSettings.IsDarkMode = value` when the cookie changes or user toggles the button.
 - Server-side `DarkModeService` (in `DeepDrftPublic`, **not here**): Reads the cookie during prerender, seeds the `DarkModeSettings` instance, rounds it through `PersistentComponentState` to the client.
-- `MainLayout.razor`: Wraps entire layout in `CascadingValue` of `DarkModeSettings`, so all children see the current dark-mode state. The dark-mode toggle button (hand-rolled lit/unlit gas-lamp icon from `DDIcons.cs`) calls `DarkModeCookieService.ToggleDarkModeAsync()`.
+- `MainLayout.razor`: Wraps entire layout in `CascadingValue` of `DarkModeSettings`, so all children see the current dark-mode state. The dark-mode toggle button (hand-rolled lit/unlit gas-lamp icon from `DeepDrftShared.Client/Common/DDIcons.cs`) calls `DarkModeCookieService.ToggleDarkModeAsync()`.
 
 The flow ensures the first paint uses the correct theme (no flash), and toggling the button persists the setting to a 365-day cookie.
 
+**`SeoEnvironment` follows the same `[PersistentState]` bridge pattern** (Phase 22). It is seeded server-side in `DeepDrftPublic/Components/App.razor` from `IWebHostEnvironment.IsProduction()` and bridged to the WASM client. Consumers (`SeoHead`) read `SeoEnvironment.IsProduction` to gate the default robots directive (`index,follow` in Production, `noindex,nofollow` elsewhere). The pattern is identical to `DarkModeSettings` — one server-side seed, one `PersistentComponentState` round-trip, one scoped client read.
+
 ## MVVM convention
 
 Component state lives in ViewModels (registered scoped in DI). Components render and dispatch only.
@@ -113,7 +148,23 @@ Component state lives in ViewModels (registered scoped in DI). Components render
 
