diff --git a/Cargo.lock b/Cargo.lock
index 9cd6250f..73793a6a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -212,6 +212,38 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec66320836265a59098af8343573a2160b12b8db033b6b879fa01fbcf95a50ed"
 
+[[package]]
+name = "anni-catalog"
+version = "0.1.0"
+dependencies = [
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "anni-catalog-worker"
+version = "0.1.0"
+dependencies = [
+ "anni-catalog",
+ "annim",
+ "chrono",
+ "futures-util",
+ "httpdate",
+ "reqwest 0.13.4",
+ "sea-orm",
+ "sea-orm-migration",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "unic-langid",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "anni-common"
 version = "0.2.0"
@@ -227,10 +259,28 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.18",
  "trash",
 ]
 
+[[package]]
+name = "anni-cover-worker"
+version = "0.1.0"
+dependencies = [
+ "anni-catalog",
+ "anni-ingest",
+ "futures-util",
+ "image",
+ "reqwest 0.13.4",
+ "sha2 0.10.9",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "anni-flac"
 version = "0.2.2"
@@ -263,6 +313,32 @@ dependencies = [
  "yup-oauth2",
 ]
 
+[[package]]
+name = "anni-ingest"
+version = "0.1.0"
+dependencies = [
+ "anni-metadata",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "thiserror 2.0.18",
+ "uuid",
+]
+
+[[package]]
+name = "anni-ingest-worker"
+version = "0.1.0"
+dependencies = [
+ "anni-common",
+ "anni-ingest",
+ "anni-split",
+ "sha2 0.10.9",
+ "tempfile",
+ "thiserror 2.0.18",
+ "uuid",
+ "which 8.0.4",
+]
+
 [[package]]
 name = "anni-metadata"
 version = "0.1.0"
@@ -422,12 +498,17 @@ dependencies = [
 name = "annim"
 version = "0.1.0"
 dependencies = [
+ "anni-catalog",
+ "anni-cover-worker",
+ "anni-ingest",
+ "anni-metadata",
  "anyhow",
  "async-graphql",
  "async-graphql-axum",
  "axum",
  "base64 0.22.1",
  "chrono",
+ "constant_time_eq",
  "lindera",
  "lindera-tantivy",
  "rmp-serde",
@@ -435,11 +516,16 @@ dependencies = [
  "sea-orm-migration",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
  "tantivy",
+ "thiserror 2.0.18",
  "tokio",
+ "tokio-stream",
+ "tower",
  "tower-http 0.7.0",
  "tracing",
  "tracing-subscriber",
+ "url",
 ]
 
 [[package]]
@@ -8082,6 +8168,7 @@ dependencies = [
  "futures-core",
  "pin-project-lite",
  "tokio",
+ "tokio-util",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index f2b5dd91..b46f4347 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,6 +11,11 @@ members = [
     "anni-workspace",
     "anni-playback",
     "anni-metadata",
+    "anni-catalog",
+    "anni-catalog-worker",
+    "anni-cover-worker",
+    "anni-ingest",
+    "anni-ingest-worker",
     "third_party/google-drive3",
 ]
 resolver = "3"
@@ -23,7 +28,12 @@ license = "Apache-2.0"
 
 [workspace.dependencies]
 anni-common = { version = "0.2.0", path = "./anni-common" }
+anni-catalog = { path = "./anni-catalog" }
+anni-catalog-worker = { path = "./anni-catalog-worker" }
+anni-cover-worker = { path = "./anni-cover-worker" }
+anni-ingest = { path = "./anni-ingest" }
 anni-metadata = { path = "./anni-metadata" }
+anni-split = { path = "./anni-split" }
 
 log = "0.4"
 uuid = { version = "1", features = ["v4"] }
diff --git a/anni-catalog-worker/Cargo.toml b/anni-catalog-worker/Cargo.toml
new file mode 100644
index 00000000..b96ae415
--- /dev/null
+++ b/anni-catalog-worker/Cargo.toml
@@ -0,0 +1,58 @@
+[package]
+name = "anni-catalog-worker"
+version = "0.1.0"
+publish = false
+
+edition.workspace = true
+authors.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+anni-catalog.workspace = true
+annim = { path = "../annim", default-features = false }
+chrono = "0.4.45"
+futures-util = "0.3"
+httpdate = "1.0.3"
+reqwest = { workspace = true, features = ["stream"] }
+sea-orm = { version = "1.1.20", default-features = false, features = [
+    "macros",
+    "runtime-tokio-rustls",
+    "with-chrono",
+    "with-uuid",
+] }
+sea-orm-migration = { version = "1.1.20", default-features = false, features = [
+    "runtime-tokio-rustls",
+    "with-uuid",
+] }
+serde.workspace = true
+serde_json = { workspace = true, features = ["raw_value"] }
+thiserror.workspace = true
+tokio = { version = "1", features = [
+    "macros",
+    "rt-multi-thread",
+    "signal",
+    "sync",
+    "time",
+] }
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
+unic-langid = "0.9.6"
+url = "2.5.8"
+uuid.workspace = true
+
+[features]
+default = ["postgres"]
+sqlite = [
+    "annim/sqlite",
+    "sea-orm/sqlx-sqlite",
+    "sea-orm-migration/sqlx-sqlite",
+]
+postgres = [
+    "annim/postgres",
+    "sea-orm/sqlx-postgres",
+    "sea-orm-migration/sqlx-postgres",
+]
+
+[dev-dependencies]
+tempfile = "3.27.0"
diff --git a/anni-catalog-worker/src/adapter.rs b/anni-catalog-worker/src/adapter.rs
new file mode 100644
index 00000000..a5fcf3e4
--- /dev/null
+++ b/anni-catalog-worker/src/adapter.rs
@@ -0,0 +1,244 @@
+use std::{
+    collections::{hash_map::Entry, HashMap},
+    fmt,
+    future::Future,
+    pin::Pin,
+    sync::Arc,
+    time::Duration,
+};
+
+use anni_catalog::{CatalogSourceKind, SyncCoverage};
+use annim::catalog::CatalogSyncLease;
+use thiserror::Error;
+
+pub type AdapterFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<AdapterPage, AdapterFailure>> + Send + 'a>>;
+
+/// One exact release observation returned by an adapter.
+///
+/// Neither document is normalized. `raw_document` is the source response (or
+/// the exact per-release fragment for a documented API), while
+/// `parsed_document` is the adapter's versioned interpretation.
+#[derive(Clone, PartialEq, Eq)]
+pub struct AdapterObservation {
+    pub external_release_id: String,
+    pub source_url: String,
+    pub raw_document: String,
+    pub parsed_document: String,
+}
+
+impl fmt::Debug for AdapterObservation {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AdapterObservation")
+            .field("external_release_id", &"[REDACTED]")
+            .field("source_url", &"[REDACTED]")
+            .field("raw_document_bytes", &self.raw_document.len())
+            .field("parsed_document_bytes", &self.parsed_document.len())
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct AdapterPage {
+    pub observations: Vec<AdapterObservation>,
+    /// Cursor used to fetch the next page of this same run.
+    pub next_cursor: Option<String>,
+    /// Cursor to seed a future incremental run after this run succeeds.
+    pub checkpoint: Option<String>,
+    pub coverage: SyncCoverage,
+    /// True only when the adapter has traversed the complete declared scope.
+    pub complete: bool,
+    /// Explicit safety interlock for a legitimate empty full snapshot.
+    ///
+    /// Adapters must leave this false unless the upstream response positively
+    /// proves that the complete source scope contains no releases. A parser
+    /// that merely failed to find release nodes must not set it.
+    pub empty_full_snapshot_confirmed: bool,
+}
+
+impl fmt::Debug for AdapterPage {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AdapterPage")
+            .field("observation_count", &self.observations.len())
+            .field("has_next_cursor", &self.next_cursor.is_some())
+            .field("has_checkpoint", &self.checkpoint.is_some())
+            .field("coverage", &self.coverage)
+            .field("complete", &self.complete)
+            .field(
+                "empty_full_snapshot_confirmed",
+                &self.empty_full_snapshot_confirmed,
+            )
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AdapterFailureDisposition {
+    Permanent,
+    Retryable,
+}
+
+/// Stable, persistence-safe adapter failure. Arbitrary remote error bodies,
+/// URLs, and credentials never cross this boundary.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub struct AdapterFailure {
+    code: &'static str,
+    disposition: AdapterFailureDisposition,
+    http_status: Option<u16>,
+    retry_after: Option<Duration>,
+}
+
+impl AdapterFailure {
+    pub fn permanent(code: &'static str, http_status: Option<u16>) -> Self {
+        if !valid_failure_code(code) {
+            return Self::invalid_code();
+        }
+        Self {
+            code,
+            disposition: AdapterFailureDisposition::Permanent,
+            http_status,
+            retry_after: None,
+        }
+    }
+
+    pub fn retryable(
+        code: &'static str,
+        http_status: Option<u16>,
+        retry_after: Option<Duration>,
+    ) -> Self {
+        if !valid_failure_code(code) {
+            return Self::invalid_code();
+        }
+        Self {
+            code,
+            disposition: AdapterFailureDisposition::Retryable,
+            http_status,
+            retry_after,
+        }
+    }
+
+    pub const fn code(self) -> &'static str {
+        self.code
+    }
+
+    pub const fn disposition(self) -> AdapterFailureDisposition {
+        self.disposition
+    }
+
+    pub const fn http_status(self) -> Option<u16> {
+        self.http_status
+    }
+
+    pub const fn retry_after(self) -> Option<Duration> {
+        self.retry_after
+    }
+
+    pub const fn is_retryable(self) -> bool {
+        matches!(self.disposition, AdapterFailureDisposition::Retryable)
+    }
+
+    const fn invalid_code() -> Self {
+        Self {
+            code: "invalid_adapter_failure_code",
+            disposition: AdapterFailureDisposition::Permanent,
+            http_status: None,
+            retry_after: None,
+        }
+    }
+}
+
+fn valid_failure_code(code: &str) -> bool {
+    !code.is_empty()
+        && code.len() <= 64
+        && code
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-' | b'.'))
+}
+
+impl fmt::Debug for AdapterFailure {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AdapterFailure")
+            .field("code", &self.code)
+            .field("disposition", &self.disposition)
+            .field("http_status", &self.http_status)
+            .field("retry_after", &self.retry_after)
+            .finish()
+    }
+}
+
+pub trait CatalogAdapter: Send + Sync + 'static {
+    fn source_kind(&self) -> CatalogSourceKind;
+
+    fn fetch_page<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        cursor: Option<&'a str>,
+    ) -> AdapterFuture<'a>;
+}
+
+pub trait CatalogAdapters: Send + Sync {
+    fn fetch_page<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        cursor: Option<&'a str>,
+    ) -> AdapterFuture<'a>;
+}
+
+#[derive(Clone, Default)]
+pub struct CatalogAdapterRegistry {
+    adapters: HashMap<CatalogSourceKind, Arc<dyn CatalogAdapter>>,
+}
+
+impl CatalogAdapterRegistry {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn register<A: CatalogAdapter>(&mut self, adapter: A) -> Result<(), AdapterRegistryError> {
+        let kind = adapter.source_kind();
+        match self.adapters.entry(kind) {
+            Entry::Vacant(entry) => {
+                entry.insert(Arc::new(adapter));
+                Ok(())
+            }
+            Entry::Occupied(_) => Err(AdapterRegistryError::DuplicateAdapter { kind }),
+        }
+    }
+
+    pub fn contains(&self, kind: CatalogSourceKind) -> bool {
+        self.adapters.contains_key(&kind)
+    }
+}
+
+impl CatalogAdapters for CatalogAdapterRegistry {
+    fn fetch_page<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        cursor: Option<&'a str>,
+    ) -> AdapterFuture<'a> {
+        let Some(adapter) = self.adapters.get(&lease.kind) else {
+            return Box::pin(async { Err(AdapterFailure::permanent("adapter_unavailable", None)) });
+        };
+        adapter.fetch_page(lease, cursor)
+    }
+}
+
+impl fmt::Debug for CatalogAdapterRegistry {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut kinds: Vec<_> = self.adapters.keys().copied().collect();
+        kinds.sort_by_key(|kind| kind.as_str());
+        formatter
+            .debug_struct("CatalogAdapterRegistry")
+            .field("source_kinds", &kinds)
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum AdapterRegistryError {
+    #[error("an adapter is already registered for {kind}")]
+    DuplicateAdapter { kind: CatalogSourceKind },
+}
diff --git a/anni-catalog-worker/src/apple_music.rs b/anni-catalog-worker/src/apple_music.rs
new file mode 100644
index 00000000..cb34cd78
--- /dev/null
+++ b/anni-catalog-worker/src/apple_music.rs
@@ -0,0 +1,988 @@
+//! Apple Music catalog synchronization through Apple's documented API.
+//!
+//! An Annim source maps `locator` to the numeric Apple artist ID,
+//! `storefront` to the two-letter catalog storefront, `locale` to the optional
+//! localization tag, and `secret_ref` to a developer token in the worker's
+//! secret store. The endpoint itself is not configurable: every request stays
+//! under the artist's `/albums` relationship on `api.music.apple.com`.
+//!
+//! Each album resource is retained as the exact JSON fragment received from
+//! Apple. The parsed document adds a schema-versioned envelope without
+//! normalizing any string values.
+
+use std::{
+    collections::HashSet,
+    fmt,
+    future::Future,
+    pin::Pin,
+    sync::Arc,
+    time::{Duration, SystemTime},
+};
+
+use anni_catalog::{CatalogSourceKind, SyncCoverage};
+use annim::catalog::CatalogSyncLease;
+use futures_util::StreamExt;
+use reqwest::{
+    header::{ACCEPT, CONTENT_TYPE, RETRY_AFTER},
+    redirect::Policy,
+};
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
+use thiserror::Error;
+use url::Url;
+
+use crate::{AdapterFailure, AdapterFuture, AdapterObservation, AdapterPage, CatalogAdapter};
+
+const APPLE_MUSIC_ORIGIN: &str = "https://api.music.apple.com";
+const PAGE_LIMIT: u16 = 100;
+const MAX_CURSOR_BYTES: usize = 4 * 1024;
+const MAX_SECRET_REF_BYTES: usize = 512;
+const MAX_DEVELOPER_TOKEN_BYTES: usize = 16 * 1024;
+
+pub type SecretFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<SecretValue, AdapterFailure>> + Send + 'a>>;
+
+/// Resolves a private value by reference inside the worker process.
+///
+/// Annim persists only `secret_ref`; the developer token never enters the
+/// catalog database or the GraphQL API.
+pub trait SecretResolver: Send + Sync + 'static {
+    fn resolve<'a>(&'a self, secret_ref: &'a str) -> SecretFuture<'a>;
+}
+
+/// An Apple Music developer token with redacted formatting.
+#[derive(Clone, PartialEq, Eq)]
+pub struct SecretValue(String);
+
+impl SecretValue {
+    pub fn new(value: impl Into<String>) -> Result<Self, SecretValueError> {
+        let value = value.into();
+        validate_developer_token(&value)?;
+        Ok(Self(value))
+    }
+
+    /// Exposes the secret only to a transport that is about to construct the
+    /// Authorization header.
+    pub fn expose_secret(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Debug for SecretValue {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("SecretValue([REDACTED])")
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum SecretValueError {
+    #[error("the Apple Music developer token is empty")]
+    Empty,
+    #[error("the Apple Music developer token exceeds the supported size")]
+    TooLong,
+    #[error("the Apple Music developer token is not a compact JWT")]
+    InvalidCompactJwt,
+}
+
+fn validate_developer_token(value: &str) -> Result<(), SecretValueError> {
+    if value.is_empty() {
+        return Err(SecretValueError::Empty);
+    }
+    if value.len() > MAX_DEVELOPER_TOKEN_BYTES {
+        return Err(SecretValueError::TooLong);
+    }
+    let mut segments = value.split('.');
+    let valid_segment = |segment: &str| {
+        !segment.is_empty()
+            && segment
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    };
+    let compact = match (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) {
+        (Some(header), Some(claims), Some(signature), None) => {
+            valid_segment(header) && valid_segment(claims) && valid_segment(signature)
+        }
+        _ => false,
+    };
+    if !compact {
+        return Err(SecretValueError::InvalidCompactJwt);
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AppleMusicHttpPolicy {
+    pub connect_timeout: Duration,
+    pub request_timeout: Duration,
+    pub max_response_bytes: u64,
+}
+
+impl Default for AppleMusicHttpPolicy {
+    fn default() -> Self {
+        Self {
+            connect_timeout: Duration::from_secs(10),
+            request_timeout: Duration::from_secs(30),
+            max_response_bytes: 4 * 1024 * 1024,
+        }
+    }
+}
+
+impl AppleMusicHttpPolicy {
+    fn validate(self) -> Result<Self, AppleMusicHttpBuildError> {
+        if self.connect_timeout.is_zero() {
+            return Err(AppleMusicHttpBuildError::InvalidPolicy {
+                field: "connect_timeout",
+                message: "duration must be positive",
+            });
+        }
+        if self.request_timeout.is_zero() {
+            return Err(AppleMusicHttpBuildError::InvalidPolicy {
+                field: "request_timeout",
+                message: "duration must be positive",
+            });
+        }
+        if self.connect_timeout > self.request_timeout {
+            return Err(AppleMusicHttpBuildError::InvalidPolicy {
+                field: "connect_timeout",
+                message: "duration must not exceed request_timeout",
+            });
+        }
+        if self.max_response_bytes == 0 {
+            return Err(AppleMusicHttpBuildError::InvalidPolicy {
+                field: "max_response_bytes",
+                message: "limit must be positive",
+            });
+        }
+        Ok(self)
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum AppleMusicHttpBuildError {
+    #[error("invalid Apple Music HTTP policy {field}: {message}")]
+    InvalidPolicy {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("failed to construct the Apple Music HTTP client")]
+    Client(#[source] reqwest::Error),
+}
+
+#[derive(Clone)]
+pub struct AppleMusicHttpRequest {
+    url: Url,
+    developer_token: SecretValue,
+}
+
+impl AppleMusicHttpRequest {
+    pub fn url(&self) -> &Url {
+        &self.url
+    }
+
+    pub fn developer_token(&self) -> &SecretValue {
+        &self.developer_token
+    }
+}
+
+impl fmt::Debug for AppleMusicHttpRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AppleMusicHttpRequest")
+            .field("origin", &APPLE_MUSIC_ORIGIN)
+            .field("path", &self.url.path())
+            .field("has_query", &self.url.query().is_some())
+            .field("developer_token", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct AppleMusicHttpResponse {
+    status: u16,
+    body: String,
+    content_type_is_json: bool,
+    retry_after: Option<Duration>,
+}
+
+impl AppleMusicHttpResponse {
+    pub fn json(status: u16, body: impl Into<String>, retry_after: Option<Duration>) -> Self {
+        Self {
+            status,
+            body: body.into(),
+            content_type_is_json: true,
+            retry_after,
+        }
+    }
+
+    pub fn non_json(status: u16, body: impl Into<String>) -> Self {
+        Self {
+            status,
+            body: body.into(),
+            content_type_is_json: false,
+            retry_after: None,
+        }
+    }
+}
+
+impl fmt::Debug for AppleMusicHttpResponse {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AppleMusicHttpResponse")
+            .field("status", &self.status)
+            .field("body_bytes", &self.body.len())
+            .field("content_type_is_json", &self.content_type_is_json)
+            .field("retry_after", &self.retry_after)
+            .finish()
+    }
+}
+
+pub type AppleMusicTransportFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<AppleMusicHttpResponse, AdapterFailure>> + Send + 'a>>;
+
+pub trait AppleMusicTransport: Send + Sync + 'static {
+    fn get<'a>(&'a self, request: AppleMusicHttpRequest) -> AppleMusicTransportFuture<'a>;
+}
+
+/// Production transport for the fixed Apple Music API origin.