 - Bespoke `PaletteLight` / `PaletteDark` defined inline in `MainLayout.razor` (MudBlazor theme objects).
 - CSS classes prefixed `deepdrft-` live in `DeepDrftPublic/wwwroot/styles/deepdrft-styles.css` (shared across server and client).
-- Custom SVG icons: `Common/DDIcons.cs` (hand-rolled gas-lamp, etc.).
+- Custom SVG icons: `DeepDrftShared.Client/Common/DDIcons.cs` (hand-rolled gas-lamp, lava-lamp, etc. — shared across public and CMS surfaces).
+
+### Interactive-accent icons (`.dd-accent-icon` / `.dd-accent-fill`)
+
+Green-accent interactive icon affordances (Play / Share / Add-to-Queue / lava-lamp trigger, etc.) use a **single reusable treatment** in `deepdrft-styles.css`, not per-site dark overrides. Wrap the affordance(s) in a container carrying `.dd-accent-icon`; the rule colours the inner `.mud-icon-root` glyph green-accent (`--deepdrft-green-accent`, the brand constant — same value in both palettes) in **both** themes. Add `.dd-accent-fill` to the same container when it also holds a filled `Color.Secondary` `MudButton` whose fill must go green-accent in **dark** (dark-only — light already renders green fill + white text).
+
+Two reasons this is needed and why it's a class, not a palette colour: (1) no MudBlazor `Color` enum is green in both themes (`Dark.Secondary` is off-white), so palette-only solutions can't express "green in both"; (2) MudBlazor stamps the standalone rule `.mud-secondary-text { color: …secondary !important }` (0,1,0) on the glyph `<svg>`, so wrapper-level overrides never reach it — the reusable rule targets `.dd-accent-icon .mud-icon-button .mud-icon-root` (0,3,0) `!important`, which beats it on specificity alone; source order is not load-bearing for the glyph clause. The Session/Mix release-detail hero Share/Play glyphs use this class too: they were already green-accent in light (via `Color.Secondary` → `Light.Secondary`), so folding them in keeps light pixel-identical while fixing the dark over-image glyphs — they are not actually theme-divergent. **Add new green-accent icon affordances by applying this class, not by spawning a new dark override.**
+
+**Self-themed components are authoritative over `.dd-accent-icon`.** `PlayStateIcon` owns its glyph colour inside `.icon-container` and must beat a surrounding `.dd-accent-icon` in dark — its scoped CSS rule targets `.mud-icon-root` at (0,5,0) `!important` (after Blazor's scope attribute is applied), which outranks the consolidation rule's (0,3,0) `!important`. Do not wrap a `PlayStateIcon` in `.dd-accent-icon` expecting to recolor its play-chip glyph — the play chip always shows navy (`--deepdrft-play-glyph`) against the moss-green chip in dark.
+
+**Layout-only cluster class: `.dd-detail-top-actions`.** When two or more icon affordances sit together in a top-action row (e.g. the Theater toggle + lava-lamp popover on the three detail pages), wrap them in `.dd-detail-top-actions` — a layout-only `display:flex; align-items:center; gap:0.25rem` class in `deepdrft-styles.css`. No colour; prevents the `SpaceBetween` row from spreading the icons apart. Each affordance inside still carries its own `.dd-accent-icon` wrapper independently.
+
+**Full-screen detail body: `.dd-detail-fill`.** Phase 20 Wave 2. Applied to each detail page's foreground content container (the `<div>` or `<MudContainer>` that wraps the scaffold/hero); sets `min-height: calc(100vh - var(--deepdrft-nav-height, 88px))` so the ambient/full-bleed visualizer reads as genuinely full-screen and the site footer is pushed below the fold, independent of Theater Mode. Reuses `--deepdrft-nav-height` (88px desktop / 72px mobile) so the clearance tracks the nav bar height across breakpoints; no new layout token. Defined in `deepdrft-styles.css`.
+
+**Eased Theater Mode collapse: `.dd-theater-collapsible` / `.dd-theater-collapsed`.** Phase 20 Wave 2. Used wherever Theater Mode should ease content in/out rather than pop via `@if`. The outer wrapper carries `.dd-theater-collapsible` (always present); its single direct child carries `.dd-theater-collapsible-inner`; adding `.dd-theater-collapsed` to the outer collapses the region. Technique: `grid-template-rows: 1fr → 0fr` (real-height interpolation), `opacity`, and `visibility: hidden` + `transition-behavior: allow-discrete` (visibility flip deferred to end of ease-out so collapsed content is removed from the tab order once the animation completes; immediately re-shown on expand). A `prefers-reduced-motion` block collapses instantly. Used on the release content regions in all three detail pages (`IsContentHidden` predicate) and on the player-bar `NowShowingPanel` band (collapsed when `!TheaterMode`). Defined in `deepdrft-styles.css`.
+
+**Gas-lamp toggle is self-colored in its SVG.** `DDIcons.GasLampLit` (dark-mode icon) carries `fill="#2A5C4F"` directly on its frame path — no CSS colour override is needed. The former dark nav rule (`.deepdrft-theme-dark .dd-nav-actions .mud-icon-button`) has been removed as dead. `DDIcons.GasLamp` (light-mode icon) continues to use `currentColor` and inherits nav text colour in light (the unlit toggle is theme-divergent by design).
 
 ## Development commands
 

DeepDrftPublic.Client/Clients/ReleaseClient.cs

@@ -83,27 +83,4 @@ public class ReleaseClient
             ? ApiResult<ReleaseDto>.CreatePassResult(release)
             : ApiResult<ReleaseDto>.CreateFailResult("Failed to deserialize response");
     }
-
-    /// <summary>
-    /// Fetches the high-res waveform datum for a Mix release, addressed by its public EntryKey. A 404
-    /// means no datum is stored (not yet generated, or not a Mix) — a valid state, so it returns a pass
-    /// result with a null value. Any other non-success status is a genuine failure.
-    /// </summary>
-    public async Task<ApiResult<WaveformProfileDto?>> GetMixWaveform(string entryKey)
-    {
-        var response = await _http.GetAsync($"api/release/{Uri.EscapeDataString(entryKey)}/mix/waveform");
-
-        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
-            return ApiResult<WaveformProfileDto?>.CreatePassResult(null);
-
-        if (!response.IsSuccessStatusCode)
-            return ApiResult<WaveformProfileDto?>.CreateFailResult($"HTTP {(int)response.StatusCode}");
-
-        var json = await response.Content.ReadAsStringAsync();
-        var profile = JsonSerializer.Deserialize<WaveformProfileDto>(json, JsonOptions);
-
-        return profile is not null
-            ? ApiResult<WaveformProfileDto?>.CreatePassResult(profile)
-            : ApiResult<WaveformProfileDto?>.CreateFailResult("Failed to deserialize response");
-    }
 }

DeepDrftPublic.Client/Clients/StatsClient.cs

@@ -0,0 +1,39 @@
+using DeepDrftModels.DTOs;
+using NetBlocks.Models;
+using System.Text.Json;
+
+namespace DeepDrftPublic.Client.Clients;
+
+/// <summary>
+/// HTTP client for the public stats read surface. Uses the named <c>"DeepDrft.API"</c> client like
+/// <see cref="TrackClient"/> and <see cref="ReleaseClient"/>: on WASM it points at the public host and
+/// proxies through <c>StatsProxyController</c>; on SSR prerender it points directly at DeepDrftAPI. The
+/// route is an unauthenticated read; the response deserializes as a bare DTO (no ApiResultDto envelope),
+/// matching the API's <c>Ok(value)</c> shape.
+/// </summary>
+public class StatsClient
+{
+    private static readonly JsonSerializerOptions JsonOptions = new() { PropertyNameCaseInsensitive = true };
+
+    private readonly HttpClient _http;
+
+    public StatsClient(IHttpClientFactory httpClientFactory)
+    {
+        _http = httpClientFactory.CreateClient("DeepDrft.API");
+    }
+
+    public async Task<ApiResult<HomeStatsDto>> GetHomeStats()
+    {
+        var response = await _http.GetAsync("api/stats/home");
+
+        if (!response.IsSuccessStatusCode)
+            return ApiResult<HomeStatsDto>.CreateFailResult($"HTTP {(int)response.StatusCode}");
+
+        var json = await response.Content.ReadAsStringAsync();
+        var stats = JsonSerializer.Deserialize<HomeStatsDto>(json, JsonOptions);
+
+        return stats is not null
+            ? ApiResult<HomeStatsDto>.CreatePassResult(stats)
+            : ApiResult<HomeStatsDto>.CreateFailResult("Failed to deserialize response");
+    }
+}

DeepDrftPublic.Client/Clients/TrackClient.cs

@@ -129,6 +129,33 @@ public class TrackClient
             : ApiResult<List<GenreSummaryDto>>.CreateFailResult("Failed to deserialize response");
     }
 