+#[derive(Clone)]
+pub struct AppleMusicHttpTransport {
+    client: reqwest::Client,
+    policy: AppleMusicHttpPolicy,
+}
+
+impl AppleMusicHttpTransport {
+    pub fn new(policy: AppleMusicHttpPolicy) -> Result<Self, AppleMusicHttpBuildError> {
+        let policy = policy.validate()?;
+        let client = reqwest::Client::builder()
+            .redirect(Policy::none())
+            .no_proxy()
+            .referer(false)
+            .connect_timeout(policy.connect_timeout)
+            .timeout(policy.request_timeout)
+            .user_agent("ProjectAnni-CatalogWorker/0.1")
+            .build()
+            .map_err(AppleMusicHttpBuildError::Client)?;
+        Ok(Self { client, policy })
+    }
+
+    pub const fn policy(&self) -> AppleMusicHttpPolicy {
+        self.policy
+    }
+
+    async fn get_inner(
+        &self,
+        request: AppleMusicHttpRequest,
+    ) -> Result<AppleMusicHttpResponse, AdapterFailure> {
+        validate_transport_url(&request.url)?;
+        let response = self
+            .client
+            .get(request.url)
+            .header(ACCEPT, "application/json")
+            .bearer_auth(request.developer_token.expose_secret())
+            .send()
+            .await
+            .map_err(classify_request_error)?;
+        let status = response.status().as_u16();
+        let retry_after = response
+            .headers()
+            .get(RETRY_AFTER)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| parse_retry_after(value, SystemTime::now()));
+        let content_type_is_json = response
+            .headers()
+            .get(CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(is_json_content_type);
+        if response
+            .content_length()
+            .is_some_and(|length| length > self.policy.max_response_bytes)
+        {
+            return Err(AdapterFailure::permanent(
+                "apple_response_too_large",
+                Some(status),
+            ));
+        }
+
+        let mut body = Vec::new();
+        let mut stream = response.bytes_stream();
+        while let Some(chunk) = stream.next().await {
+            let chunk = chunk.map_err(|_| {
+                AdapterFailure::retryable("apple_response_interrupted", Some(status), None)
+            })?;
+            let next_len = body.len().checked_add(chunk.len()).ok_or_else(|| {
+                AdapterFailure::permanent("apple_response_too_large", Some(status))
+            })?;
+            if next_len as u64 > self.policy.max_response_bytes {
+                return Err(AdapterFailure::permanent(
+                    "apple_response_too_large",
+                    Some(status),
+                ));
+            }
+            body.extend_from_slice(&chunk);
+        }
+        let body = String::from_utf8(body)
+            .map_err(|_| AdapterFailure::permanent("apple_response_not_utf8", Some(status)))?;
+        Ok(AppleMusicHttpResponse {
+            status,
+            body,
+            content_type_is_json,
+            retry_after,
+        })
+    }
+}
+
+impl fmt::Debug for AppleMusicHttpTransport {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AppleMusicHttpTransport")
+            .field("origin", &APPLE_MUSIC_ORIGIN)
+            .field("policy", &self.policy)
+            .finish()
+    }
+}
+
+impl AppleMusicTransport for AppleMusicHttpTransport {
+    fn get<'a>(&'a self, request: AppleMusicHttpRequest) -> AppleMusicTransportFuture<'a> {
+        Box::pin(async move { self.get_inner(request).await })
+    }
+}
+
+fn classify_request_error(error: reqwest::Error) -> AdapterFailure {
+    if error.is_timeout() {
+        AdapterFailure::retryable("apple_request_timeout", None, None)
+    } else {
+        AdapterFailure::retryable("apple_request_failed", None, None)
+    }
+}
+
+fn is_json_content_type(value: &str) -> bool {
+    value
+        .split(';')
+        .next()
+        .is_some_and(|mime| mime.trim().eq_ignore_ascii_case("application/json"))
+}
+
+fn parse_retry_after(value: &str, now: SystemTime) -> Option<Duration> {
+    if let Ok(seconds) = value.trim().parse::<u64>() {
+        return Some(Duration::from_secs(seconds));
+    }
+    let deadline = httpdate::parse_http_date(value).ok()?;
+    deadline.duration_since(now).ok().or(Some(Duration::ZERO))
+}
+
+fn validate_transport_url(url: &Url) -> Result<(), AdapterFailure> {
+    if url.scheme() != "https"
+        || url.host_str() != Some("api.music.apple.com")
+        || url.port().is_some()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.fragment().is_some()
+    {
+        return Err(AdapterFailure::permanent(
+            "apple_request_origin_invalid",
+            None,
+        ));
+    }
+    Ok(())
+}
+
+pub struct AppleMusicAdapter<R, T = AppleMusicHttpTransport> {
+    secrets: Arc<R>,
+    transport: T,
+}
+
+impl<R: SecretResolver> AppleMusicAdapter<R, AppleMusicHttpTransport> {
+    pub fn new(
+        secrets: Arc<R>,
+        policy: AppleMusicHttpPolicy,
+    ) -> Result<Self, AppleMusicHttpBuildError> {
+        Ok(Self {
+            secrets,
+            transport: AppleMusicHttpTransport::new(policy)?,
+        })
+    }
+}
+
+impl<R, T> AppleMusicAdapter<R, T> {
+    pub fn with_transport(secrets: Arc<R>, transport: T) -> Self {
+        Self { secrets, transport }
+    }
+}
+
+impl<R, T> fmt::Debug for AppleMusicAdapter<R, T> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AppleMusicAdapter")
+            .field("origin", &APPLE_MUSIC_ORIGIN)
+            .field("secret_resolver", &"[REDACTED]")
+            .field("transport", &std::any::type_name::<T>())
+            .finish()
+    }
+}
+
+impl<R: SecretResolver, T: AppleMusicTransport> AppleMusicAdapter<R, T> {
+    async fn fetch_page_inner(
+        &self,
+        lease: &CatalogSyncLease,
+        cursor: Option<&str>,
+    ) -> Result<AdapterPage, AdapterFailure> {
+        let scope = AppleMusicScope::from_lease(lease)?;
+        let request_url = scope.request_url(cursor)?;
+        let secret_ref = validate_secret_ref(lease.secret_ref.as_deref())?;
+        let developer_token = self.secrets.resolve(secret_ref).await?;
+        let response = self
+            .transport
+            .get(AppleMusicHttpRequest {
+                url: request_url,
+                developer_token,
+            })
+            .await?;
+        if response.status != 200 {
+            return Err(failure_for_status(response.status, response.retry_after));
+        }
+        if !response.content_type_is_json {
+            return Err(AdapterFailure::permanent(
+                "apple_response_not_json",
+                Some(response.status),
+            ));
+        }
+        parse_page(&scope, cursor, &response.body)
+    }
+}
+
+impl<R: SecretResolver, T: AppleMusicTransport> CatalogAdapter for AppleMusicAdapter<R, T> {
+    fn source_kind(&self) -> CatalogSourceKind {
+        CatalogSourceKind::AppleMusic
+    }
+
+    fn fetch_page<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        cursor: Option<&'a str>,
+    ) -> AdapterFuture<'a> {
+        Box::pin(async move { self.fetch_page_inner(lease, cursor).await })
+    }
+}
+
+fn failure_for_status(status: u16, retry_after: Option<Duration>) -> AdapterFailure {
+    match status {
+        401 | 403 => AdapterFailure::permanent("apple_authorization_failed", Some(status)),
+        404 => AdapterFailure::permanent("apple_artist_not_found", Some(status)),
+        429 => AdapterFailure::retryable("apple_rate_limited", Some(status), retry_after),
+        408 | 425 | 500..=599 => {
+            AdapterFailure::retryable("apple_upstream_unavailable", Some(status), retry_after)
+        }
+        300..=399 => AdapterFailure::permanent("apple_redirect_rejected", Some(status)),
+        100..=299 | 400..=499 => AdapterFailure::permanent("apple_request_rejected", Some(status)),
+        _ => AdapterFailure::permanent("apple_invalid_http_status", None),
+    }
+}
+
+#[derive(Clone)]
+struct AppleMusicScope {
+    storefront: String,
+    artist_id: String,
+    locale: Option<String>,
+    albums_path: String,
+}
+
+impl AppleMusicScope {
+    fn from_lease(lease: &CatalogSyncLease) -> Result<Self, AdapterFailure> {
+        if lease.kind != CatalogSourceKind::AppleMusic {
+            return Err(AdapterFailure::permanent("apple_source_kind_invalid", None));
+        }
+        if lease.configuration_document.is_some() {
+            return Err(AdapterFailure::permanent(
+                "apple_configuration_unsupported",
+                None,
+            ));
+        }
+        if !valid_numeric_id(&lease.locator) {
+            return Err(AdapterFailure::permanent("apple_artist_id_invalid", None));
+        }
+        let storefront = lease
+            .storefront
+            .as_deref()
+            .filter(|value| valid_storefront(value))
+            .ok_or_else(|| AdapterFailure::permanent("apple_storefront_invalid", None))?;
+        if lease
+            .locale
+            .as_deref()
+            .is_some_and(|value| !valid_locale(value))
+        {
+            return Err(AdapterFailure::permanent("apple_locale_invalid", None));
+        }
+        Ok(Self {
+            storefront: storefront.to_owned(),
+            artist_id: lease.locator.clone(),
+            locale: lease.locale.clone(),
+            albums_path: format!("/v1/catalog/{storefront}/artists/{}/albums", lease.locator),
+        })
+    }
+
+    fn request_url(&self, cursor: Option<&str>) -> Result<Url, AdapterFailure> {
+        if let Some(cursor) = cursor {
+            self.validate_cursor(cursor).map(|(url, _)| url)
+        } else {
+            let mut url = Url::parse(&format!("{APPLE_MUSIC_ORIGIN}{}", self.albums_path))
+                .map_err(|_| AdapterFailure::permanent("apple_endpoint_invalid", None))?;
+            {
+                let mut query = url.query_pairs_mut();
+                query.append_pair("limit", &PAGE_LIMIT.to_string());
+                if let Some(locale) = &self.locale {
+                    query.append_pair("l", locale);
+                }
+            }
+            Ok(url)
+        }
+    }
+
+    fn validate_cursor(&self, cursor: &str) -> Result<(Url, u64), AdapterFailure> {
+        if cursor.is_empty() || cursor.len() > MAX_CURSOR_BYTES {
+            return Err(AdapterFailure::permanent("apple_cursor_invalid", None));
+        }
+        let base = Url::parse(&format!("{APPLE_MUSIC_ORIGIN}/"))
+            .map_err(|_| AdapterFailure::permanent("apple_endpoint_invalid", None))?;
+        let url = base
+            .join(cursor)
+            .map_err(|_| AdapterFailure::permanent("apple_cursor_invalid", None))?;
+        validate_transport_url(&url)?;
+        if url.path() != self.albums_path {
+            return Err(AdapterFailure::permanent(
+                "apple_cursor_scope_invalid",
+                None,
+            ));
+        }
+
+        let mut seen = HashSet::new();
+        let mut offset = None;
+        for (key, value) in url.query_pairs() {
+            if !seen.insert(key.to_string()) {
+                return Err(AdapterFailure::permanent(
+                    "apple_cursor_query_invalid",
+                    None,
+                ));
+            }
+            match key.as_ref() {
+                "offset" => {
+                    offset = value.parse::<u64>().ok().filter(|value| *value > 0);
+                    if offset.is_none() {
+                        return Err(AdapterFailure::permanent(
+                            "apple_cursor_query_invalid",
+                            None,
+                        ));
+                    }
+                }
+                "limit" => {
+                    let valid = value
+                        .parse::<u16>()
+                        .ok()
+                        .is_some_and(|limit| (1..=PAGE_LIMIT).contains(&limit));
+                    if !valid {
+                        return Err(AdapterFailure::permanent(
+                            "apple_cursor_query_invalid",
+                            None,
+                        ));
+                    }
+                }
+                "l" if self.locale.as_deref() == Some(value.as_ref()) => {}
+                _ => {
+                    return Err(AdapterFailure::permanent(
+                        "apple_cursor_query_invalid",
+                        None,
+                    ));
+                }
+            }
+        }
+        let offset =
+            offset.ok_or_else(|| AdapterFailure::permanent("apple_cursor_query_invalid", None))?;
+        Ok((url, offset))
+    }
+
+    fn album_url(&self, id: &str, href: &str) -> Result<String, AdapterFailure> {
+        if !valid_numeric_id(id) {
+            return Err(AdapterFailure::permanent("apple_album_id_invalid", None));
+        }
+        let base = Url::parse(&format!("{APPLE_MUSIC_ORIGIN}/"))
+            .map_err(|_| AdapterFailure::permanent("apple_endpoint_invalid", None))?;
+        let url = base
+            .join(href)
+            .map_err(|_| AdapterFailure::permanent("apple_album_href_invalid", None))?;
+        validate_transport_url(&url)?;
+        let expected = format!("/v1/catalog/{}/albums/{id}", self.storefront);
+        if url.path() != expected || url.query().is_some() {
+            return Err(AdapterFailure::permanent("apple_album_href_invalid", None));
+        }
+        Ok(url.to_string())
+    }
+}
+
+fn valid_numeric_id(value: &str) -> bool {
+    (1..=32).contains(&value.len())
+        && value.bytes().all(|byte| byte.is_ascii_digit())
+        && value.bytes().any(|byte| byte != b'0')
+}
+
+fn valid_storefront(value: &str) -> bool {
+    value.len() == 2 && value.bytes().all(|byte| byte.is_ascii_lowercase())
+}
+
+fn valid_locale(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 35
+        && value.is_ascii()
+        && !value.contains('_')
+        && value.parse::<unic_langid::LanguageIdentifier>().is_ok()
+}
+
+fn validate_secret_ref(value: Option<&str>) -> Result<&str, AdapterFailure> {
+    value
+        .filter(|value| {
+            !value.is_empty()
+                && value.len() <= MAX_SECRET_REF_BYTES
+                && !value.chars().any(char::is_control)
+        })
+        .ok_or_else(|| AdapterFailure::permanent("apple_secret_ref_invalid", None))
+}
+
+#[derive(Deserialize)]
+struct AppleRelationshipPage<'a> {
+    #[serde(borrow)]
+    data: Vec<&'a RawValue>,
+    #[serde(default)]
+    next: Option<&'a str>,
+}
+
+#[derive(Deserialize)]
+struct AppleAlbumResource<'a> {
+    id: &'a str,
+    #[serde(rename = "type")]
+    resource_type: &'a str,
+    href: &'a str,
+    #[serde(borrow)]
+    attributes: &'a RawValue,
+}
+
+#[derive(Deserialize)]
+struct RequiredAlbumAttributes<'a> {
+    name: &'a str,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ParsedAppleMusicRelease<'a> {
+    schema_version: u8,
+    source: &'static str,
+    storefront: &'a str,
+    artist_id: &'a str,
+    external_release_id: &'a str,
+    resource_type: &'a str,
+    attributes: &'a RawValue,
+}
+
+fn parse_page(
+    scope: &AppleMusicScope,
+    cursor: Option<&str>,
+    body: &str,
+) -> Result<AdapterPage, AdapterFailure> {
+    let page: AppleRelationshipPage<'_> = serde_json::from_str(body)
+        .map_err(|_| AdapterFailure::permanent("apple_response_schema_invalid", Some(200)))?;
+    if page.data.is_empty() && page.next.is_some() {
+        return Err(AdapterFailure::permanent(
+            "apple_empty_page_with_next",
+            Some(200),
+        ));
+    }
+
+    let current_offset = cursor
+        .map(|cursor| scope.validate_cursor(cursor).map(|(_, offset)| offset))
+        .transpose()?
+        .unwrap_or(0);
+    let next_cursor = if let Some(next) = page.next {
+        let (_, next_offset) = scope.validate_cursor(next)?;
+        if next_offset <= current_offset {
+            return Err(AdapterFailure::permanent(
+                "apple_cursor_not_forward",
+                Some(200),
+            ));
+        }
+        Some(next.to_owned())
+    } else {
+        None
+    };
+
+    let mut ids = HashSet::new();
+    let mut observations = Vec::with_capacity(page.data.len());
+    for raw in page.data {
+        let resource: AppleAlbumResource<'_> = serde_json::from_str(raw.get())
+            .map_err(|_| AdapterFailure::permanent("apple_album_schema_invalid", Some(200)))?;
+        if resource.resource_type != "albums" || !ids.insert(resource.id) {
+            return Err(AdapterFailure::permanent(
+                "apple_album_resource_invalid",
+                Some(200),
+            ));
+        }
+        let required: RequiredAlbumAttributes<'_> = serde_json::from_str(resource.attributes.get())
+            .map_err(|_| AdapterFailure::permanent("apple_album_schema_invalid", Some(200)))?;
+        if required.name.is_empty() {
+            return Err(AdapterFailure::permanent(
+                "apple_album_schema_invalid",
+                Some(200),
+            ));
+        }
+        let source_url = scope.album_url(resource.id, resource.href)?;
+        let parsed_document = serde_json::to_string(&ParsedAppleMusicRelease {
+            schema_version: 1,
+            source: "appleMusic",
+            storefront: &scope.storefront,
+            artist_id: &scope.artist_id,
+            external_release_id: resource.id,
+            resource_type: resource.resource_type,
+            attributes: resource.attributes,
+        })
+        .map_err(|_| AdapterFailure::permanent("apple_parsed_document_failed", None))?;
+        observations.push(AdapterObservation {
+            external_release_id: resource.id.to_owned(),
+            source_url,
+            raw_document: raw.get().to_owned(),
+            parsed_document,
+        });
+    }
+
+    let complete = next_cursor.is_none();
+    Ok(AdapterPage {
+        empty_full_snapshot_confirmed: cursor.is_none() && complete && observations.is_empty(),
+        observations,
+        next_cursor,
+        checkpoint: None,
+        // Every page declares the same relationship scope. The runner only
+        // completes it after following `next` to the end, and Annim only
+        // permits absence inference when the durable run started at root.