+    /// <summary>
+    /// Fetches the per-track high-res waveform datum, addressed by the track's EntryKey (phase-12 §5b).
+    /// A 404 means no high-res datum is stored (a track not yet backfilled) — a valid state, so it
+    /// returns a pass result with a null value and the visualizer blanks gracefully. Any other
+    /// non-success status is a genuine failure.
+    /// </summary>
+    public async Task<ApiResult<WaveformProfileDto?>> GetTrackWaveform(string trackEntryKey)
+    {
+        var response = await _http.GetAsync($"api/track/{Uri.EscapeDataString(trackEntryKey)}/waveform/high-res");
+
+        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+            return ApiResult<WaveformProfileDto?>.CreatePassResult(null);
+
+        if (!response.IsSuccessStatusCode)
+            return ApiResult<WaveformProfileDto?>.CreateFailResult($"HTTP {(int)response.StatusCode}");
+
+        var json = await response.Content.ReadAsStringAsync();
+        var profile = JsonSerializer.Deserialize<WaveformProfileDto>(json, new JsonSerializerOptions
+        {
+            PropertyNameCaseInsensitive = true
+        });
+
+        return profile is not null
+            ? ApiResult<WaveformProfileDto?>.CreatePassResult(profile)
+            : ApiResult<WaveformProfileDto?>.CreateFailResult("Failed to deserialize response");
+    }
+
     public async Task<ApiResult<TrackDto>> GetTrack(string entryKey)
     {
         var response = await _http.GetAsync($"api/track/meta/by-key/{Uri.EscapeDataString(entryKey)}");

DeepDrftPublic.Client/Common/SeoEnvironment.cs

@@ -0,0 +1,33 @@
+using Microsoft.AspNetCore.Components;
+
+namespace DeepDrftPublic.Client.Common;
+
+/// <summary>
+/// Environment-gated robots bridge (Phase 22 remediation §4). The beta/staging site is web-hosted and must
+/// not be crawled, so the <i>default</i> robots directive is environment-gated: <c>index,follow</c> only in
+/// Production, <c>noindex,nofollow</c> everywhere else. A per-page <see cref="SeoModel.Robots"/> override
+/// still wins — this only sets the default.
+///
+/// <para>
+/// Crawlers read the server-prerendered HTML, so correctness lives in the server prerender pass — but the
+/// value must be identical across the InteractiveAuto double render (AC6), so the WASM pass has to resolve
+/// the same flag. The WASM assembly has no <c>IWebHostEnvironment</c> (config comes from the server). This
+/// mirrors the DarkMode bridge exactly: a scoped service the server seeds during prerender (from
+/// <c>IWebHostEnvironment.IsProduction()</c>) and <c>[PersistentState]</c> rounds to the client, so both
+/// passes resolve the identical value. <c>SeoHead</c> injects this rather than an environment dependency,
+/// honouring the no-environment-in-the-component constraint.
+/// </para>
+/// </summary>
+public class SeoEnvironment
+{
+    /// <summary>
+    /// True only in Production. Seeded server-side and persisted across the WASM boot. Defaults to
+    /// <c>false</c> so the fail-safe is "do not index" — a missing bridge never accidentally opens a
+    /// non-production site to crawlers.
+    /// </summary>
+    [PersistentState]
+    public bool IsProduction { get; set; }
+
+    /// <summary>The environment-gated default robots directive. Explicit page values override this.</summary>
+    public string DefaultRobots => IsProduction ? "index,follow" : "noindex,nofollow";
+}

DeepDrftPublic.Client/Common/SeoJsonLd.cs

@@ -0,0 +1,127 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DeepDrftPublic.Client.Common;
+
+/// <summary>
+/// Typed schema.org JSON-LD nodes (Phase 22, OQ5 — the typed-builder option). Each record mirrors one
+/// schema.org type; <see cref="SeoJsonLd.Serialize"/> renders a node to the <c>&lt;script type="application/ld+json"&gt;</c>
+/// body. Keeping the shape in C# (not hand-written JSON in pages) is what makes the medium→type mapping
+/// live in one place (DRY, §4.3) and the output unit-testable (AC5) rather than a manual validator pass.
+///
+/// <para>
+/// All nodes share <see cref="JsonLdNode"/> so the <c>@context</c>/<c>@type</c> pair serialises first and
+/// once. Null properties are omitted (the serializer ignores nulls) so partial data never emits an empty
+/// or broken node (C6/AC4).
+/// </para>
+/// </summary>
+public static class SeoJsonLd
+{
+    private static readonly JsonSerializerOptions Options = new()
+    {
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+        // schema.org keys are PascalCase ("@type", "byArtist", "datePublished"); JsonPropertyName drives
+        // each. Encoder relaxed so the JSON sits inline in HTML without over-escaping apostrophes etc.
+        // Note: the relaxed encoder leaves <, >, & raw — InlineSafe re-escapes exactly those before the
+        // body is injected into the <script> element. See Serialize.
+        Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
+        WriteIndented = false,
+    };
+
+    /// <summary>
+    /// Renders a node to its compact JSON-LD script body. The host component wraps it in the script tag.
+    /// The body is run through <see cref="InlineSafe"/> so CMS-authored values containing
+    /// <c>&lt;/script&gt;</c> or <c>&lt;</c> cannot break out of the inline script element (XSS).
+    /// </summary>
+    public static string Serialize<TNode>(TNode node) where TNode : JsonLdNode =>
+        InlineSafe(JsonSerializer.Serialize(node, node.GetType(), Options));
+
+    /// <summary>
+    /// Escapes the three characters that can break out of an inline <c>&lt;script type="application/ld+json"&gt;</c>
+    /// element. Replacing <c>&lt;</c>/<c>&gt;</c>/<c>&amp;</c> with their <c>\uXXXX</c> JSON escapes keeps the
+    /// JSON byte-for-byte equivalent on parse (a JSON string treats <c><</c> and <c>&lt;</c> identically)
+    /// while making <c>&lt;/script&gt;</c> impossible to emit raw — the documented safe pattern for inline JSON-LD.
+    /// </summary>
+    internal static string InlineSafe(string json) => json
+        .Replace("<", "\\u003C")
+        .Replace(">", "\\u003E")
+        .Replace("&", "\\u0026");
+}
+
+/// <summary>Base for every schema.org node: emits <c>@context</c> and <c>@type</c> first.</summary>
+public abstract record JsonLdNode
+{
+    [JsonPropertyName("@context")]
+    [JsonPropertyOrder(-2)]
+    public string Context => "https://schema.org";
+
+    [JsonPropertyName("@type")]
+    [JsonPropertyOrder(-1)]
+    public abstract string Type { get; }
+}
+
+/// <summary>The Deep DRFT collective entity — the home/about node.</summary>
+public sealed record MusicGroupNode : JsonLdNode
+{