+        coverage: SyncCoverage::FullSnapshot,
+        complete,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::VecDeque,
+        sync::{Arc, Mutex},
+    };
+
+    use annim::catalog::CatalogRowVersion;
+    use chrono::Utc;
+    use uuid::Uuid;
+
+    use super::*;
+
+    const TOKEN: &str = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJURUFNSUQifQ.c2lnbmF0dXJl";
+    const FIRST_RAW: &str = r#"{"id":"100","type":"albums","href":"/v1/catalog/jp/albums/100","attributes":{"name":"作品・A〜B～C（初回）","artistName":"歌手・甲"}}"#;
+
+    struct FixtureSecrets {
+        requested: Mutex<Vec<String>>,
+    }
+
+    impl FixtureSecrets {
+        fn new() -> Self {
+            Self {
+                requested: Mutex::new(Vec::new()),
+            }
+        }
+    }
+
+    impl SecretResolver for FixtureSecrets {
+        fn resolve<'a>(&'a self, secret_ref: &'a str) -> SecretFuture<'a> {
+            self.requested.lock().unwrap().push(secret_ref.to_owned());
+            Box::pin(async { Ok(SecretValue::new(TOKEN).unwrap()) })
+        }
+    }
+
+    struct FixtureTransport {
+        responses: Mutex<VecDeque<Result<AppleMusicHttpResponse, AdapterFailure>>>,
+        requests: Mutex<Vec<AppleMusicHttpRequest>>,
+    }
+
+    impl FixtureTransport {
+        fn new(
+            responses: impl IntoIterator<Item = Result<AppleMusicHttpResponse, AdapterFailure>>,
+        ) -> Self {
+            Self {
+                responses: Mutex::new(responses.into_iter().collect()),
+                requests: Mutex::new(Vec::new()),
+            }
+        }
+    }
+
+    impl AppleMusicTransport for FixtureTransport {
+        fn get<'a>(&'a self, request: AppleMusicHttpRequest) -> AppleMusicTransportFuture<'a> {
+            self.requests.lock().unwrap().push(request);
+            let response = self.responses.lock().unwrap().pop_front().unwrap();
+            Box::pin(async move { response })
+        }
+    }
+
+    fn lease() -> CatalogSyncLease {
+        CatalogSyncLease {
+            run_id: Uuid::new_v4(),
+            source_id: Uuid::new_v4(),
+            kind: CatalogSourceKind::AppleMusic,
+            locator: "123".to_owned(),
+            storefront: Some("jp".to_owned()),
+            locale: Some("ja-JP".to_owned()),
+            configuration_document: None,
+            secret_ref: Some("secret/apple/developer-token".to_owned()),
+            requested_cursor: None,
+            lease_token: Uuid::new_v4(),
+            lease_expires_at: Utc::now() + chrono::Duration::minutes(10),
+            attempt_count: 1,
+            row_version: CatalogRowVersion::INITIAL,
+        }
+    }
+
+    #[tokio::test]
+    async fn preserves_exact_release_fragments_and_follows_only_the_same_relationship() {
+        let next = "/v1/catalog/jp/artists/123/albums?offset=100&limit=100&l=ja-JP";
+        let first_body = format!(r#"{{"data":[{FIRST_RAW}],"next":"{next}"}}"#);
+        let second_raw = r#"{"id":"200","type":"albums","href":"/v1/catalog/jp/albums/200","attributes":{"name":"第二作（通常盤）","artistName":"歌手・甲"}}"#;
+        let second_body = format!(r#"{{"data":[{second_raw}]}}"#);
+        let secrets = Arc::new(FixtureSecrets::new());
+        let transport = FixtureTransport::new([
+            Ok(AppleMusicHttpResponse::json(200, first_body, None)),
+            Ok(AppleMusicHttpResponse::json(200, second_body, None)),
+        ]);
+        let adapter = AppleMusicAdapter::with_transport(secrets.clone(), transport);
+        let lease = lease();
+
+        let first = adapter.fetch_page_inner(&lease, None).await.unwrap();
+        assert_eq!(first.coverage, SyncCoverage::FullSnapshot);
+        assert!(!first.complete);
+        assert_eq!(first.next_cursor.as_deref(), Some(next));
+        assert_eq!(first.observations[0].raw_document, FIRST_RAW);
+        assert!(first.observations[0]
+            .parsed_document
+            .contains("作品・A〜B～C（初回）"));
+        assert!(first.observations[0]
+            .parsed_document
+            .contains("\"schemaVersion\":1"));
+
+        let second = adapter.fetch_page_inner(&lease, Some(next)).await.unwrap();
+        assert!(second.complete);
+        assert_eq!(second.observations[0].raw_document, second_raw);
+
+        let requests = adapter.transport.requests.lock().unwrap();
+        assert_eq!(
+            requests[0].url.as_str(),
+            "https://api.music.apple.com/v1/catalog/jp/artists/123/albums?limit=100&l=ja-JP"
+        );
+        assert_eq!(
+            requests[1].url.as_str(),
+            format!("{APPLE_MUSIC_ORIGIN}{next}")
+        );
+        assert_eq!(requests[0].developer_token.expose_secret(), TOKEN);
+        assert!(!format!("{:?}", requests[0]).contains(TOKEN));
+        assert_eq!(secrets.requested.lock().unwrap().len(), 2);
+    }
+
+    #[tokio::test]
+    async fn rejects_invalid_scope_before_resolving_a_secret_or_using_transport() {
+        let secrets = Arc::new(FixtureSecrets::new());
+        let transport = FixtureTransport::new([]);
+        let adapter = AppleMusicAdapter::with_transport(secrets.clone(), transport);
+        let mut invalid_lease = lease();
+        invalid_lease.locale = Some("ja_JP".to_owned());
+        let failure = adapter
+            .fetch_page_inner(&invalid_lease, None)
+            .await
+            .unwrap_err();
+        assert_eq!(failure.code(), "apple_locale_invalid");
+
+        let mut invalid_lease = lease();
+        invalid_lease.storefront = Some("JP".to_owned());
+        let failure = adapter
+            .fetch_page_inner(&invalid_lease, None)
+            .await
+            .unwrap_err();
+        assert_eq!(failure.code(), "apple_storefront_invalid");
+
+        let mut invalid_lease = lease();
+        invalid_lease.locator = "../123".to_owned();
+        let failure = adapter
+            .fetch_page_inner(&invalid_lease, None)
+            .await
+            .unwrap_err();
+        assert_eq!(failure.code(), "apple_artist_id_invalid");
+
+        let lease = lease();
+        for cursor in [
+            "https://example.com/v1/catalog/jp/artists/123/albums?offset=100",
+            "/v1/catalog/jp/artists/999/albums?offset=100",
+            "/v1/catalog/jp/artists/123/albums?offset=100&include=tracks",
+        ] {
+            let failure = adapter
+                .fetch_page_inner(&lease, Some(cursor))
+                .await
+                .unwrap_err();
+            assert!(matches!(
+                failure.code(),
+                "apple_request_origin_invalid"
+                    | "apple_cursor_scope_invalid"
+                    | "apple_cursor_query_invalid"
+            ));
+        }
+        assert!(secrets.requested.lock().unwrap().is_empty());
+        assert!(adapter.transport.requests.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn maps_rate_limits_and_confirms_only_a_proven_empty_root_snapshot() {
+        let secrets = Arc::new(FixtureSecrets::new());
+        let transport = FixtureTransport::new([
+            Ok(AppleMusicHttpResponse::json(
+                429,
+                r#"{"errors":[]}"#,
+                Some(Duration::from_secs(120)),
+            )),
+            Ok(AppleMusicHttpResponse::json(200, r#"{"data":[]}"#, None)),
+        ]);
+        let adapter = AppleMusicAdapter::with_transport(secrets, transport);
+        let lease = lease();
+
+        let failure = adapter.fetch_page_inner(&lease, None).await.unwrap_err();
+        assert_eq!(failure.code(), "apple_rate_limited");
+        assert_eq!(failure.http_status(), Some(429));
+        assert_eq!(failure.retry_after(), Some(Duration::from_secs(120)));
+
+        let page = adapter.fetch_page_inner(&lease, None).await.unwrap();
+        assert!(page.complete);
+        assert!(page.empty_full_snapshot_confirmed);
+    }
+
+    #[tokio::test]
+    async fn production_transport_rejects_off_origin_without_network_access() {
+        let transport = AppleMusicHttpTransport::new(AppleMusicHttpPolicy::default()).unwrap();
+        let request = AppleMusicHttpRequest {
+            url: Url::parse("https://example.com/v1/catalog/jp/artists/123/albums").unwrap(),
+            developer_token: SecretValue::new(TOKEN).unwrap(),
+        };
+        let failure = transport.get(request).await.unwrap_err();
+        assert_eq!(failure.code(), "apple_request_origin_invalid");
+
+        assert_eq!(
+            parse_retry_after("120", SystemTime::UNIX_EPOCH),
+            Some(Duration::from_secs(120))
+        );
+        let date = "Thu, 01 Jan 1970 00:02:00 GMT";
+        assert_eq!(
+            parse_retry_after(date, SystemTime::UNIX_EPOCH),
+            Some(Duration::from_secs(120))
+        );
+        assert!(SecretValue::new("secret-token").is_err());
+        assert!(!format!("{:?}", SecretValue::new(TOKEN).unwrap()).contains(TOKEN));
+    }
+}
diff --git a/anni-catalog-worker/src/bin/catalog-worker.rs b/anni-catalog-worker/src/bin/catalog-worker.rs
new file mode 100644
index 00000000..1e285d5a
--- /dev/null
+++ b/anni-catalog-worker/src/bin/catalog-worker.rs
@@ -0,0 +1,649 @@
+//! Executable catalog synchronization worker.
+//!
+//! This binary lives in `anni-catalog-worker` rather than `annim`: the worker
+//! library already depends on Annim's durable queue, so reversing that edge
+//! would create a Cargo dependency cycle.
+
+use std::{
+    fmt,
+    fs::{self, File},
+    io::Read,
+    path::{Component, Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+
+use anni_catalog_worker::{
+    AdapterFailure, AppleMusicAdapter, AppleMusicHttpPolicy, CatalogAdapterRegistry, CatalogWorker,
+    CatalogWorkerOutcome, CatalogWorkerPolicy, SecretFuture, SecretResolver, SecretValue,
+};
+use annim::{catalog::CatalogSyncService, migrator::Migrator};
+use sea_orm::{ConnectOptions, Database};
+use sea_orm_migration::MigratorTrait;
+use thiserror::Error;
+
+const DEFAULT_POLL_SECONDS: u64 = 5;
+const DEFAULT_LEASE_SECONDS: u64 = 10 * 60;
+const DEFAULT_PAGE_TIMEOUT_SECONDS: u64 = 60;
+const DEFAULT_CONNECT_TIMEOUT_SECONDS: u64 = 10;
+const DEFAULT_REQUEST_TIMEOUT_SECONDS: u64 = 30;
+const DEFAULT_RESPONSE_BYTES: u64 = 4 * 1024 * 1024;
+const DEFAULT_SECRET_BYTES: u64 = 16 * 1024;
+
+const MAX_DATABASE_URL_BYTES: usize = 4 * 1024;
+const MAX_SECRET_ROOT_BYTES: usize = 4 * 1024;
+const MAX_POLL_SECONDS: u64 = 60 * 60;
+const MIN_LEASE_SECONDS: u64 = 30;
+const MAX_LEASE_SECONDS: u64 = 60 * 60;
+const MAX_PAGE_TIMEOUT_SECONDS: u64 = 10 * 60;
+const MAX_CONNECT_TIMEOUT_SECONDS: u64 = 60;
+const MAX_REQUEST_TIMEOUT_SECONDS: u64 = 5 * 60;
+const MIN_RESPONSE_BYTES: u64 = 64 * 1024;
+const MAX_RESPONSE_BYTES: u64 = 32 * 1024 * 1024;
+const MIN_SECRET_BYTES: u64 = 256;
+const MAX_SECRET_BYTES: u64 = 64 * 1024;
+
+struct WorkerConfig {
+    database_url: String,
+    secret_root: PathBuf,
+    poll_interval: Duration,
+    worker_policy: CatalogWorkerPolicy,
+    http_policy: AppleMusicHttpPolicy,
+    max_secret_bytes: usize,
+}
+
+impl WorkerConfig {
+    fn from_env() -> Result<Self, WorkerConfigError> {
+        Self::from_lookup(|name| std::env::var(name).ok())
+    }
+
+    fn from_lookup(
+        mut lookup: impl FnMut(&str) -> Option<String>,
+    ) -> Result<Self, WorkerConfigError> {
+        let database_url =
+            required_text(&mut lookup, "ANNIM_DATABASE_URL", MAX_DATABASE_URL_BYTES)?;
+        let secret_root_value = required_text(
+            &mut lookup,
+            "ANNIM_CATALOG_SECRET_ROOT",
+            MAX_SECRET_ROOT_BYTES,
+        )?;
+        let secret_root = PathBuf::from(secret_root_value);
+        if !secret_root.is_absolute() {
+            return Err(WorkerConfigError::InvalidValue {
+                name: "ANNIM_CATALOG_SECRET_ROOT",
+                requirement: "must be an absolute path",
+            });
+        }
+
+        let poll_seconds = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_POLL_INTERVAL_SECONDS",
+            DEFAULT_POLL_SECONDS,
+            1,
+            MAX_POLL_SECONDS,
+        )?;
+        let lease_seconds = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_LEASE_SECONDS",
+            DEFAULT_LEASE_SECONDS,
+            MIN_LEASE_SECONDS,
+            MAX_LEASE_SECONDS,
+        )?;
+        let page_timeout_seconds = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_PAGE_TIMEOUT_SECONDS",
+            DEFAULT_PAGE_TIMEOUT_SECONDS,
+            2,
+            MAX_PAGE_TIMEOUT_SECONDS,
+        )?;
+        let connect_timeout_seconds = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_CONNECT_TIMEOUT_SECONDS",
+            DEFAULT_CONNECT_TIMEOUT_SECONDS,
+            1,
+            MAX_CONNECT_TIMEOUT_SECONDS,
+        )?;
+        let request_timeout_seconds = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS",
+            DEFAULT_REQUEST_TIMEOUT_SECONDS,
+            1,
+            MAX_REQUEST_TIMEOUT_SECONDS,
+        )?;
+        let max_response_bytes = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_MAX_RESPONSE_BYTES",
+            DEFAULT_RESPONSE_BYTES,
+            MIN_RESPONSE_BYTES,
+            MAX_RESPONSE_BYTES,
+        )?;
+        let max_secret_bytes = bounded_integer(
+            &mut lookup,
+            "ANNIM_CATALOG_MAX_SECRET_BYTES",
+            DEFAULT_SECRET_BYTES,
+            MIN_SECRET_BYTES,
+            MAX_SECRET_BYTES,
+        )?;
+
+        if connect_timeout_seconds > request_timeout_seconds {
+            return Err(WorkerConfigError::InvalidTimeoutOrder {
+                shorter: "ANNIM_CATALOG_CONNECT_TIMEOUT_SECONDS",
+                longer: "ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS",
+            });
+        }
+        if request_timeout_seconds >= page_timeout_seconds {
+            return Err(WorkerConfigError::InvalidTimeoutOrder {
+                shorter: "ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS",
+                longer: "ANNIM_CATALOG_PAGE_TIMEOUT_SECONDS",
+            });
+        }
+        if page_timeout_seconds >= lease_seconds {
+            return Err(WorkerConfigError::InvalidTimeoutOrder {
+                shorter: "ANNIM_CATALOG_PAGE_TIMEOUT_SECONDS",
+                longer: "ANNIM_CATALOG_LEASE_SECONDS",
+            });
+        }
+
+        let worker_policy = CatalogWorkerPolicy {
+            lease_for: Duration::from_secs(lease_seconds),
+            page_timeout: Duration::from_secs(page_timeout_seconds),
+            ..CatalogWorkerPolicy::default()
+        };
+        let http_policy = AppleMusicHttpPolicy {
+            connect_timeout: Duration::from_secs(connect_timeout_seconds),
+            request_timeout: Duration::from_secs(request_timeout_seconds),
+            max_response_bytes,
+        };
+        Ok(Self {
+            database_url,
+            secret_root,
+            poll_interval: Duration::from_secs(poll_seconds),
+            worker_policy,
+            http_policy,
+            max_secret_bytes: max_secret_bytes as usize,
+        })
+    }
+}
+
+impl fmt::Debug for WorkerConfig {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("WorkerConfig")
+            .field("database_url", &"[REDACTED]")
+            .field("secret_root", &"[REDACTED]")
+            .field("poll_interval", &self.poll_interval)
+            .field("worker_policy", &self.worker_policy)
+            .field("http_policy", &self.http_policy)
+            .field("max_secret_bytes", &self.max_secret_bytes)
+            .finish()
+    }
+}
+
+fn required_text(
+    lookup: &mut impl FnMut(&str) -> Option<String>,
+    name: &'static str,
+    max_bytes: usize,
+) -> Result<String, WorkerConfigError> {
+    let value = lookup(name).ok_or(WorkerConfigError::MissingValue { name })?;
+    if value.is_empty() || value.len() > max_bytes || value.chars().any(char::is_control) {
+        return Err(WorkerConfigError::InvalidValue {
+            name,
+            requirement: "must be non-empty, bounded UTF-8 without control characters",
+        });
+    }
+    Ok(value)
+}
+
+fn bounded_integer(
+    lookup: &mut impl FnMut(&str) -> Option<String>,
+    name: &'static str,
+    default: u64,
+    minimum: u64,
+    maximum: u64,
+) -> Result<u64, WorkerConfigError> {
+    match lookup(name) {
+        None => Ok(default),
+        Some(value) => value
+            .parse::<u64>()
+            .ok()
+            .filter(|value| (minimum..=maximum).contains(value))
+            .ok_or(WorkerConfigError::InvalidValue {
+                name,
+                requirement: "must be an integer within the documented bounds",
+            }),
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+enum WorkerConfigError {
+    #[error("required worker setting {name} is missing")]
+    MissingValue { name: &'static str },
+    #[error("invalid worker setting {name}: {requirement}")]
+    InvalidValue {
+        name: &'static str,
+        requirement: &'static str,
+    },
+    #[error("{shorter} must be shorter than {longer}")]
+    InvalidTimeoutOrder {
+        shorter: &'static str,
+        longer: &'static str,
+    },
+}
+
+#[derive(Clone)]
+struct FileSecretResolver {
+    canonical_root: Arc<PathBuf>,
+    max_bytes: usize,
+}
+
+impl FileSecretResolver {
+    fn open(root: &Path, max_bytes: usize) -> Result<Self, SecretFileError> {
+        if max_bytes == 0 {
+            return Err(SecretFileError::InvalidSizeLimit);
+        }
+        let canonical_root =
+            fs::canonicalize(root).map_err(|_| SecretFileError::RootUnavailable)?;
+        let metadata =
+            fs::metadata(&canonical_root).map_err(|_| SecretFileError::RootUnavailable)?;
+        if !metadata.is_dir() {
+            return Err(SecretFileError::RootNotDirectory);
+        }
+        Ok(Self {
+            canonical_root: Arc::new(canonical_root),
+            max_bytes,
+        })
+    }
+
+    fn read_secret(&self, secret_ref: &str) -> Result<SecretValue, SecretFileError> {
+        let components = validate_secret_reference(secret_ref)?;
+        let mut candidate = self.canonical_root.as_ref().clone();
+        for (index, component) in components.iter().enumerate() {
+            candidate.push(component);
+            let metadata =
+                fs::symlink_metadata(&candidate).map_err(|_| SecretFileError::SecretUnavailable)?;
+            if metadata.file_type().is_symlink() {
+                return Err(SecretFileError::SymlinkNotAllowed);
+            }
+            if index + 1 == components.len() {
+                if !metadata.is_file() {
+                    return Err(SecretFileError::SecretNotRegularFile);
+                }
+            } else if !metadata.is_dir() {
+                return Err(SecretFileError::SecretUnavailable);
+            }
+        }
+
+        let canonical =
+            fs::canonicalize(&candidate).map_err(|_| SecretFileError::SecretUnavailable)?;
+        if !canonical.starts_with(self.canonical_root.as_ref()) {
+            return Err(SecretFileError::ReferenceEscapesRoot);
+        }
+        let metadata = fs::metadata(&canonical).map_err(|_| SecretFileError::SecretUnavailable)?;
+        if !metadata.is_file() {
+            return Err(SecretFileError::SecretNotRegularFile);
+        }
+        if metadata.len() > self.max_bytes as u64 {
+            return Err(SecretFileError::SecretTooLarge);
+        }
+
+        let file = File::open(&canonical).map_err(|_| SecretFileError::SecretUnavailable)?;
+        let mut bytes = Vec::with_capacity(metadata.len() as usize);
+        file.take(self.max_bytes as u64 + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|_| SecretFileError::SecretUnavailable)?;
+        if bytes.len() > self.max_bytes {
+            return Err(SecretFileError::SecretTooLarge);
+        }
+        let value = String::from_utf8(bytes).map_err(|_| SecretFileError::SecretNotUtf8)?;
+        SecretValue::new(value).map_err(|_| SecretFileError::SecretInvalid)
+    }
+}
+
+impl fmt::Debug for FileSecretResolver {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("FileSecretResolver")
+            .field("canonical_root", &"[REDACTED]")
+            .field("max_bytes", &self.max_bytes)
+            .finish()
+    }
+}
+
+impl SecretResolver for FileSecretResolver {
+    fn resolve<'a>(&'a self, secret_ref: &'a str) -> SecretFuture<'a> {
+        let resolver = self.clone();
+        let secret_ref = secret_ref.to_owned();
+        Box::pin(async move {
+            let result = tokio::task::spawn_blocking(move || resolver.read_secret(&secret_ref))
+                .await
+                .map_err(|_| {
+                    AdapterFailure::retryable("apple_secret_resolver_failed", None, None)
+                })?;
+            result.map_err(SecretFileError::adapter_failure)
+        })
+    }
+}
+
+fn validate_secret_reference(secret_ref: &str) -> Result<Vec<&std::ffi::OsStr>, SecretFileError> {
+    if secret_ref.is_empty()
+        || secret_ref.len() > 512
+        || secret_ref.contains('\\')
+        || secret_ref.chars().any(char::is_control)
+    {
+        return Err(SecretFileError::InvalidReference);
+    }
+    let path = Path::new(secret_ref);
+    if path.is_absolute() {
+        return Err(SecretFileError::InvalidReference);
+    }
+    let mut components = Vec::new();
+    for component in path.components() {
+        match component {
+            Component::Normal(component) => components.push(component),
+            Component::CurDir
+            | Component::ParentDir
+            | Component::RootDir
+            | Component::Prefix(_) => return Err(SecretFileError::InvalidReference),
+        }
+    }
+    if components.is_empty() {
+        return Err(SecretFileError::InvalidReference);
+    }
+    Ok(components)
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+enum SecretFileError {
+    #[error("the catalog secret size limit is invalid")]
+    InvalidSizeLimit,
+    #[error("the catalog secret root is unavailable")]
+    RootUnavailable,
+    #[error("the catalog secret root is not a directory")]
+    RootNotDirectory,
+    #[error("the catalog secret reference is invalid")]
+    InvalidReference,
+    #[error("catalog secret references may not contain symbolic links")]
+    SymlinkNotAllowed,
+    #[error("the catalog secret reference escapes its root")]
+    ReferenceEscapesRoot,
+    #[error("the catalog secret is unavailable")]
+    SecretUnavailable,
+    #[error("the catalog secret is not a regular file")]
+    SecretNotRegularFile,
+    #[error("the catalog secret exceeds the configured size limit")]
+    SecretTooLarge,
+    #[error("the catalog secret is not UTF-8")]
+    SecretNotUtf8,
+    #[error("the catalog secret is not a valid developer token")]
+    SecretInvalid,
+}
+
+impl SecretFileError {
+    fn adapter_failure(self) -> AdapterFailure {
+        match self {
+            Self::RootUnavailable | Self::SecretUnavailable => {
+                AdapterFailure::retryable("apple_secret_unavailable", None, None)
+            }
+            Self::InvalidSizeLimit
+            | Self::RootNotDirectory
+            | Self::InvalidReference
+            | Self::SymlinkNotAllowed
+            | Self::ReferenceEscapesRoot
+            | Self::SecretNotRegularFile
+            | Self::SecretTooLarge
+            | Self::SecretNotUtf8
+            | Self::SecretInvalid => AdapterFailure::permanent("apple_secret_invalid", None),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+enum ProcessError {
+    #[error("catalog worker configuration is invalid")]
+    Configuration,
+    #[error("catalog secret resolver initialization failed")]
+    SecretResolver,
+    #[error("catalog database connection failed")]
+    DatabaseConnection,
+    #[error("catalog database migration failed")]
+    DatabaseMigration,
+    #[error("Apple Music transport initialization failed")]
+    Transport,
+    #[error("catalog adapter registration failed")]
+    AdapterRegistration,
+    #[error("catalog worker initialization failed")]
+    WorkerInitialization,
+    #[error("catalog worker shutdown signal failed")]
+    ShutdownSignal,
+}
+
+#[tokio::main]
+async fn main() -> Result<(), ProcessError> {
+    tracing_subscriber::fmt()
+        // Do not inherit RUST_LOG: dependency diagnostics can contain SQL or
+        // request context outside this binary's deliberately small log
+        // contract.