+    [JsonPropertyName("@type")] public override string Type => "MusicGroup";
+
+    [JsonPropertyName("name")] public string Name { get; init; } = string.Empty;
+    [JsonPropertyName("url")] public string? Url { get; init; }
+    [JsonPropertyName("genre")] public string? Genre { get; init; }
+    [JsonPropertyName("description")] public string? Description { get; init; }
+    [JsonPropertyName("logo")] public string? Logo { get; init; }
+    [JsonPropertyName("sameAs")] public IReadOnlyList<string>? SameAs { get; init; }
+}
+
+/// <summary>A studio cut or a live session release. <c>AlbumProductionType</c> distinguishes them.</summary>
+public sealed record MusicAlbumNode : JsonLdNode
+{
+    [JsonPropertyName("@type")] public override string Type => "MusicAlbum";
+
+    [JsonPropertyName("name")] public string Name { get; init; } = string.Empty;
+    [JsonPropertyName("byArtist")] public ArtistRef? ByArtist { get; init; }
+
+    /// <summary>schema.org <c>MusicAlbumProductionType</c> URI, e.g. <c>StudioAlbum</c> or <c>LiveAlbum</c>.</summary>
+    [JsonPropertyName("albumProductionType")] public string? AlbumProductionType { get; init; }
+
+    [JsonPropertyName("datePublished")] public string? DatePublished { get; init; }
+    [JsonPropertyName("genre")] public string? Genre { get; init; }
+    [JsonPropertyName("image")] public string? Image { get; init; }
+    [JsonPropertyName("url")] public string? Url { get; init; }
+
+    /// <summary>Ordered list of the album's recordings (cut track list, in TrackNumber order).</summary>
+    [JsonPropertyName("track")] public IReadOnlyList<MusicRecordingNode>? Track { get; init; }
+}
+
+/// <summary>A single recording — a mix release, or one track inside an album's <c>track</c> list.</summary>
+public sealed record MusicRecordingNode : JsonLdNode
+{
+    [JsonPropertyName("@type")] public override string Type => "MusicRecording";
+
+    [JsonPropertyName("name")] public string Name { get; init; } = string.Empty;
+    [JsonPropertyName("byArtist")] public ArtistRef? ByArtist { get; init; }
+
+    /// <summary>ISO-8601 duration (e.g. <c>PT1H2M3S</c>) from <c>DurationSeconds</c>.</summary>
+    [JsonPropertyName("duration")] public string? Duration { get; init; }
+
+    [JsonPropertyName("genre")] public string? Genre { get; init; }
+    [JsonPropertyName("image")] public string? Image { get; init; }
+    [JsonPropertyName("url")] public string? Url { get; init; }
+}
+
+/// <summary>A browse/index surface listing releases (cuts/sessions/mixes/archive).</summary>
+public sealed record CollectionPageNode : JsonLdNode
+{
+    [JsonPropertyName("@type")] public override string Type => "CollectionPage";
+
+    [JsonPropertyName("name")] public string Name { get; init; } = string.Empty;
+    [JsonPropertyName("description")] public string? Description { get; init; }
+    [JsonPropertyName("url")] public string? Url { get; init; }
+}
+
+/// <summary>A nested <c>byArtist</c> reference — the collective as a MusicGroup, by name.</summary>
+public sealed record ArtistRef
+{
+    [JsonPropertyName("@type")] public string Type => "MusicGroup";
+    [JsonPropertyName("name")] public string Name { get; init; } = string.Empty;
+}

DeepDrftPublic.Client/Common/SeoModel.cs

@@ -0,0 +1,209 @@
+using DeepDrftModels.DTOs;
+using DeepDrftModels.Enums;
+
+namespace DeepDrftPublic.Client.Common;
+
+/// <summary>
+/// The OG <c>og:type</c> for a page. Releases map per medium (§3.4); everything else is a website.
+/// </summary>
+public enum SeoOgType
+{
+    Website,
+    MusicAlbum,
+    MusicSong,
+}
+
+/// <summary>
+/// The typed per-page SEO input (Phase 22). A page hands <c>SeoHead</c> one model instead of ~15 loose
+/// parameters; the named factories below encode the per-page / per-medium mapping (title, description,
+/// canonical path, og:type, JSON-LD node) in exactly one place each (DRY, §4.1/§4.2). The factories are
+/// pure functions over DTOs the page already holds — unit-testable without rendering.
+///
+/// <para>
+/// <see cref="CanonicalPath"/> is site-relative; <c>SeoHead</c> absolutises it against
+/// <see cref="SeoOptions.BaseUrl"/>. Release pages pass <see cref="ReleaseRoutes.DetailHref"/> so the
+/// canonical is the dedicated route regardless of alias/query routes (AC7). A null cover means the model
+/// carries no <see cref="ImagePath"/> and <c>SeoHead</c> falls back to the default OG image (C6/AC4).
+/// </para>
+/// </summary>
+public sealed record SeoModel
+{
+    /// <summary>Bare page title, no site suffix. <c>SeoHead</c> composes <c>"{Title} · {suffix}"</c>.</summary>
+    public required string Title { get; init; }
+
+    /// <summary>Meta/OG description. Null falls back to <see cref="SeoOptions.DefaultDescription"/>.</summary>
+    public string? Description { get; init; }
+
+    /// <summary>Site-relative canonical path. Null defaults to the current path in <c>SeoHead</c>.</summary>
+    public string? CanonicalPath { get; init; }
+
+    /// <summary>Relative cover <c>ImagePath</c>. Null → the default OG image.</summary>
+    public string? ImagePath { get; init; }
+
+    public SeoOgType OgType { get; init; } = SeoOgType.Website;
+
+    /// <summary>Robots directive. Null falls back to <see cref="SeoOptions.DefaultRobots"/>.</summary>
+    public string? Robots { get; init; }
+
+    /// <summary>Pre-serialised JSON-LD script body, or null to emit no structured-data script.</summary>
+    public string? JsonLd { get; init; }
+
+    // --- Music-vertical OG, release pages only (null elsewhere → tags omitted) ---
+    public string? Artist { get; init; }
+    public DateOnly? ReleaseDate { get; init; }
+    public double? DurationSeconds { get; init; }
+
+    // ------------------------------------------------------------------ Factories
+
+    /// <summary>Home page: the collective entity (MusicGroup JSON-LD), site-level OG.</summary>
+    public static SeoModel ForHome(SeoOptions options) => new()
+    {
+        Title = "Electronic Music Collective",
+        Description = options.DefaultDescription,
+        CanonicalPath = "/",
+        OgType = SeoOgType.Website,
+        JsonLd = SeoJsonLd.Serialize(MusicGroup(options)),
+    };
+
+    /// <summary>About page: the collective again, with the bio lede as description.</summary>
+    public static SeoModel ForAbout(SeoOptions options) => new()
+    {
+        Title = "The Collective",
+        Description =
+            "Two people, many hats. Deep DRFT brings the heart and soul of Midwest deep house to " +
+            "Charleston — informed by the founders of the style, and promising to push it forward.",
+        CanonicalPath = "/about",
+        OgType = SeoOgType.Website,
+        JsonLd = SeoJsonLd.Serialize(MusicGroup(options) with
+        {
+            Description =
+                "Two people, many hats. Deep DRFT brings the heart and soul of Midwest deep house to " +
+                "Charleston — informed by the founders of the style, and promising to push it forward.",
+        }),
+    };
+
+    /// <summary>A browse surface: <c>CollectionPage</c> JSON-LD, website OG.</summary>
+    public static SeoModel ForBrowse(SeoOptions options, ReleaseMedium? medium, string path)
+    {
+        var (title, description) = BrowseCopy(medium);
+        return new SeoModel
+        {
+            Title = title,
+            Description = description,
+            CanonicalPath = path,
+            OgType = SeoOgType.Website,
+            JsonLd = SeoJsonLd.Serialize(new CollectionPageNode
+            {
+                Name = title,
+                Description = description,
+                Url = SeoUrls.Absolute(options, path),
+            }),
+        };
+    }
+
+    /// <summary>The 404 page: no canonical, <c>noindex,follow</c>, no JSON-LD.</summary>
+    public static SeoModel ForNotFound(SeoOptions options) => new()
+    {
+        Title = "Not Found",
+        Description = options.DefaultDescription,
+        Robots = "noindex,follow",
+        OgType = SeoOgType.Website,