+        .with_env_filter("off,annim_catalog_worker=info")
+        .init();
+
+    let config = WorkerConfig::from_env().map_err(|_| ProcessError::Configuration)?;
+    let secrets = Arc::new(
+        FileSecretResolver::open(&config.secret_root, config.max_secret_bytes)
+            .map_err(|_| ProcessError::SecretResolver)?,
+    );
+    let mut database_options = ConnectOptions::new(config.database_url);
+    database_options.sqlx_logging(false);
+    let database = Database::connect(database_options)
+        .await
+        .map_err(|_| ProcessError::DatabaseConnection)?;
+    Migrator::up(&database, None)
+        .await
+        .map_err(|_| ProcessError::DatabaseMigration)?;
+
+    let apple_music =
+        AppleMusicAdapter::new(secrets, config.http_policy).map_err(|_| ProcessError::Transport)?;
+    let mut adapters = CatalogAdapterRegistry::new();
+    adapters
+        .register(apple_music)
+        .map_err(|_| ProcessError::AdapterRegistration)?;
+    let worker = CatalogWorker::new(
+        CatalogSyncService::new(database),
+        adapters,
+        config.worker_policy,
+    )
+    .map_err(|_| ProcessError::WorkerInitialization)?;
+
+    tracing::info!(target: "annim_catalog_worker", "Annim catalog worker started");
+    loop {
+        let cycle = tokio::select! {
+            signal = tokio::signal::ctrl_c() => {
+                signal.map_err(|_| ProcessError::ShutdownSignal)?;
+                break;
+            }
+            result = worker.run_once() => result,
+        };
+
+        let should_wait = match cycle {
+            Ok(CatalogWorkerOutcome::Idle) => true,
+            Ok(CatalogWorkerOutcome::Succeeded { run_id, .. }) => {
+                tracing::info!(target: "annim_catalog_worker", %run_id, "catalog sync run succeeded");
+                false
+            }
+            Ok(CatalogWorkerOutcome::RetryScheduled {
+                run_id, failure, ..
+            }) => {
+                tracing::warn!(target: "annim_catalog_worker", %run_id, code = failure.code(), "catalog sync retry scheduled");
+                false
+            }
+            Ok(CatalogWorkerOutcome::Failed {
+                run_id, failure, ..
+            }) => {
+                tracing::warn!(target: "annim_catalog_worker", %run_id, code = failure.code(), "catalog sync run failed");
+                false
+            }
+            Err(_) => {
+                // Queue errors may wrap database diagnostics. Never log their
+                // Debug representation; this stable code is the entire log
+                // contract for an unowned cycle failure.
+                tracing::error!(
+                    target: "annim_catalog_worker",
+                    code = "catalog_worker_cycle_failed",
+                    "catalog worker cycle failed"
+                );
+                true
+            }
+        };
+
+        if should_wait {
+            tokio::select! {
+                signal = tokio::signal::ctrl_c() => {
+                    signal.map_err(|_| ProcessError::ShutdownSignal)?;
+                    break;
+                }
+                _ = tokio::time::sleep(config.poll_interval) => {}
+            }
+        }
+    }
+    tracing::info!(target: "annim_catalog_worker", "Annim catalog worker stopped");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use tempfile::tempdir;
+
+    use super::*;
+
+    const TOKEN: &str = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJURUFNSUQifQ.c2lnbmF0dXJl";
+
+    fn valid_settings(secret_root: &Path) -> HashMap<&'static str, String> {
+        HashMap::from([
+            (
+                "ANNIM_DATABASE_URL",
+                "postgres://user:database-password@example.invalid/annim".to_owned(),
+            ),
+            (
+                "ANNIM_CATALOG_SECRET_ROOT",
+                secret_root.to_string_lossy().into_owned(),
+            ),
+            ("ANNIM_CATALOG_POLL_INTERVAL_SECONDS", "7".to_owned()),
+            ("ANNIM_CATALOG_LEASE_SECONDS", "300".to_owned()),
+            ("ANNIM_CATALOG_PAGE_TIMEOUT_SECONDS", "45".to_owned()),
+            ("ANNIM_CATALOG_CONNECT_TIMEOUT_SECONDS", "5".to_owned()),
+            ("ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS", "20".to_owned()),
+            (
+                "ANNIM_CATALOG_MAX_RESPONSE_BYTES",
+                (2 * 1024 * 1024).to_string(),
+            ),
+            ("ANNIM_CATALOG_MAX_SECRET_BYTES", (8 * 1024).to_string()),
+        ])
+    }
+
+    #[test]
+    fn configuration_is_bounded_ordered_and_redacted() {
+        let root = tempdir().unwrap();
+        let values = valid_settings(root.path());
+        let config = WorkerConfig::from_lookup(|name| values.get(name).cloned()).unwrap();
+        assert_eq!(config.poll_interval, Duration::from_secs(7));
+        assert_eq!(config.worker_policy.lease_for, Duration::from_secs(300));
+        assert_eq!(config.worker_policy.page_timeout, Duration::from_secs(45));
+        assert_eq!(config.http_policy.request_timeout, Duration::from_secs(20));
+        assert!(config.http_policy.request_timeout < config.worker_policy.lease_for);
+        let debug = format!("{config:?}");
+        assert!(!debug.contains("database-password"));
+        assert!(!debug.contains(root.path().to_string_lossy().as_ref()));
+
+        assert!(matches!(
+            WorkerConfig::from_lookup(|_| None),
+            Err(WorkerConfigError::MissingValue {
+                name: "ANNIM_DATABASE_URL"
+            })
+        ));
+
+        let mut values = valid_settings(root.path());
+        values.insert("ANNIM_CATALOG_SECRET_ROOT", "relative/secrets".to_owned());
+        assert!(matches!(
+            WorkerConfig::from_lookup(|name| values.get(name).cloned()),
+            Err(WorkerConfigError::InvalidValue {
+                name: "ANNIM_CATALOG_SECRET_ROOT",
+                ..
+            })
+        ));
+
+        let mut values = valid_settings(root.path());
+        values.insert("ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS", "45".to_owned());
+        assert!(matches!(
+            WorkerConfig::from_lookup(|name| values.get(name).cloned()),
+            Err(WorkerConfigError::InvalidTimeoutOrder { .. })
+        ));
+
+        let mut values = valid_settings(root.path());
+        values.insert(
+            "ANNIM_CATALOG_MAX_RESPONSE_BYTES",
+            (MAX_RESPONSE_BYTES + 1).to_string(),
+        );
+        assert!(matches!(
+            WorkerConfig::from_lookup(|name| values.get(name).cloned()),
+            Err(WorkerConfigError::InvalidValue {
+                name: "ANNIM_CATALOG_MAX_RESPONSE_BYTES",
+                ..
+            })
+        ));
+    }
+
+    #[tokio::test]
+    async fn file_secret_resolver_is_bounded_and_redacted() {
+        let temporary = tempdir().unwrap();
+        let root = temporary.path().join("secrets");
+        fs::create_dir(&root).unwrap();
+        fs::create_dir(root.join("apple")).unwrap();
+        fs::write(root.join("apple/developer.jwt"), TOKEN).unwrap();
+        fs::write(root.join("too-large.jwt"), "x".repeat(129)).unwrap();
+        let resolver = FileSecretResolver::open(&root, 128).unwrap();
+
+        let secret = resolver.read_secret("apple/developer.jwt").unwrap();
+        assert_eq!(secret.expose_secret(), TOKEN);
+        assert!(!format!("{resolver:?}").contains(root.to_string_lossy().as_ref()));
+        assert!(!format!("{secret:?}").contains(TOKEN));
+        assert_eq!(
+            resolver.read_secret("too-large.jwt").unwrap_err(),
+            SecretFileError::SecretTooLarge
+        );
+
+        for invalid in ["../outside.jwt", "/outside.jwt", "apple\\developer.jwt"] {
+            let error = resolver.read_secret(invalid).unwrap_err();
+            assert_eq!(error, SecretFileError::InvalidReference);
+            assert!(!format!("{error:?}").contains(invalid));
+        }
+        let failure = resolver.resolve("missing.jwt").await.unwrap_err();
+        assert_eq!(failure.code(), "apple_secret_unavailable");
+        assert!(!format!("{failure:?}").contains("missing.jwt"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn file_secret_resolver_rejects_symlink_escape() {
+        use std::os::unix::fs::symlink;
+
+        let temporary = tempdir().unwrap();
+        let root = temporary.path().join("secrets");
+        fs::create_dir(&root).unwrap();
+        let outside = temporary.path().join("outside.jwt");
+        fs::write(&outside, TOKEN).unwrap();
+        symlink(&outside, root.join("escaped.jwt")).unwrap();
+        let outside_directory = temporary.path().join("outside-secrets");
+        fs::create_dir(&outside_directory).unwrap();
+        fs::write(outside_directory.join("developer.jwt"), TOKEN).unwrap();
+        symlink(&outside_directory, root.join("escaped-directory")).unwrap();
+        let resolver = FileSecretResolver::open(&root, 1024).unwrap();
+
+        for reference in ["escaped.jwt", "escaped-directory/developer.jwt"] {
+            assert_eq!(
+                resolver.read_secret(reference).unwrap_err(),
+                SecretFileError::SymlinkNotAllowed
+            );
+        }
+    }
+}
diff --git a/anni-catalog-worker/src/lib.rs b/anni-catalog-worker/src/lib.rs
new file mode 100644
index 00000000..fac457b0
--- /dev/null
+++ b/anni-catalog-worker/src/lib.rs
@@ -0,0 +1,13 @@
+//! Safe background synchronization of external release catalogs.
+//!
+//! Annim owns durable runs, leases, and immutable observations. This crate
+//! owns adapter pagination and retry orchestration. Adapter data is always
+//! evidence: it never writes canonical Booklet metadata directly.
+
+mod adapter;
+mod apple_music;
+mod runner;
+
+pub use adapter::*;
+pub use apple_music::*;
+pub use runner::*;
diff --git a/anni-catalog-worker/src/runner.rs b/anni-catalog-worker/src/runner.rs
new file mode 100644
index 00000000..fda68c47
--- /dev/null
+++ b/anni-catalog-worker/src/runner.rs
@@ -0,0 +1,1025 @@
+use std::{collections::HashSet, fmt, future::Future, num::NonZeroU32, pin::Pin, time::Duration};
+
+use anni_catalog::SyncCoverage;
+use annim::catalog::{
+    CatalogReleaseObservation, CatalogRowVersion, CatalogSyncError, CatalogSyncLease,
+    CatalogSyncService, FinishCatalogSyncRun,
+};
+use chrono::{DateTime, Utc};
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::{
+    AdapterFailure, AdapterFailureDisposition, AdapterObservation, AdapterPage, CatalogAdapters,
+};
+
+type QueueFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, CatalogSyncError>> + Send + 'a>>;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CatalogWorkerPolicy {
+    pub lease_for: Duration,
+    pub page_timeout: Duration,
+    pub base_retry_delay: Duration,
+    pub max_retry_delay: Duration,
+    pub max_attempts: NonZeroU32,
+    pub max_pages: NonZeroU32,
+    pub max_observations_per_page: NonZeroU32,
+    pub max_total_observations: NonZeroU32,
+    pub max_reference_bytes: NonZeroU32,
+    pub max_document_bytes: NonZeroU32,
+    pub max_page_bytes: NonZeroU32,
+}
+
+impl Default for CatalogWorkerPolicy {
+    fn default() -> Self {
+        Self {
+            lease_for: Duration::from_secs(10 * 60),
+            page_timeout: Duration::from_secs(60),
+            base_retry_delay: Duration::from_secs(30),
+            max_retry_delay: Duration::from_secs(6 * 60 * 60),
+            max_attempts: NonZeroU32::new(5).expect("five is non-zero"),
+            max_pages: NonZeroU32::new(100).expect("one hundred is non-zero"),
+            max_observations_per_page: NonZeroU32::new(500).expect("five hundred is non-zero"),
+            max_total_observations: NonZeroU32::new(10_000).expect("ten thousand is non-zero"),
+            max_reference_bytes: NonZeroU32::new(16 * 1024).expect("sixteen KiB is non-zero"),
+            max_document_bytes: NonZeroU32::new(8 * 1024 * 1024).expect("eight MiB is non-zero"),
+            max_page_bytes: NonZeroU32::new(32 * 1024 * 1024).expect("thirty-two MiB is non-zero"),
+        }
+    }
+}
+
+impl CatalogWorkerPolicy {
+    fn validate(self) -> Result<Self, CatalogWorkerError> {
+        if self.lease_for.is_zero() {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "lease_for",
+                message: "duration must be positive",
+            });
+        }
+        if self.page_timeout.is_zero() {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "page_timeout",
+                message: "duration must be positive",
+            });
+        }
+        if self.page_timeout >= self.lease_for {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "page_timeout",
+                message: "duration must be shorter than lease_for",
+            });
+        }
+        if self.base_retry_delay.is_zero() {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "base_retry_delay",
+                message: "duration must be positive",
+            });
+        }
+        if self.max_retry_delay < self.base_retry_delay {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "max_retry_delay",
+                message: "duration must not be shorter than base_retry_delay",
+            });
+        }
+        chrono::Duration::from_std(self.max_retry_delay).map_err(|_| {
+            CatalogWorkerError::InvalidPolicy {
+                field: "max_retry_delay",
+                message: "duration cannot be represented as a timestamp delta",
+            }
+        })?;
+        if self.max_page_bytes < self.max_document_bytes {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "max_page_bytes",
+                message: "limit must not be smaller than max_document_bytes",
+            });
+        }
+        if self.max_page_bytes < self.max_reference_bytes {
+            return Err(CatalogWorkerError::InvalidPolicy {
+                field: "max_page_bytes",
+                message: "limit must not be smaller than max_reference_bytes",
+            });
+        }
+        Ok(self)
+    }
+
+    fn retry_delay(self, attempt_count: u32, requested: Option<Duration>) -> Duration {
+        let exponent = attempt_count.saturating_sub(1).min(31);
+        let multiplier = 1_u32.checked_shl(exponent).unwrap_or(u32::MAX);
+        requested
+            .unwrap_or_else(|| self.base_retry_delay.saturating_mul(multiplier))
+            .min(self.max_retry_delay)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CatalogFailureReason {
+    PermanentFailure,
+    AttemptsExhausted,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CatalogWorkerOutcome {
+    Idle,
+    Succeeded {
+        run_id: Uuid,
+        coverage: SyncCoverage,
+        processed_count: u32,
+    },
+    RetryScheduled {
+        run_id: Uuid,
+        attempt_count: u32,
+        not_before: DateTime<Utc>,
+        failure: AdapterFailure,
+    },
+    Failed {
+        run_id: Uuid,
+        attempt_count: u32,
+        reason: CatalogFailureReason,
+        failure: AdapterFailure,
+    },
+}
+
+#[derive(Error)]
+pub enum CatalogWorkerError {
+    #[error("invalid catalog worker policy {field}: {message}")]
+    InvalidPolicy {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("catalog queue operation failed")]
+    Queue(#[from] CatalogSyncError),
+    #[error("catalog retry deadline exceeds the supported timestamp range")]
+    RetryDeadlineOverflow,
+}
+
+impl fmt::Debug for CatalogWorkerError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidPolicy { field, message } => formatter
+                .debug_struct("InvalidPolicy")
+                .field("field", field)
+                .field("message", message)
+                .finish(),
+            Self::Queue(_) => formatter.write_str("Queue([REDACTED])"),
+            Self::RetryDeadlineOverflow => formatter.write_str("RetryDeadlineOverflow"),
+        }
+    }
+}
+
+pub struct CatalogWorker<A> {
+    core: CatalogWorkerCore<CatalogSyncService, A>,
+}
+
+impl<A: CatalogAdapters> CatalogWorker<A> {
+    pub fn new(
+        queue: CatalogSyncService,
+        adapters: A,
+        policy: CatalogWorkerPolicy,
+    ) -> Result<Self, CatalogWorkerError> {
+        Ok(Self {
+            core: CatalogWorkerCore::new(queue, adapters, policy.validate()?),
+        })
+    }
+
+    pub async fn run_once(&self) -> Result<CatalogWorkerOutcome, CatalogWorkerError> {
+        self.core.run_once_at(Utc::now()).await
+    }
+}
+
+trait CatalogQueue: Send + Sync {
+    fn claim_next<'a>(&'a self, lease_for: Duration) -> QueueFuture<'a, Option<CatalogSyncLease>>;
+
+    fn renew<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        lease_for: Duration,
+    ) -> QueueFuture<'a, CatalogSyncLease>;
+
+    fn record<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        observation: AdapterObservation,
+    ) -> QueueFuture<'a, CatalogRowVersion>;
+
+    fn retry<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        failure_code: &'static str,
+        resume_cursor: Option<String>,
+        not_before: DateTime<Utc>,
+    ) -> QueueFuture<'a, ()>;
+
+    fn finish<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        outcome: FinishCatalogSyncRun,
+    ) -> QueueFuture<'a, ()>;
+}
+
+impl CatalogQueue for CatalogSyncService {
+    fn claim_next<'a>(&'a self, lease_for: Duration) -> QueueFuture<'a, Option<CatalogSyncLease>> {
+        Box::pin(async move { CatalogSyncService::claim_next(self, lease_for).await })
+    }
+
+    fn renew<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        lease_for: Duration,
+    ) -> QueueFuture<'a, CatalogSyncLease> {
+        Box::pin(async move {
+            CatalogSyncService::renew_lease(
+                self,
+                lease.run_id,
+                lease.row_version,
+                lease.lease_token,
+                lease_for,
+            )
+            .await
+        })
+    }
+
+    fn record<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        observation: AdapterObservation,
+    ) -> QueueFuture<'a, CatalogRowVersion> {
+        Box::pin(async move {
+            CatalogSyncService::record_observation(
+                self,
+                lease.run_id,
+                lease.row_version,
+                lease.lease_token,
+                CatalogReleaseObservation {
+                    external_release_id: observation.external_release_id,
+                    source_url: observation.source_url,
+                    raw_document: observation.raw_document,
+                    parsed_document: observation.parsed_document,
+                },
+            )
+            .await
+            .map(|recorded| recorded.run.row_version)
+        })
+    }
+
+    fn retry<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        failure_code: &'static str,
+        resume_cursor: Option<String>,
+        not_before: DateTime<Utc>,
+    ) -> QueueFuture<'a, ()> {
+        Box::pin(async move {
+            CatalogSyncService::retry_run(
+                self,
+                lease.run_id,
+                lease.row_version,
+                lease.lease_token,
+                failure_code,
+                resume_cursor,
+                not_before,
+            )
+            .await
+            .map(|_| ())
+        })
+    }
+
+    fn finish<'a>(
+        &'a self,
+        lease: &'a CatalogSyncLease,
+        outcome: FinishCatalogSyncRun,
+    ) -> QueueFuture<'a, ()> {
+        Box::pin(async move {
+            CatalogSyncService::finish_run(
+                self,
+                lease.run_id,
+                lease.row_version,
+                lease.lease_token,
+                outcome,
+            )
+            .await
+            .map(|_| ())
+        })
+    }
+}
+
+struct CatalogWorkerCore<Q, A> {
+    queue: Q,
+    adapters: A,
+    policy: CatalogWorkerPolicy,
+}
+
+impl<Q: CatalogQueue, A: CatalogAdapters> CatalogWorkerCore<Q, A> {
+    const fn new(queue: Q, adapters: A, policy: CatalogWorkerPolicy) -> Self {
+        Self {
+            queue,
+            adapters,
+            policy,
+        }
+    }
+
+    async fn run_once_at(
+        &self,
+        now: DateTime<Utc>,
+    ) -> Result<CatalogWorkerOutcome, CatalogWorkerError> {
+        let Some(mut lease) = self.queue.claim_next(self.policy.lease_for).await? else {
+            return Ok(CatalogWorkerOutcome::Idle);
+        };
+        let mut cursor = lease.requested_cursor.clone();
+        if cursor
+            .as_ref()
+            .is_some_and(|cursor| !reference_fits(cursor, self.policy))
+        {
+            return self
+                .handle_failure(
+                    lease,
+                    None,
+                    AdapterFailure::permanent("cursor_too_large", None),
+                    now,
+                )
+                .await;
+        }
+        let mut seen_cursors = HashSet::new();
+        if let Some(cursor) = cursor.as_ref() {
+            seen_cursors.insert(cursor.clone());
+        }
+        let mut declared_coverage = None;
+        let mut checkpoint = None;
+        let mut page_count = 0_u32;
+        let mut observed_count = 0_u32;
+
+        loop {
+            if page_count >= self.policy.max_pages.get() {
+                return self
+                    .handle_failure(
+                        lease,
+                        cursor,
+                        AdapterFailure::permanent("page_limit_exceeded", None),
+                        now,
+                    )
+                    .await;
+            }
+
+            lease = self.queue.renew(&lease, self.policy.lease_for).await?;
+            let page = match tokio::time::timeout(
+                self.policy.page_timeout,
+                self.adapters.fetch_page(&lease, cursor.as_deref()),
+            )
+            .await
+            {
+                Ok(Ok(page)) => page,
+                Ok(Err(failure)) => {
+                    return self.handle_failure(lease, cursor, failure, now).await;
+                }
+                Err(_) => {
+                    return self
+                        .handle_failure(
+                            lease,
+                            cursor,
+                            AdapterFailure::retryable("adapter_timeout", None, None),
+                            now,
+                        )
+                        .await;
+                }
+            };
+            // Network work may consume most of a lease. Renew before writing
+            // the page so every observation is owned by a current token.
+            lease = self.queue.renew(&lease, self.policy.lease_for).await?;
+
+            if let Err(failure) = validate_page(&page, declared_coverage, self.policy) {
+                return self.handle_failure(lease, cursor, failure, now).await;
+            }
+            declared_coverage.get_or_insert(page.coverage);
+            page_count = page_count.saturating_add(1);
+
+            for observation in page.observations {
+                if let Err(failure) = validate_observation(&observation, self.policy) {
+                    return self.handle_failure(lease, cursor, failure, now).await;
+                }
+                observed_count =
+                    observed_count
+                        .checked_add(1)
+                        .ok_or(CatalogWorkerError::InvalidPolicy {
+                            field: "max_total_observations",
+                            message: "counter overflow",
+                        })?;
+                if observed_count > self.policy.max_total_observations.get() {
+                    return self
+                        .handle_failure(
+                            lease,
+                            cursor,
+                            AdapterFailure::permanent("observation_limit_exceeded", None),
+                            now,
+                        )
+                        .await;
+                }
+                lease.row_version = self.queue.record(&lease, observation).await?;
+            }
+
+            if page.checkpoint.is_some() {
+                checkpoint = page.checkpoint;
+            }
+            if page.complete {
+                let coverage = declared_coverage.unwrap_or(SyncCoverage::DiscoveryOnly);
+                if coverage == SyncCoverage::FullSnapshot
+                    && observed_count == 0
+                    && !page.empty_full_snapshot_confirmed
+                {
+                    return self
+                        .handle_failure(
+                            lease,
+                            cursor,
+                            AdapterFailure::permanent("empty_full_snapshot_not_confirmed", None),
+                            now,
+                        )
+                        .await;
+                }
+                self.queue
+                    .finish(
+                        &lease,
+                        FinishCatalogSyncRun::Succeeded {
+                            result_cursor: checkpoint,
+                            coverage,
+                            snapshot_complete: true,
+                        },
+                    )
+                    .await?;
+                return Ok(CatalogWorkerOutcome::Succeeded {
+                    run_id: lease.run_id,
+                    coverage,
+                    processed_count: observed_count,
+                });
+            }
+
+            let next_cursor = page
+                .next_cursor
+                .expect("validated non-complete pages always have a cursor");
+            if !seen_cursors.insert(next_cursor.clone()) {
+                return self
+                    .handle_failure(
+                        lease,
+                        cursor,
+                        AdapterFailure::permanent("cursor_cycle", None),
+                        now,
+                    )
+                    .await;
+            }
+            cursor = Some(next_cursor);
+        }
+    }
+
+    async fn handle_failure(
+        &self,
+        lease: CatalogSyncLease,
+        resume_cursor: Option<String>,
+        failure: AdapterFailure,
+        now: DateTime<Utc>,
+    ) -> Result<CatalogWorkerOutcome, CatalogWorkerError> {
+        if failure.is_retryable() && lease.attempt_count < self.policy.max_attempts.get() {
+            let delay = self
+                .policy
+                .retry_delay(lease.attempt_count, failure.retry_after());
+            let delta = chrono::Duration::from_std(delay)
+                .map_err(|_| CatalogWorkerError::RetryDeadlineOverflow)?;
+            let not_before = now
+                .checked_add_signed(delta)
+                .ok_or(CatalogWorkerError::RetryDeadlineOverflow)?;
+            self.queue
+                .retry(&lease, failure.code(), resume_cursor, not_before)
+                .await?;
+            return Ok(CatalogWorkerOutcome::RetryScheduled {
+                run_id: lease.run_id,
+                attempt_count: lease.attempt_count,
+                not_before,
+                failure,
+            });
+        }
+
+        let reason = if failure.disposition() == AdapterFailureDisposition::Retryable {
+            CatalogFailureReason::AttemptsExhausted
+        } else {
+            CatalogFailureReason::PermanentFailure
+        };
+        self.queue
+            .finish(
+                &lease,
+                FinishCatalogSyncRun::Failed {
+                    error_message: failure.code().to_owned(),
+                },
+            )
+            .await?;
+        Ok(CatalogWorkerOutcome::Failed {
+            run_id: lease.run_id,
+            attempt_count: lease.attempt_count,
+            reason,
+            failure,
+        })
+    }
+}
+
+fn validate_page(
+    page: &AdapterPage,
+    previous_coverage: Option<SyncCoverage>,
+    policy: CatalogWorkerPolicy,
+) -> Result<(), AdapterFailure> {
+    if page.observations.len() > policy.max_observations_per_page.get() as usize {
+        return Err(AdapterFailure::permanent(
+            "page_observation_limit_exceeded",
+            None,
+        ));
+    }
+    if previous_coverage.is_some_and(|coverage| coverage != page.coverage) {
+        return Err(AdapterFailure::permanent("coverage_changed", None));
+    }
+    if page.complete == page.next_cursor.is_some() {
+        return Err(AdapterFailure::permanent("invalid_pagination_state", None));
+    }
+    if page
+        .next_cursor
+        .as_ref()
+        .is_some_and(|cursor| !reference_fits(cursor, policy))
+        || page
+            .checkpoint
+            .as_ref()
+            .is_some_and(|checkpoint| !reference_fits(checkpoint, policy))
+    {
+        return Err(AdapterFailure::permanent("cursor_too_large", None));
+    }
+    let page_bytes = page.observations.iter().try_fold(
+        page.next_cursor.as_ref().map_or(0, String::len)
+            + page.checkpoint.as_ref().map_or(0, String::len),
+        |total, observation| {
+            total
+                .checked_add(observation_bytes(observation))
+                .ok_or_else(|| AdapterFailure::permanent("page_size_overflow", None))
+        },
+    )?;
+    if page_bytes > policy.max_page_bytes.get() as usize {
+        return Err(AdapterFailure::permanent("page_too_large", None));
+    }
+    Ok(())
+}
+
+fn validate_observation(
+    observation: &AdapterObservation,
+    policy: CatalogWorkerPolicy,
+) -> Result<(), AdapterFailure> {
+    if observation.external_release_id.is_empty()
+        || observation.source_url.is_empty()
+        || observation.raw_document.is_empty()
+        || observation.parsed_document.is_empty()
+    {
+        return Err(AdapterFailure::permanent("invalid_observation", None));
+    }
+    if !reference_fits(&observation.external_release_id, policy)
+        || !reference_fits(&observation.source_url, policy)
+    {
+        return Err(AdapterFailure::permanent(
+            "observation_reference_too_large",
+            None,
+        ));
+    }
+    if observation.raw_document.len() > policy.max_document_bytes.get() as usize
+        || observation.parsed_document.len() > policy.max_document_bytes.get() as usize
+    {
+        return Err(AdapterFailure::permanent(
+            "observation_document_too_large",
+            None,
+        ));
+    }
+    Ok(())
+}
+
+fn reference_fits(value: &str, policy: CatalogWorkerPolicy) -> bool {
+    value.len() <= policy.max_reference_bytes.get() as usize
+}
+
+fn observation_bytes(observation: &AdapterObservation) -> usize {
+    observation
+        .external_release_id
+        .len()
+        .saturating_add(observation.source_url.len())
+        .saturating_add(observation.raw_document.len())
+        .saturating_add(observation.parsed_document.len())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::VecDeque, sync::Mutex};
+
+    use anni_catalog::CatalogSourceKind;
+
+    use super::*;
+    use crate::{AdapterFuture, CatalogAdapters};
+
+    struct FakeAdapters {
+        pages: Mutex<VecDeque<Result<AdapterPage, AdapterFailure>>>,
+    }
+
+    impl FakeAdapters {
+        fn new(pages: impl IntoIterator<Item = Result<AdapterPage, AdapterFailure>>) -> Self {
+            Self {
+                pages: Mutex::new(pages.into_iter().collect()),
+            }
+        }
+    }
+
+    impl CatalogAdapters for FakeAdapters {
+        fn fetch_page<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            _cursor: Option<&'a str>,
+        ) -> AdapterFuture<'a> {
+            let page = self.pages.lock().unwrap().pop_front().unwrap();
+            Box::pin(async move { page })
+        }
+    }
+
+    struct PendingAdapters;
+
+    impl CatalogAdapters for PendingAdapters {
+        fn fetch_page<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            _cursor: Option<&'a str>,
+        ) -> AdapterFuture<'a> {
+            Box::pin(std::future::pending())
+        }
+    }
+
+    #[derive(Debug, Clone, PartialEq, Eq)]
+    enum QueueAction {
+        Observation(AdapterObservation),
+        Retry {
+            code: &'static str,
+            cursor: Option<String>,
+            not_before: DateTime<Utc>,
+        },
+        Finish(FinishCatalogSyncRun),
+    }
+
+    struct FakeQueue {
+        lease: Mutex<Option<CatalogSyncLease>>,
+        current: Mutex<CatalogSyncLease>,
+        actions: Mutex<Vec<QueueAction>>,
+    }
+
+    impl FakeQueue {
+        fn new(lease: CatalogSyncLease) -> Self {
+            Self {
+                lease: Mutex::new(Some(lease.clone())),
+                current: Mutex::new(lease),
+                actions: Mutex::new(Vec::new()),
+            }
+        }
+
+        fn actions(&self) -> Vec<QueueAction> {
+            self.actions.lock().unwrap().clone()
+        }
+
+        fn advance(&self) -> CatalogSyncLease {
+            let mut lease = self.current.lock().unwrap();
+            lease.row_version = CatalogRowVersion::new(lease.row_version.get() + 1).unwrap();
+            lease.clone()
+        }
+    }
+
+    impl CatalogQueue for FakeQueue {
+        fn claim_next<'a>(
+            &'a self,
+            _lease_for: Duration,
+        ) -> QueueFuture<'a, Option<CatalogSyncLease>> {
+            let lease = self.lease.lock().unwrap().take();
+            Box::pin(async move { Ok(lease) })
+        }
+
+        fn renew<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            _lease_for: Duration,
+        ) -> QueueFuture<'a, CatalogSyncLease> {
+            let lease = self.advance();
+            Box::pin(async move { Ok(lease) })
+        }
+
+        fn record<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            observation: AdapterObservation,
+        ) -> QueueFuture<'a, CatalogRowVersion> {
+            self.actions
+                .lock()
+                .unwrap()
+                .push(QueueAction::Observation(observation));
+            let version = self.advance().row_version;
+            Box::pin(async move { Ok(version) })
+        }
+
+        fn retry<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            failure_code: &'static str,
+            resume_cursor: Option<String>,
+            not_before: DateTime<Utc>,
+        ) -> QueueFuture<'a, ()> {
+            self.actions.lock().unwrap().push(QueueAction::Retry {
+                code: failure_code,
+                cursor: resume_cursor,
+                not_before,
+            });
+            Box::pin(async { Ok(()) })
+        }
+
+        fn finish<'a>(
+            &'a self,
+            _lease: &'a CatalogSyncLease,
+            outcome: FinishCatalogSyncRun,
+        ) -> QueueFuture<'a, ()> {
+            self.actions
+                .lock()
+                .unwrap()
+                .push(QueueAction::Finish(outcome));
+            Box::pin(async { Ok(()) })
+        }
+    }
+
+    fn lease(attempt_count: u32) -> CatalogSyncLease {
+        CatalogSyncLease {
+            run_id: Uuid::new_v4(),
+            source_id: Uuid::new_v4(),
+            kind: CatalogSourceKind::ArtistWebsite,
+            locator: "https://artist.example/discography?token=must-not-leak".to_owned(),
+            storefront: None,
+            locale: Some("ja-JP".to_owned()),
+            configuration_document: None,
+            secret_ref: Some("secret/catalog/artist".to_owned()),
+            requested_cursor: None,
+            lease_token: Uuid::new_v4(),
+            lease_expires_at: Utc::now() + chrono::Duration::minutes(10),
+            attempt_count,
+            row_version: CatalogRowVersion::INITIAL,
+        }
+    }
+
+    fn observation(id: &str) -> AdapterObservation {
+        AdapterObservation {
+            external_release_id: id.to_owned(),
+            source_url: format!("https://artist.example/{id}?signature=must-not-leak"),
+            raw_document: format!(r#"{{"title":"作品・A〜B～C（初回）","id":"{id}"}}"#),
+            parsed_document: format!(
+                r#"{{"schemaVersion":1,"title":"作品・A〜B～C（初回）","id":"{id}"}}"#
+            ),
+        }
+    }
+
+    fn policy() -> CatalogWorkerPolicy {
+        CatalogWorkerPolicy {
+            lease_for: Duration::from_secs(60),
+            page_timeout: Duration::from_millis(20),
+            base_retry_delay: Duration::from_secs(10),
+            max_retry_delay: Duration::from_secs(40),
+            max_attempts: NonZeroU32::new(3).unwrap(),
+            max_pages: NonZeroU32::new(4).unwrap(),
+            max_observations_per_page: NonZeroU32::new(5).unwrap(),
+            max_total_observations: NonZeroU32::new(10).unwrap(),
+            max_reference_bytes: NonZeroU32::new(128).unwrap(),
+            max_document_bytes: NonZeroU32::new(1024).unwrap(),
+            max_page_bytes: NonZeroU32::new(4096).unwrap(),
+        }
+    }
+
+    #[tokio::test]
+    async fn complete_full_snapshot_records_exact_pages_then_succeeds() {
+        let queue = FakeQueue::new(lease(1));
+        let first = observation("album/100");
+        let second = observation("album/200");
+        let adapters = FakeAdapters::new([
+            Ok(AdapterPage {
+                observations: vec![first.clone()],
+                next_cursor: Some("page:2-secret".to_owned()),
+                checkpoint: None,
+                coverage: SyncCoverage::FullSnapshot,
+                complete: false,
+                empty_full_snapshot_confirmed: false,
+            }),
+            Ok(AdapterPage {
+                observations: vec![second.clone()],
+                next_cursor: None,
+                checkpoint: Some("next-run-secret".to_owned()),
+                coverage: SyncCoverage::FullSnapshot,
+                complete: true,
+                empty_full_snapshot_confirmed: false,
+            }),
+        ]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+
+        let outcome = worker.run_once_at(Utc::now()).await.unwrap();
+
+        assert!(matches!(
+            outcome,
+            CatalogWorkerOutcome::Succeeded {
+                coverage: SyncCoverage::FullSnapshot,
+                processed_count: 2,
+                ..