+    };
+
+    /// <summary>
+    /// A release detail page. The medium picks the schema (cut/session → MusicAlbum, mix → MusicRecording),
+    /// the og:type, and the music-vertical OG fields; the canonical is the dedicated route. The optional
+    /// <paramref name="tracks"/> seed the album's ordered <c>track</c> list (cut). <b>One call site, all tags.</b>
+    /// </summary>
+    public static SeoModel ForRelease(SeoOptions options, ReleaseDto release, IReadOnlyList<TrackDto>? tracks = null)
+    {
+        var canonicalPath = ReleaseRoutes.DetailHref(release.EntryKey, release.Medium);
+        var image = SeoUrls.CoverOrDefault(options, release.ImagePath);
+        // byArtist reflects the release's own artist, consistent with the music:musician OG tag (Daniel's
+        // call) — not the collective name. Album sub-recordings share it: the tracks are by this artist.
+        var artist = new ArtistRef { Name = release.Artist };
+        var description = string.IsNullOrWhiteSpace(release.Description) ? options.DefaultDescription : release.Description;
+
+        // A mix is a single recording; its duration comes from the (single) track when present.
+        var mixDurationSeconds = release.Medium == ReleaseMedium.Mix
+            ? tracks?.FirstOrDefault()?.DurationSeconds
+            : null;
+
+        JsonLdNode node = release.Medium switch
+        {
+            ReleaseMedium.Mix => new MusicRecordingNode
+            {
+                Name = release.Title,
+                ByArtist = artist,
+                Duration = SeoUrls.IsoDuration(mixDurationSeconds),
+                Genre = release.Genre,
+                Image = image,
+                Url = SeoUrls.Absolute(options, canonicalPath),
+            },
+            // Cut and Session are both albums; the production type distinguishes a live session.
+            _ => new MusicAlbumNode
+            {
+                Name = release.Title,
+                ByArtist = artist,
+                AlbumProductionType = release.Medium == ReleaseMedium.Session
+                    ? "https://schema.org/LiveAlbum"
+                    : "https://schema.org/StudioAlbum",
+                DatePublished = release.ReleaseDate?.ToString("yyyy-MM-dd"),
+                Genre = release.Genre,
+                Image = image,
+                Url = SeoUrls.Absolute(options, canonicalPath),
+                Track = AlbumTracks(options, artist, tracks),
+            },
+        };
+
+        return new SeoModel
+        {
+            Title = release.Title,
+            Description = description,
+            CanonicalPath = canonicalPath,
+            ImagePath = release.ImagePath,
+            OgType = release.Medium == ReleaseMedium.Mix ? SeoOgType.MusicSong : SeoOgType.MusicAlbum,
+            Artist = release.Artist,
+            ReleaseDate = release.ReleaseDate,
+            DurationSeconds = mixDurationSeconds,
+            JsonLd = SeoJsonLd.Serialize(node),
+        };
+    }
+
+    // The collective entity, built once from config — the home/about JSON-LD root.
+    private static MusicGroupNode MusicGroup(SeoOptions options) => new()
+    {
+        Name = options.SiteName,
+        Url = SeoUrls.Absolute(options, "/"),
+        Genre = options.Genre,
+        Description = options.DefaultDescription,
+        Logo = SeoUrls.Absolute(options, options.DefaultImageUrl),
+        SameAs = options.SameAs.Count > 0 ? options.SameAs : null,
+    };
+
+    // Ordered recording list for an album's `track` property. Null when there are no tracks so the
+    // property is omitted rather than emitting an empty array (C6).
+    private static IReadOnlyList<MusicRecordingNode>? AlbumTracks(
+        SeoOptions options, ArtistRef artist, IReadOnlyList<TrackDto>? tracks)
+    {
+        if (tracks is null || tracks.Count == 0) return null;
+
+        return tracks
+            .OrderBy(t => t.TrackNumber)
+            .Select(t => new MusicRecordingNode
+            {
+                Name = t.TrackName,
+                ByArtist = artist,
+                Duration = SeoUrls.IsoDuration(t.DurationSeconds),
+            })
+            .ToList();
+    }
+
+    private static (string Title, string Description) BrowseCopy(ReleaseMedium? medium) => medium switch
+    {
+        ReleaseMedium.Cut => ("Cuts", "Studio cuts from Deep DRFT — composed, layered, and finished."),
+        ReleaseMedium.Session => ("Sessions", "Live sessions from Deep DRFT — performances caught in the moment, unrepeatable and unedited."),
+        ReleaseMedium.Mix => ("Mixes", "DJ mixes from Deep DRFT — uninterrupted sets, one track bleeding into the next."),
+        _ => ("Archive", "The full Deep DRFT catalogue — cuts, sessions, and mixes, indexed and always expanding."),
+    };
+}