+            }
+        ));
+        let actions = worker.queue.actions();
+        assert_eq!(actions[0], QueueAction::Observation(first));
+        assert_eq!(actions[1], QueueAction::Observation(second));
+        assert!(matches!(
+            &actions[2],
+            QueueAction::Finish(FinishCatalogSyncRun::Succeeded {
+                result_cursor: Some(cursor),
+                coverage: SyncCoverage::FullSnapshot,
+                snapshot_complete: true,
+            }) if cursor == "next-run-secret"
+        ));
+        assert!(!format!("{outcome:?}").contains("must-not-leak"));
+    }
+
+    #[tokio::test]
+    async fn retryable_page_failure_preserves_the_private_resume_cursor() {
+        let lease = lease(1);
+        let run_id = lease.run_id;
+        let queue = FakeQueue::new(lease);
+        let failure = AdapterFailure::retryable("upstream_unavailable", Some(503), None);
+        let adapters = FakeAdapters::new([
+            Ok(AdapterPage {
+                observations: vec![observation("album/100")],
+                next_cursor: Some("page:2-secret".to_owned()),
+                checkpoint: None,
+                coverage: SyncCoverage::DiscoveryOnly,
+                complete: false,
+                empty_full_snapshot_confirmed: false,
+            }),
+            Err(failure),
+        ]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let now = DateTime::parse_from_rfc3339("2026-07-12T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let outcome = worker.run_once_at(now).await.unwrap();
+
+        assert_eq!(
+            outcome,
+            CatalogWorkerOutcome::RetryScheduled {
+                run_id,
+                attempt_count: 1,
+                not_before: now + chrono::Duration::seconds(10),
+                failure,
+            }
+        );
+        assert!(matches!(
+            worker.queue.actions().last(),
+            Some(QueueAction::Retry {
+                code: "upstream_unavailable",
+                cursor: Some(cursor),
+                ..
+            }) if cursor == "page:2-secret"
+        ));
+        assert!(!format!("{outcome:?}").contains("page:2-secret"));
+    }
+
+    #[tokio::test]
+    async fn malformed_pagination_and_exhausted_retries_finish_safely() {
+        let invalid_code = AdapterFailure::retryable("token secret", None, None);
+        assert_eq!(invalid_code.code(), "invalid_adapter_failure_code");
+        assert_eq!(
+            invalid_code.disposition(),
+            AdapterFailureDisposition::Permanent
+        );
+        assert!(!format!("{invalid_code:?}").contains("token secret"));
+
+        let queue = FakeQueue::new(lease(1));
+        let adapters = FakeAdapters::new([Ok(AdapterPage {
+            observations: vec![],
+            next_cursor: None,
+            checkpoint: None,
+            coverage: SyncCoverage::FullSnapshot,
+            complete: false,
+            empty_full_snapshot_confirmed: false,
+        })]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let malformed = worker.run_once_at(Utc::now()).await.unwrap();
+        assert!(matches!(
+            malformed,
+            CatalogWorkerOutcome::Failed {
+                reason: CatalogFailureReason::PermanentFailure,
+                failure,
+                ..
+            } if failure.code() == "invalid_pagination_state"
+        ));
+
+        let queue = FakeQueue::new(lease(policy().max_attempts.get()));
+        let failure = AdapterFailure::retryable("rate_limited", Some(429), None);
+        let adapters = FakeAdapters::new([Err(failure)]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let exhausted = worker.run_once_at(Utc::now()).await.unwrap();
+        assert!(matches!(
+            exhausted,
+            CatalogWorkerOutcome::Failed {
+                reason: CatalogFailureReason::AttemptsExhausted,
+                failure: actual,
+                ..
+            } if actual == failure
+        ));
+    }
+
+    #[tokio::test]
+    async fn empty_full_snapshot_requires_an_explicit_confirmation() {
+        let queue = FakeQueue::new(lease(1));
+        let adapters = FakeAdapters::new([Ok(AdapterPage {
+            observations: vec![],
+            next_cursor: None,
+            checkpoint: None,
+            coverage: SyncCoverage::FullSnapshot,
+            complete: true,
+            empty_full_snapshot_confirmed: false,
+        })]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let rejected = worker.run_once_at(Utc::now()).await.unwrap();
+        assert!(matches!(
+            rejected,
+            CatalogWorkerOutcome::Failed { failure, .. }
+                if failure.code() == "empty_full_snapshot_not_confirmed"
+        ));
+
+        let queue = FakeQueue::new(lease(1));
+        let adapters = FakeAdapters::new([Ok(AdapterPage {
+            observations: vec![],
+            next_cursor: None,
+            checkpoint: None,
+            coverage: SyncCoverage::FullSnapshot,
+            complete: true,
+            empty_full_snapshot_confirmed: true,
+        })]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let accepted = worker.run_once_at(Utc::now()).await.unwrap();
+        assert!(matches!(
+            accepted,
+            CatalogWorkerOutcome::Succeeded {
+                coverage: SyncCoverage::FullSnapshot,
+                processed_count: 0,
+                ..
+            }
+        ));
+    }
+
+    #[tokio::test]
+    async fn adapter_documents_are_bounded_before_persistence() {
+        let mut at_limit = observation("album/100");
+        at_limit.raw_document = "x".repeat(policy().max_document_bytes.get() as usize);
+        let queue = FakeQueue::new(lease(1));
+        let adapters = FakeAdapters::new([Ok(AdapterPage {
+            observations: vec![at_limit],
+            next_cursor: None,
+            checkpoint: None,
+            coverage: SyncCoverage::DiscoveryOnly,
+            complete: true,
+            empty_full_snapshot_confirmed: false,
+        })]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        assert!(matches!(
+            worker.run_once_at(Utc::now()).await.unwrap(),
+            CatalogWorkerOutcome::Succeeded {
+                processed_count: 1,
+                ..
+            }
+        ));
+
+        let mut oversized = observation("album/100");
+        oversized.raw_document = "x".repeat(policy().max_document_bytes.get() as usize + 1);
+        let queue = FakeQueue::new(lease(1));
+        let adapters = FakeAdapters::new([Ok(AdapterPage {
+            observations: vec![oversized],
+            next_cursor: None,
+            checkpoint: None,
+            coverage: SyncCoverage::DiscoveryOnly,
+            complete: true,
+            empty_full_snapshot_confirmed: false,
+        })]);
+        let worker = CatalogWorkerCore::new(queue, adapters, policy());
+        let rejected = worker.run_once_at(Utc::now()).await.unwrap();
+        assert!(matches!(
+            rejected,
+            CatalogWorkerOutcome::Failed { failure, .. }
+                if failure.code() == "observation_document_too_large"
+        ));
+    }
+
+    #[tokio::test]
+    async fn hung_adapter_page_is_cancelled_and_retried() {
+        let queue = FakeQueue::new(lease(1));
+        let worker = CatalogWorkerCore::new(queue, PendingAdapters, policy());
+        let now = DateTime::parse_from_rfc3339("2026-07-12T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let outcome = worker.run_once_at(now).await.unwrap();
+
+        assert!(matches!(
+            outcome,
+            CatalogWorkerOutcome::RetryScheduled { failure, .. }
+                if failure.code() == "adapter_timeout"
+        ));
+    }
+}
diff --git a/anni-catalog-worker/tests/runner_repository.rs b/anni-catalog-worker/tests/runner_repository.rs
new file mode 100644
index 00000000..35c96eb0
--- /dev/null
+++ b/anni-catalog-worker/tests/runner_repository.rs
@@ -0,0 +1,122 @@
+#![cfg(feature = "sqlite")]
+
+use anni_catalog::{CatalogSourceKind, SyncCoverage, SyncRunStatus};
+use anni_catalog_worker::{
+    AdapterFuture, AdapterObservation, AdapterPage, CatalogAdapter, CatalogAdapterRegistry,
+    CatalogWorker, CatalogWorkerOutcome, CatalogWorkerPolicy,
+};
+use annim::{
+    catalog::{
+        CatalogRepository, CatalogService, CatalogSyncService, NewCatalogArtist, NewCatalogSource,
+        NewCatalogSyncRun,
+    },
+    entities::catalog_source_release_revision,
+    migrator::Migrator,
+};
+use sea_orm::{ConnectOptions, Database, EntityTrait};
+use sea_orm_migration::MigratorTrait;
+
+const RAW: &str = r#"{"title":"作品・A〜B～C（初回）"}"#;
+const PARSED: &str = r#"{"schemaVersion":1,"title":"作品・A〜B～C（初回）","kind":"album"}"#;
+
+struct FixtureAdapter;
+
+impl CatalogAdapter for FixtureAdapter {
+    fn source_kind(&self) -> CatalogSourceKind {
+        CatalogSourceKind::Vgmdb
+    }
+
+    fn fetch_page<'a>(
+        &'a self,
+        _lease: &'a annim::catalog::CatalogSyncLease,
+        cursor: Option<&'a str>,
+    ) -> AdapterFuture<'a> {
+        assert!(cursor.is_none());
+        Box::pin(async {
+            Ok(AdapterPage {
+                observations: vec![AdapterObservation {
+                    external_release_id: "album/100".to_owned(),
+                    source_url: "https://vgmdb.net/album/100".to_owned(),
+                    raw_document: RAW.to_owned(),
+                    parsed_document: PARSED.to_owned(),
+                }],
+                next_cursor: None,
+                checkpoint: None,
+                coverage: SyncCoverage::FullSnapshot,
+                complete: true,
+                empty_full_snapshot_confirmed: false,
+            })
+        })
+    }
+}
+
+#[tokio::test]
+async fn runner_commits_exact_evidence_through_the_real_repository() {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+
+    let catalog = CatalogService::new(CatalogRepository::new(database.clone()));
+    let artist = catalog
+        .create_artist(NewCatalogArtist {
+            artist_id: None,
+            display_name: "Artist（公式）".to_owned(),
+            sort_name: None,
+            notes: None,
+        })
+        .await
+        .unwrap();
+    let sync = CatalogSyncService::new(database.clone());
+    let source = sync
+        .create_source(NewCatalogSource {
+            source_id: None,
+            artist_id: artist.artist_id,
+            kind: CatalogSourceKind::Vgmdb,
+            locator: "https://vgmdb.net/artist/1234".to_owned(),
+            storefront: None,
+            locale: Some("ja-JP".to_owned()),
+            configuration_document: None,
+            secret_ref: None,
+        })
+        .await
+        .unwrap();
+    let queued = sync
+        .start_run(NewCatalogSyncRun {
+            run_id: None,
+            source_id: source.source_id,
+            requested_cursor: None,
+        })
+        .await
+        .unwrap();
+
+    let mut adapters = CatalogAdapterRegistry::new();
+    adapters.register(FixtureAdapter).unwrap();
+    let worker =
+        CatalogWorker::new(sync.clone(), adapters, CatalogWorkerPolicy::default()).unwrap();
+    let outcome = worker.run_once().await.unwrap();
+    assert!(matches!(
+        outcome,
+        CatalogWorkerOutcome::Succeeded {
+            run_id,
+            coverage: SyncCoverage::FullSnapshot,
+            processed_count: 1,
+        } if run_id == queued.run_id
+    ));
+
+    let finished = sync.get_run(queued.run_id).await.unwrap().unwrap();
+    assert_eq!(finished.status, SyncRunStatus::Succeeded);
+    assert_eq!(finished.coverage, SyncCoverage::FullSnapshot);
+    assert!(finished.started_from_root);
+    assert!(finished.snapshot_complete);
+    assert_eq!(finished.observed_count, 1);
+    assert_eq!(finished.attempt_count, 1);
+
+    let revision = catalog_source_release_revision::Entity::find()
+        .one(&database)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(revision.raw_document, RAW);
+    assert_eq!(revision.parsed_document, PARSED);
+}
diff --git a/anni-catalog/Cargo.toml b/anni-catalog/Cargo.toml
new file mode 100644
index 00000000..30b4932e
--- /dev/null
+++ b/anni-catalog/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "anni-catalog"
+version = "0.1.0"
+publish = false
+
+edition.workspace = true
+authors.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+thiserror.workspace = true
+url = "2.5.8"
diff --git a/anni-catalog/src/collection.rs b/anni-catalog/src/collection.rs
new file mode 100644
index 00000000..09ed7650
--- /dev/null
+++ b/anni-catalog/src/collection.rs
@@ -0,0 +1,284 @@
+use std::{fmt, num::NonZeroU32, str::FromStr};
+
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CollectionState {
+    Missing,
+    Wanted,
+    Acquired,
+    Ingesting,
+    Published,
+    Unavailable,
+}
+
+impl CollectionState {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Missing => "missing",
+            Self::Wanted => "wanted",
+            Self::Acquired => "acquired",
+            Self::Ingesting => "ingesting",
+            Self::Published => "published",
+            Self::Unavailable => "unavailable",
+        }
+    }
+
+    pub const fn is_collected(self) -> bool {
+        matches!(self, Self::Acquired | Self::Ingesting | Self::Published)
+    }
+
+    pub const fn can_transition_to(self, next: Self) -> bool {
+        self as u8 == next as u8
+            || matches!(
+                (self, next),
+                (
+                    Self::Missing,
+                    Self::Wanted | Self::Acquired | Self::Unavailable
+                ) | (
+                    Self::Wanted,
+                    Self::Missing | Self::Acquired | Self::Unavailable
+                ) | (Self::Acquired, Self::Wanted | Self::Ingesting)
+                    | (Self::Ingesting, Self::Acquired | Self::Published)
+                    | (Self::Published, Self::Acquired)
+                    | (
+                        Self::Unavailable,
+                        Self::Missing | Self::Wanted | Self::Acquired
+                    )
+            )
+    }
+}
+
+impl fmt::Display for CollectionState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for CollectionState {
+    type Err = UnknownCollectionState;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "missing" => Ok(Self::Missing),
+            "wanted" => Ok(Self::Wanted),
+            "acquired" => Ok(Self::Acquired),
+            "ingesting" => Ok(Self::Ingesting),
+            "published" => Ok(Self::Published),
+            "unavailable" => Ok(Self::Unavailable),
+            _ => Err(UnknownCollectionState(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown collection state: {0}")]
+pub struct UnknownCollectionState(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ReleaseKind {
+    Album,
+    Single,
+    Ep,
+    Soundtrack,
+    Compilation,
+    Other,
+}
+
+impl ReleaseKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Album => "album",
+            Self::Single => "single",
+            Self::Ep => "ep",
+            Self::Soundtrack => "soundtrack",
+            Self::Compilation => "compilation",
+            Self::Other => "other",
+        }
+    }
+}
+
+impl fmt::Display for ReleaseKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for ReleaseKind {
+    type Err = UnknownReleaseKind;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "album" => Ok(Self::Album),
+            "single" => Ok(Self::Single),
+            "ep" => Ok(Self::Ep),
+            "soundtrack" => Ok(Self::Soundtrack),
+            "compilation" => Ok(Self::Compilation),
+            "other" => Ok(Self::Other),
+            _ => Err(UnknownReleaseKind(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown release kind: {0}")]
+pub struct UnknownReleaseKind(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum AudioCodec {
+    Flac,
+    Wav,
+    Alac,
+    Aac,
+    Mp3,
+    Opus,
+    Other,
+}
+
+impl AudioCodec {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Flac => "flac",
+            Self::Wav => "wav",
+            Self::Alac => "alac",
+            Self::Aac => "aac",
+            Self::Mp3 => "mp3",
+            Self::Opus => "opus",
+            Self::Other => "other",
+        }
+    }
+
+    pub const fn is_lossless(self) -> Option<bool> {
+        match self {
+            Self::Flac | Self::Wav | Self::Alac => Some(true),
+            Self::Aac | Self::Mp3 | Self::Opus => Some(false),
+            Self::Other => None,
+        }
+    }
+}
+
+impl fmt::Display for AudioCodec {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for AudioCodec {
+    type Err = UnknownAudioCodec;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "flac" => Ok(Self::Flac),
+            "wav" => Ok(Self::Wav),
+            "alac" => Ok(Self::Alac),
+            "aac" => Ok(Self::Aac),
+            "mp3" => Ok(Self::Mp3),
+            "opus" => Ok(Self::Opus),
+            "other" => Ok(Self::Other),
+            _ => Err(UnknownAudioCodec(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown audio codec: {0}")]
+pub struct UnknownAudioCodec(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum QualityTier {
+    Unknown,
+    Lossy,
+    Lossless,
+    HiResLossless,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct AudioProperties {
+    codec: AudioCodec,
+    sample_rate_hz: Option<NonZeroU32>,
+    bit_depth: Option<u8>,
+    channels: Option<u8>,
+}
+
+impl AudioProperties {
+    pub fn new(
+        codec: AudioCodec,
+        sample_rate_hz: Option<NonZeroU32>,
+        bit_depth: Option<u8>,
+        channels: Option<u8>,
+    ) -> Result<Self, AudioPropertiesError> {
+        if bit_depth == Some(0) {
+            return Err(AudioPropertiesError::ZeroBitDepth);
+        }
+        if channels == Some(0) {
+            return Err(AudioPropertiesError::ZeroChannels);
+        }
+        Ok(Self {
+            codec,
+            sample_rate_hz,
+            bit_depth,
+            channels,
+        })
+    }
+
+    pub const fn codec(self) -> AudioCodec {
+        self.codec
+    }
+
+    pub const fn sample_rate_hz(self) -> Option<NonZeroU32> {
+        self.sample_rate_hz
+    }
+
+    pub const fn bit_depth(self) -> Option<u8> {
+        self.bit_depth
+    }
+
+    pub const fn channels(self) -> Option<u8> {
+        self.channels
+    }
+
+    pub const fn quality_tier(self) -> QualityTier {
+        match self.codec.is_lossless() {
+            Some(false) => QualityTier::Lossy,
+            None => QualityTier::Unknown,
+            Some(true)
+                if matches!(self.bit_depth, Some(depth) if depth > 16)
+                    || matches!(self.sample_rate_hz, Some(rate) if rate.get() > 48_000) =>
+            {
+                QualityTier::HiResLossless
+            }
+            Some(true) => QualityTier::Lossless,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum AudioPropertiesError {
+    #[error("bit depth must be greater than zero when known")]
+    ZeroBitDepth,
+    #[error("channel count must be greater than zero when known")]
+    ZeroChannels,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn quality_tier_uses_codec_and_measured_properties() {
+        let cd = AudioProperties::new(AudioCodec::Flac, NonZeroU32::new(44_100), Some(16), Some(2))
+            .unwrap();
+        let hi_res =
+            AudioProperties::new(AudioCodec::Flac, NonZeroU32::new(96_000), Some(24), Some(2))
+                .unwrap();
+        let lossy =
+            AudioProperties::new(AudioCodec::Aac, NonZeroU32::new(48_000), None, Some(2)).unwrap();
+
+        assert_eq!(cd.quality_tier(), QualityTier::Lossless);
+        assert_eq!(hi_res.quality_tier(), QualityTier::HiResLossless);
+        assert_eq!(lossy.quality_tier(), QualityTier::Lossy);
+        assert!(CollectionState::Acquired.is_collected());
+        assert!(CollectionState::Acquired.can_transition_to(CollectionState::Ingesting));
+        assert!(!CollectionState::Missing.can_transition_to(CollectionState::Published));
+    }
+}
diff --git a/anni-catalog/src/cover.rs b/anni-catalog/src/cover.rs
new file mode 100644
index 00000000..c56de85d
--- /dev/null
+++ b/anni-catalog/src/cover.rs
@@ -0,0 +1,365 @@
+use std::{cmp::Ordering, fmt, num::NonZeroU32, str::FromStr};
+
+use thiserror::Error;
+use url::Url;
+
+const PREFERRED_APPLE_ARTWORK_SIZE: u16 = 10_000;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CoverMediaType {
+    Jpeg,
+    Png,
+    Webp,
+}
+
+impl CoverMediaType {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Jpeg => "image/jpeg",
+            Self::Png => "image/png",
+            Self::Webp => "image/webp",
+        }
+    }
+
+    pub const fn extension(self) -> &'static str {
+        match self {
+            Self::Jpeg => "jpg",
+            Self::Png => "png",
+            Self::Webp => "webp",
+        }
+    }
+}
+
+impl fmt::Display for CoverMediaType {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for CoverMediaType {
+    type Err = UnknownCoverMediaType;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "image/jpeg" => Ok(Self::Jpeg),
+            "image/png" => Ok(Self::Png),
+            "image/webp" => Ok(Self::Webp),
+            _ => Err(UnknownCoverMediaType(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unsupported cover media type: {0}")]
+pub struct UnknownCoverMediaType(String);
+
+/// Return the only storage key form accepted for verified cover masters.
+/// The caller supplies a SHA-256 digest calculated from the encoded bytes.
+pub fn cover_asset_storage_key(content_sha256: &[u8; 32], media_type: CoverMediaType) -> String {
+    let mut encoded = String::with_capacity(64);
+    for byte in content_sha256 {
+        use std::fmt::Write as _;
+        write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail");
+    }
+    format!(
+        "sha256/{}/{}/{}.{}",
+        &encoded[..2],
+        &encoded[2..4],
+        encoded,
+        media_type.extension()
+    )
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CoverCandidateState {
+    Discovered,
+    Queued,
+    Fetching,
+    Verified,
+    Rejected,
+}
+
+impl CoverCandidateState {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Discovered => "discovered",
+            Self::Queued => "queued",
+            Self::Fetching => "fetching",
+            Self::Verified => "verified",
+            Self::Rejected => "rejected",
+        }
+    }
+
+    pub const fn can_transition_to(self, next: Self) -> bool {
+        self as u8 == next as u8
+            || matches!(
+                (self, next),
+                (Self::Discovered, Self::Queued | Self::Rejected)
+                    | (Self::Queued, Self::Fetching | Self::Rejected)
+                    | (
+                        Self::Fetching,
+                        Self::Verified | Self::Queued | Self::Rejected
+                    )
+                    | (Self::Rejected, Self::Queued)
+            )
+    }
+}
+
+impl fmt::Display for CoverCandidateState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for CoverCandidateState {
+    type Err = UnknownCoverCandidateState;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "discovered" => Ok(Self::Discovered),
+            "queued" => Ok(Self::Queued),
+            "fetching" => Ok(Self::Fetching),
+            "verified" => Ok(Self::Verified),
+            "rejected" => Ok(Self::Rejected),
+            _ => Err(UnknownCoverCandidateState(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown cover candidate state: {0}")]
+pub struct UnknownCoverCandidateState(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CoverQuality {
+    width: NonZeroU32,
+    height: NonZeroU32,
+    byte_length: u64,
+}
+
+impl CoverQuality {
+    pub const fn new(width: NonZeroU32, height: NonZeroU32, byte_length: u64) -> Self {
+        Self {
+            width,
+            height,
+            byte_length,
+        }
+    }
+
+    pub const fn width(self) -> NonZeroU32 {
+        self.width
+    }
+
+    pub const fn height(self) -> NonZeroU32 {
+        self.height
+    }
+
+    pub const fn byte_length(self) -> u64 {
+        self.byte_length
+    }
+
+    pub fn pixel_area(self) -> u64 {
+        u64::from(self.width.get()) * u64::from(self.height.get())
+    }
+
+    pub const fn shortest_side(self) -> u32 {
+        if self.width.get() < self.height.get() {
+            self.width.get()
+        } else {
+            self.height.get()
+        }
+    }
+}
+
+impl Ord for CoverQuality {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.shortest_side()
+            .cmp(&other.shortest_side())
+            .then_with(|| self.pixel_area().cmp(&other.pixel_area()))
+            .then_with(|| self.byte_length.cmp(&other.byte_length))
+    }
+}
+
+impl PartialOrd for CoverQuality {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+/// Validate a remote cover URL and remove Amazon's filename compression block.
+///
+/// Query parameters are preserved because they can contain signed access
+/// credentials rather than image transforms. Non-Amazon URLs are returned
+/// byte-for-byte after validation.
+pub fn canonicalize_cover_url(value: &str) -> Result<String, CoverUrlError> {
+    let url = validate_remote_url(value)?;
+    if !is_amazon_image_host(url.host_str().expect("validated URL has host")) {
+        return Ok(value.to_owned());
+    }
+
+    canonicalize_amazon_url(url)
+}
+
+/// Derive an original-quality request URL for a known Amazon image CDN.
+/// Unknown hosts are rejected so source-specific rules cannot be applied to
+/// an unrelated website.
+pub fn preferred_amazon_artwork_url(value: &str) -> Result<String, CoverUrlError> {
+    let url = validate_remote_url(value)?;
+    if !is_amazon_image_host(url.host_str().expect("validated URL has host")) {
+        return Err(CoverUrlError::NotAmazonArtworkHost);
+    }
+    canonicalize_amazon_url(url)
+}
+
+fn canonicalize_amazon_url(mut url: Url) -> Result<String, CoverUrlError> {
+    if let Some(path) = amazon_original_path(url.path()) {
+        url.set_path(&path);
+    }
+    url.set_fragment(None);
+    Ok(url.into())
+}
+
+/// Expand the width/height placeholders from Apple Music artwork responses.
+/// The server still verifies the downloaded dimensions before accepting it.
+pub fn preferred_apple_artwork_url(template: &str) -> Result<String, CoverUrlError> {
+    if !template.contains("{w}") || !template.contains("{h}") {
+        return Err(CoverUrlError::MissingAppleSizeTemplate);
+    }
+    let expanded = template
+        .replace("{w}", &PREFERRED_APPLE_ARTWORK_SIZE.to_string())
+        .replace("{h}", &PREFERRED_APPLE_ARTWORK_SIZE.to_string())
+        .replace("{f}", "jpg");
+    let url = validate_remote_url(&expanded)?;
+    let host = url.host_str().expect("validated URL has host");
+    if host != "mzstatic.com" && !host.ends_with(".mzstatic.com") {
+        return Err(CoverUrlError::NotAppleArtworkHost);
+    }
+    Ok(expanded)
+}
+
+fn validate_remote_url(value: &str) -> Result<Url, CoverUrlError> {
+    let url = Url::parse(value).map_err(CoverUrlError::InvalidUrl)?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(CoverUrlError::UnsupportedScheme);
+    }
+    if url.host_str().is_none() {
+        return Err(CoverUrlError::MissingHost);
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(CoverUrlError::EmbeddedCredentials);
+    }
+    Ok(url)
+}
+
+fn is_amazon_image_host(host: &str) -> bool {
+    host == "m.media-amazon.com"
+        || host.ends_with(".media-amazon.com")
+        || host == "ssl-images-amazon.com"
+        || host.ends_with(".ssl-images-amazon.com")
+        || host == "images.amazon.com"
+        || host.ends_with(".images-amazon.com")
+}
+
+fn amazon_original_path(path: &str) -> Option<String> {
+    let filename_start = path.rfind('/').map_or(0, |index| index + 1);
+    let filename = &path[filename_start..];
+    let parameter_start = filename.rfind("._")?;
+    let after_start = &filename[parameter_start + 2..];
+    let parameter_end = after_start.find("_.")?;
+    let remove_end = filename_start + parameter_start + 2 + parameter_end + 1;
+    let remove_start = filename_start + parameter_start;
+    let mut result = path.to_owned();
+    result.replace_range(remove_start..remove_end, "");
+    Some(result)
+}
+
+#[derive(Debug, Error)]
+pub enum CoverUrlError {
+    #[error("invalid cover URL: {0}")]
+    InvalidUrl(#[source] url::ParseError),
+    #[error("cover URL must use HTTP or HTTPS")]
+    UnsupportedScheme,
+    #[error("cover URL must include a host")]
+    MissingHost,
+    #[error("cover URL cannot contain embedded credentials")]
+    EmbeddedCredentials,
+    #[error("Apple artwork URL must include both {{w}} and {{h}} placeholders")]
+    MissingAppleSizeTemplate,
+    #[error("Apple artwork URL must use an mzstatic.com host")]
+    NotAppleArtworkHost,
+    #[error("Amazon artwork URL must use a known Amazon image CDN host")]
+    NotAmazonArtworkHost,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn amazon_compression_block_is_removed() {
+        let source = "https://m.media-amazon.com/images/I/81abc._AC_SL1500_.jpg?x=1";
+        assert_eq!(
+            canonicalize_cover_url(source).unwrap(),
+            "https://m.media-amazon.com/images/I/81abc.jpg?x=1"
+        );
+        assert!(matches!(
+            preferred_amazon_artwork_url("https://artist.example/cover._SL100_.jpg"),
+            Err(CoverUrlError::NotAmazonArtworkHost)
+        ));
+    }
+
+    #[test]
+    fn validated_non_amazon_url_is_not_rewritten() {
+        let source = "https://artist.example/ジャケット（初回）.png?size=full";
+        assert_eq!(canonicalize_cover_url(source).unwrap(), source);
+        assert!(matches!(
+            canonicalize_cover_url("file:///tmp/cover.jpg"),
+            Err(CoverUrlError::UnsupportedScheme)
+        ));
+    }
+
+    #[test]
+    fn apple_artwork_template_requests_preferred_size() {
+        let template = "https://is1-ssl.mzstatic.com/image/thumb/Music/a/b/c/{w}x{h}bb.{f}";
+        assert_eq!(
+            preferred_apple_artwork_url(template).unwrap(),
+            "https://is1-ssl.mzstatic.com/image/thumb/Music/a/b/c/10000x10000bb.jpg"
+        );
+    }
+
+    #[test]
+    fn cover_quality_prefers_shortest_side_then_pixels_and_bytes() {
+        let small = CoverQuality::new(
+            NonZeroU32::new(1_000).unwrap(),
+            NonZeroU32::new(1_000).unwrap(),
+            2_000_000,
+        );
+        let large = CoverQuality::new(
+            NonZeroU32::new(2_000).unwrap(),
+            NonZeroU32::new(2_000).unwrap(),
+            1_000_000,
+        );
+        assert!(large > small);
+
+        let banner = CoverQuality::new(
+            NonZeroU32::new(20_000).unwrap(),
+            NonZeroU32::new(100).unwrap(),
+            3_000_000,
+        );
+        assert!(small > banner);
+    }
+
+    #[test]
+    fn cover_candidate_fetch_lifecycle_is_recoverable() {
+        assert!(CoverCandidateState::Discovered.can_transition_to(CoverCandidateState::Queued));
+        assert!(CoverCandidateState::Queued.can_transition_to(CoverCandidateState::Fetching));
+        assert!(CoverCandidateState::Fetching.can_transition_to(CoverCandidateState::Queued));
+        assert!(CoverCandidateState::Fetching.can_transition_to(CoverCandidateState::Verified));
+        assert!(!CoverCandidateState::Verified.can_transition_to(CoverCandidateState::Queued));
+
+        assert_eq!(
+            cover_asset_storage_key(&[0xab; 32], CoverMediaType::Jpeg),
+            format!("sha256/ab/ab/{}.jpg", "ab".repeat(32))
+        );
+    }
+}
diff --git a/anni-catalog/src/lib.rs b/anni-catalog/src/lib.rs
new file mode 100644
index 00000000..e765fe3d
--- /dev/null
+++ b/anni-catalog/src/lib.rs
@@ -0,0 +1,19 @@
+//! Domain types for the server-side collection catalog.
+//!
+//! This crate deliberately separates desired/observed releases from files in
+//! the ingest pipeline. Network sources produce observations; they never
+//! overwrite canonical metadata or claim that audio has been collected.
+
+mod collection;
+mod cover;
+mod source;
+
+pub use collection::{AudioCodec, AudioProperties, CollectionState, QualityTier, ReleaseKind};
+pub use cover::{
+    canonicalize_cover_url, cover_asset_storage_key, preferred_amazon_artwork_url,
+    preferred_apple_artwork_url, CoverCandidateState, CoverMediaType, CoverQuality, CoverUrlError,
+    UnknownCoverMediaType,
+};
+pub use source::{
+    AcquisitionSourceKind, CatalogSourceKind, CoverSourceKind, SyncCoverage, SyncRunStatus,
+};
diff --git a/anni-catalog/src/source.rs b/anni-catalog/src/source.rs
new file mode 100644
index 00000000..b48afde3
--- /dev/null
+++ b/anni-catalog/src/source.rs
@@ -0,0 +1,277 @@
+use std::{fmt, str::FromStr};
+
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CatalogSourceKind {
+    AppleMusic,
+    RecordLabel,
+    ArtistWebsite,
+    Vgmdb,
+    Manual,
+}
+
+impl CatalogSourceKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::AppleMusic => "apple_music",
+            Self::RecordLabel => "record_label",
+            Self::ArtistWebsite => "artist_website",
+            Self::Vgmdb => "vgmdb",
+            Self::Manual => "manual",
+        }
+    }
+}
+
+impl fmt::Display for CatalogSourceKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for CatalogSourceKind {
+    type Err = UnknownCatalogSourceKind;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "apple_music" => Ok(Self::AppleMusic),
+            "record_label" => Ok(Self::RecordLabel),
+            "artist_website" => Ok(Self::ArtistWebsite),
+            "vgmdb" => Ok(Self::Vgmdb),
+            "manual" => Ok(Self::Manual),
+            _ => Err(UnknownCatalogSourceKind(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown catalog source kind: {0}")]
+pub struct UnknownCatalogSourceKind(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum AcquisitionSourceKind {
+    OwnedCd,
+    AngelAnime,
+    PrivateTracker,
+    BitTorrent,
+    FriendShare,
+    Streaming,
+    Other,
+}
+
+impl AcquisitionSourceKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::OwnedCd => "owned_cd",
+            Self::AngelAnime => "angel_anime",
+            Self::PrivateTracker => "private_tracker",
+            Self::BitTorrent => "bit_torrent",
+            Self::FriendShare => "friend_share",
+            Self::Streaming => "streaming",
+            Self::Other => "other",
+        }
+    }
+}
+
+impl fmt::Display for AcquisitionSourceKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for AcquisitionSourceKind {
+    type Err = UnknownAcquisitionSourceKind;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "owned_cd" => Ok(Self::OwnedCd),
+            "angel_anime" => Ok(Self::AngelAnime),
+            "private_tracker" => Ok(Self::PrivateTracker),
+            "bit_torrent" => Ok(Self::BitTorrent),
+            "friend_share" => Ok(Self::FriendShare),
+            "streaming" => Ok(Self::Streaming),
+            "other" => Ok(Self::Other),
+            _ => Err(UnknownAcquisitionSourceKind(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown acquisition source kind: {0}")]
+pub struct UnknownAcquisitionSourceKind(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum CoverSourceKind {
+    AppleMusic,
+    Amazon,
+    RecordLabel,
+    ArtistWebsite,
+    Vgmdb,
+    Manual,
+}
+
+impl CoverSourceKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::AppleMusic => "apple_music",
+            Self::Amazon => "amazon",
+            Self::RecordLabel => "record_label",
+            Self::ArtistWebsite => "artist_website",
+            Self::Vgmdb => "vgmdb",
+            Self::Manual => "manual",
+        }
+    }
+}
+
+impl fmt::Display for CoverSourceKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for CoverSourceKind {
+    type Err = UnknownCoverSourceKind;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "apple_music" => Ok(Self::AppleMusic),
+            "amazon" => Ok(Self::Amazon),
+            "record_label" => Ok(Self::RecordLabel),
+            "artist_website" => Ok(Self::ArtistWebsite),
+            "vgmdb" => Ok(Self::Vgmdb),
+            "manual" => Ok(Self::Manual),
+            _ => Err(UnknownCoverSourceKind(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown cover source kind: {0}")]
+pub struct UnknownCoverSourceKind(String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum SyncRunStatus {
+    Queued,
+    Running,
+    Succeeded,
+    Failed,
+    Cancelled,
+}
+
+impl SyncRunStatus {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Queued => "queued",
+            Self::Running => "running",
+            Self::Succeeded => "succeeded",
+            Self::Failed => "failed",
+            Self::Cancelled => "cancelled",
+        }
+    }
+
+    pub const fn can_transition_to(self, next: Self) -> bool {
+        self as u8 == next as u8
+            || matches!(
+                (self, next),
+                (Self::Queued, Self::Running | Self::Failed | Self::Cancelled)
+                    | (
+                        Self::Running,
+                        Self::Queued | Self::Succeeded | Self::Failed | Self::Cancelled
+                    )
+            )
+    }
+}
+
+impl fmt::Display for SyncRunStatus {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for SyncRunStatus {
+    type Err = UnknownSyncRunStatus;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "queued" => Ok(Self::Queued),
+            "running" => Ok(Self::Running),
+            "succeeded" => Ok(Self::Succeeded),
+            "failed" => Ok(Self::Failed),
+            "cancelled" => Ok(Self::Cancelled),
+            _ => Err(UnknownSyncRunStatus(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown sync run status: {0}")]
+pub struct UnknownSyncRunStatus(String);
+
+/// How much of a remote catalog a synchronization run is expected to cover.
+///
+/// This value is intentionally separate from run success. A successful
+/// incremental or discovery run is useful evidence, but it must never imply
+/// that releases omitted from that response disappeared from the catalog.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum SyncCoverage {
+    FullSnapshot,
+    Incremental,
+    DiscoveryOnly,
+}
+
+impl SyncCoverage {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::FullSnapshot => "full_snapshot",
+            Self::Incremental => "incremental",
+            Self::DiscoveryOnly => "discovery_only",
+        }
+    }
+
+    pub const fn may_infer_absence(self) -> bool {
+        matches!(self, Self::FullSnapshot)
+    }
+}
+
+impl fmt::Display for SyncCoverage {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for SyncCoverage {
+    type Err = UnknownSyncCoverage;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "full_snapshot" => Ok(Self::FullSnapshot),
+            "incremental" => Ok(Self::Incremental),
+            "discovery_only" => Ok(Self::DiscoveryOnly),
+            _ => Err(UnknownSyncCoverage(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown sync coverage: {0}")]
+pub struct UnknownSyncCoverage(String);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_complete_snapshot_coverage_can_support_absence_inference() {
+        for coverage in [
+            SyncCoverage::FullSnapshot,
+            SyncCoverage::Incremental,
+            SyncCoverage::DiscoveryOnly,
+        ] {
+            assert_eq!(SyncCoverage::from_str(coverage.as_str()), Ok(coverage));
+        }
+        assert!(SyncCoverage::FullSnapshot.may_infer_absence());
+        assert!(!SyncCoverage::Incremental.may_infer_absence());
+        assert!(!SyncCoverage::DiscoveryOnly.may_infer_absence());
+        assert!(SyncRunStatus::Running.can_transition_to(SyncRunStatus::Queued));
+    }
+}
diff --git a/anni-common/Cargo.toml b/anni-common/Cargo.toml
index eb5c3721..48cd61d3 100644
--- a/anni-common/Cargo.toml
+++ b/anni-common/Cargo.toml
@@ -26,3 +26,6 @@ serde.workspace = true
 serde_json.workspace = true
 
 trash = { version = "5.2.6", optional = true }
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/anni-common/src/fs.rs b/anni-common/src/fs.rs
index eac79d3d..566d04f2 100644
--- a/anni-common/src/fs.rs
+++ b/anni-common/src/fs.rs
@@ -271,6 +271,7 @@ where
     }
 
     match rename(from.as_ref(), to.as_ref()) {
+        Ok(()) => Ok(()),
         Err(e) if is_cross_device_error(&e) => {
             debug!("Failed to rename across filesystems. Copying instead.");
 
@@ -279,11 +280,10 @@ where
 
             fs::remove_dir_all(from.as_ref())?;
             debug!("Source directory removed.");
+            Ok(())
         }
-        _ => {}
-    };
-
-    Ok(())
+        Err(error) => Err(error),
+    }
 }
 
 /// Checks raw os error code of `error`.
@@ -306,3 +306,23 @@ fn is_cross_device_error(error: &io::Error) -> bool {
         false
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn move_dir_keeps_source_when_rename_fails() {
+        let root = tempfile::tempdir().unwrap();
+        let source = root.path().join("source");
+        let source_file = source.join("track.flac");
+        create_dir(&source).unwrap();
+        write(&source_file, b"audio data").unwrap();
+
+        let destination = root.path().join("missing-parent").join("destination");
+        let error = move_dir(&source, destination).unwrap_err();
+
+        assert_eq!(error.kind(), io::ErrorKind::NotFound);
+        assert_eq!(read(source_file).unwrap(), b"audio data");
+    }
+}
diff --git a/anni-cover-worker/Cargo.toml b/anni-cover-worker/Cargo.toml
new file mode 100644
index 00000000..582d05b3
--- /dev/null
+++ b/anni-cover-worker/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "anni-cover-worker"
+version = "0.1.0"
+publish = false
+
+edition.workspace = true
+authors.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+anni-catalog.workspace = true
+anni-ingest.workspace = true
+futures-util = "0.3"
+image = "0.25"
+reqwest = { workspace = true, features = ["stream"] }
+sha2 = "0.10.9"
+thiserror.workspace = true
+tokio = { version = "1", features = ["fs", "io-util", "net", "time"] }
+url = "2.5.8"
+uuid.workspace = true
+
+[dev-dependencies]
+tempfile = "3.27.0"
diff --git a/anni-cover-worker/src/lib.rs b/anni-cover-worker/src/lib.rs
new file mode 100644
index 00000000..cefa07da
--- /dev/null
+++ b/anni-cover-worker/src/lib.rs
@@ -0,0 +1,664 @@
+//! Safe remote cover acquisition and content-addressed storage.
+//!
+//! Network access ends in this crate. Annim persists candidates and leases;
+//! immutable ingest plans only see the verified local asset digest and key.
+
+use std::{
+    collections::HashSet,
+    fmt,
+    fs::{self, File},
+    io::Read,
+    net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anni_catalog::{cover_asset_storage_key, CoverMediaType};
+use anni_ingest::Digest;
+use futures_util::StreamExt;
+use image::{ImageFormat, ImageReader, Limits};
+use reqwest::{
+    header::{ACCEPT, LOCATION},
+    redirect::Policy,
+    Response, StatusCode,
+};
+use sha2::{Digest as ShaDigest, Sha256};
+use thiserror::Error;
+use tokio::io::AsyncWriteExt;
+use url::Url;
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CoverFetchPolicy {
+    pub max_redirects: usize,
+    pub max_encoded_bytes: u64,
+    pub max_dimension: u32,
+    pub max_pixels: u64,
+    pub connect_timeout: Duration,
+    pub request_timeout: Duration,
+}
+
+impl Default for CoverFetchPolicy {
+    fn default() -> Self {
+        Self {
+            max_redirects: 5,
+            max_encoded_bytes: 100 * 1024 * 1024,
+            max_dimension: 20_000,
+            max_pixels: 120_000_000,
+            connect_timeout: Duration::from_secs(10),
+            request_timeout: Duration::from_secs(45),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct AssetStore {
+    root: PathBuf,
+    incoming: PathBuf,
+}
+
+impl AssetStore {
+    pub fn open(root: impl AsRef<Path>) -> Result<Self, CoverWorkerError> {
+        let root = fs::canonicalize(root)?;
+        if !root.is_dir() {
+            return Err(CoverWorkerError::AssetRootNotDirectory { path: root });
+        }
+        let incoming = root.join(".incoming");
+        fs::create_dir_all(&incoming)?;
+        let incoming = fs::canonicalize(incoming)?;
+        if !incoming.starts_with(&root) {
+            return Err(CoverWorkerError::AssetRootNotDirectory { path: root });
+        }
+        Ok(Self { root, incoming })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    fn pending_path(&self) -> PathBuf {
+        self.incoming.join(format!("{}.partial", Uuid::new_v4()))
+    }
+
+    fn target_path(&self, storage_key: &str) -> PathBuf {
+        storage_key
+            .split('/')
+            .fold(self.root.clone(), |path, component| path.join(component))
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct VerifiedCoverDownload {
+    digest: Digest,
+    storage_key: String,
+    media_type: CoverMediaType,
+    width: u32,
+    height: u32,
+    byte_length: u64,
+    effective_url: String,
+}
+
+impl VerifiedCoverDownload {
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+
+    pub fn storage_key(&self) -> &str {
+        &self.storage_key
+    }
+
+    pub const fn media_type(&self) -> CoverMediaType {
+        self.media_type
+    }
+
+    pub const fn width(&self) -> u32 {
+        self.width
+    }
+
+    pub const fn height(&self) -> u32 {
+        self.height
+    }
+
+    pub const fn byte_length(&self) -> u64 {
+        self.byte_length
+    }
+
+    /// This URL may contain signed query parameters. It is intended only for
+    /// persistence in the private candidate record, never ordinary logging.
+    pub fn effective_url(&self) -> &str {
+        &self.effective_url
+    }
+}
+
+impl fmt::Debug for VerifiedCoverDownload {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("VerifiedCoverDownload")
+            .field("digest", &self.digest)
+            .field("storage_key", &self.storage_key)
+            .field("media_type", &self.media_type)
+            .field("width", &self.width)
+            .field("height", &self.height)
+            .field("byte_length", &self.byte_length)
+            .field("effective_origin", &origin_label(&self.effective_url))
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CoverDownloader {
+    policy: CoverFetchPolicy,
+}
+
+impl CoverDownloader {
+    pub const fn new(policy: CoverFetchPolicy) -> Self {
+        Self { policy }
+    }
+
+    pub const fn policy(&self) -> CoverFetchPolicy {
+        self.policy
+    }
+
+    pub async fn download(
+        &self,
+        requested_url: &str,
+        store: &AssetStore,
+    ) -> Result<VerifiedCoverDownload, CoverWorkerError> {
+        let mut url = validate_remote_url(requested_url)?;
+        let mut redirects = 0_usize;
+        let response = loop {
+            let response = self.request_once(&url).await?;
+            if !is_followed_redirect(response.status()) {
+                break response;
+            }
+            if redirects >= self.policy.max_redirects {
+                return Err(CoverWorkerError::TooManyRedirects);
+            }
+            url = redirect_target(&url, &response)?;
+            redirects += 1;
+            // The next request will resolve and pin the new host again.
+        };
+
+        if !response.status().is_success() {
+            return Err(CoverWorkerError::HttpStatus {
+                status: response.status().as_u16(),
+                origin: origin_label(response.url().as_str()),
+            });
+        }
+        if response
+            .content_length()
+            .is_some_and(|length| length > self.policy.max_encoded_bytes)
+        {
+            return Err(CoverWorkerError::BodyTooLarge {
+                limit: self.policy.max_encoded_bytes,
+            });
+        }
+
+        let effective_url = response.url().to_string();
+        let pending_path = store.pending_path();
+        let mut pending = PendingFile::new(pending_path.clone());
+        let mut output = tokio::fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&pending_path)
+            .await?;
+        let mut hasher = Sha256::new();
+        let mut byte_length = 0_u64;
+        let mut body = response.bytes_stream();
+        while let Some(chunk) = body.next().await {
+            let chunk = chunk.map_err(|source| CoverWorkerError::Request {
+                origin: origin_label(&effective_url),
+                source: source.without_url(),
+            })?;
+            byte_length = byte_length.checked_add(chunk.len() as u64).ok_or(
+                CoverWorkerError::BodyTooLarge {
+                    limit: self.policy.max_encoded_bytes,
+                },
+            )?;
+            if byte_length > self.policy.max_encoded_bytes {
+                return Err(CoverWorkerError::BodyTooLarge {
+                    limit: self.policy.max_encoded_bytes,
+                });
+            }
+            hasher.update(&chunk);
+            output.write_all(&chunk).await?;
+        }
+        output.flush().await?;
+        output.sync_all().await?;
+        drop(output);
+
+        if byte_length == 0 {
+            return Err(CoverWorkerError::EmptyBody);
+        }
+        let digest = Digest::new(hasher.finalize().into());
+        let policy = self.policy;
+        let store = store.clone();
+        let verified = tokio::task::spawn_blocking(move || {
+            verify_and_commit(&store, &pending_path, digest, byte_length, policy)
+        })
+        .await
+        .map_err(|_| CoverWorkerError::VerifierPanicked)??;
+        // The object is a hard link to the fsynced partial; removing only the
+        // worker-owned name cannot remove the content-addressed object.
+        if fs::remove_file(&pending.path).is_ok() {
+            pending.committed = true;
+        }
+
+        Ok(VerifiedCoverDownload {
+            digest,
+            storage_key: verified.storage_key,
+            media_type: verified.media_type,
+            width: verified.width,
+            height: verified.height,
+            byte_length,
+            effective_url,
+        })
+    }
+
+    async fn request_once(&self, url: &Url) -> Result<Response, CoverWorkerError> {
+        validate_url(url)?;
+        let host = url
+            .host_str()
+            .ok_or(CoverWorkerError::MissingHost)?
+            .to_owned();
+        let port = url.port_or_known_default().unwrap_or(443);
+        let addrs = resolve_public_addrs(&host, port).await?;
+        let client = reqwest::Client::builder()
+            .redirect(Policy::none())
+            .no_proxy()
+            .referer(false)
+            .connect_timeout(self.policy.connect_timeout)
+            .timeout(self.policy.request_timeout)
+            .user_agent("ProjectAnni-CoverWorker/0.1")
+            .resolve_to_addrs(&host, &addrs)
+            .build()
+            .map_err(|source| CoverWorkerError::Client(source.without_url()))?;
+        client
+            .get(url.clone())
+            .header(ACCEPT, "image/webp,image/png,image/jpeg;q=0.9")
+            .send()
+            .await
+            .map_err(|source| CoverWorkerError::Request {
+                origin: origin_label(url.as_str()),
+                source: source.without_url(),
+            })
+    }
+}
+
+impl Default for CoverDownloader {
+    fn default() -> Self {
+        Self::new(CoverFetchPolicy::default())
+    }
+}
+
+fn is_followed_redirect(status: StatusCode) -> bool {
+    matches!(
+        status,
+        StatusCode::MOVED_PERMANENTLY
+            | StatusCode::FOUND
+            | StatusCode::SEE_OTHER
+            | StatusCode::TEMPORARY_REDIRECT
+            | StatusCode::PERMANENT_REDIRECT
+    )
+}
+
+fn redirect_target(current: &Url, response: &Response) -> Result<Url, CoverWorkerError> {
+    let location = response
+        .headers()
+        .get(LOCATION)
+        .ok_or(CoverWorkerError::RedirectWithoutLocation)?
+        .to_str()
+        .map_err(|_| CoverWorkerError::InvalidRedirectLocation)?;
+    let target = current
+        .join(location)
+        .map_err(|_| CoverWorkerError::InvalidRedirectLocation)?;
+    validate_url(&target)?;
+    Ok(target)
+}
+
+fn validate_remote_url(value: &str) -> Result<Url, CoverWorkerError> {
+    let url = Url::parse(value).map_err(CoverWorkerError::InvalidUrl)?;
+    validate_url(&url)?;
+    Ok(url)
+}
+
+fn validate_url(url: &Url) -> Result<(), CoverWorkerError> {
+    if url.scheme() != "https" {
+        return Err(CoverWorkerError::HttpsRequired);
+    }
+    if url.host_str().is_none() {
+        return Err(CoverWorkerError::MissingHost);
+    }
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(CoverWorkerError::EmbeddedCredentials);
+    }
+    Ok(())
+}
+
+async fn resolve_public_addrs(host: &str, port: u16) -> Result<Vec<SocketAddr>, CoverWorkerError> {
+    let resolved = tokio::net::lookup_host((host, port))
+        .await
+        .map_err(|source| CoverWorkerError::Resolve {
+            host: host.to_owned(),
+            source,
+        })?;
+    let mut unique = HashSet::new();
+    for address in resolved {
+        if !is_public_ip(address.ip()) {
+            return Err(CoverWorkerError::ForbiddenAddress {
+                host: host.to_owned(),
+                address: address.ip(),
+            });
+        }
+        unique.insert(address);
+    }
+    if unique.is_empty() {
+        return Err(CoverWorkerError::NoAddresses {
+            host: host.to_owned(),
+        });
+    }
+    Ok(unique.into_iter().collect())
+}
+
+fn is_public_ip(address: IpAddr) -> bool {
+    match address {
+        IpAddr::V4(address) => is_public_ipv4(address),
+        IpAddr::V6(address) => is_public_ipv6(address),
+    }
+}
+
+fn is_public_ipv4(address: Ipv4Addr) -> bool {
+    let [a, b, c, _] = address.octets();
+    !(address.is_private()
+        || address.is_loopback()
+        || address.is_link_local()
+        || address.is_multicast()
+        || address.is_broadcast()
+        || address.is_documentation()
+        || address.is_unspecified()
+        || a == 0
+        || (a == 100 && (64..=127).contains(&b))
+        || (a == 192 && b == 0 && c == 0)
+        || (a == 192 && b == 88 && c == 99)
+        || (a == 198 && matches!(b, 18 | 19))
+        || a >= 240)
+}
+
+fn is_public_ipv6(address: Ipv6Addr) -> bool {
+    if let Some(mapped) = address.to_ipv4_mapped() {
+        return is_public_ipv4(mapped);
+    }
+    let first = address.segments()[0];
+    !address.is_unspecified()
+        && !address.is_loopback()
+        && !address.is_multicast()
+        && !address.is_unique_local()
+        && !address.is_unicast_link_local()
+        && !(first & 0xffc0 == 0xfec0)
+        && address.segments()[0..2] != [0x2001, 0x0db8]
+        // Be conservative: currently allocated global unicast space.
+        && first & 0xe000 == 0x2000
+}
+
+#[derive(Debug)]
+struct CommittedAsset {
+    storage_key: String,
+    media_type: CoverMediaType,
+    width: u32,
+    height: u32,
+}
+
+fn verify_and_commit(
+    store: &AssetStore,
+    pending_path: &Path,
+    digest: Digest,
+    byte_length: u64,
+    policy: CoverFetchPolicy,
+) -> Result<CommittedAsset, CoverWorkerError> {
+    let (media_type, width, height) = inspect_image(pending_path, policy)?;
+    let storage_key = cover_asset_storage_key(digest.as_bytes(), media_type);
+    let target = store.target_path(&storage_key);
+    let requested_parent = target
+        .parent()
+        .ok_or_else(|| CoverWorkerError::InvalidStorageKey(storage_key.clone()))?;
+    fs::create_dir_all(requested_parent)?;
+    let parent = fs::canonicalize(requested_parent)?;
+    if !parent.starts_with(&store.root) {
+        return Err(CoverWorkerError::AssetPathEscapesRoot { path: parent });
+    }
+    let file_name = target
+        .file_name()
+        .ok_or_else(|| CoverWorkerError::InvalidStorageKey(storage_key.clone()))?;
+    let target = parent.join(file_name);
+    match fs::hard_link(pending_path, &target) {
+        Ok(()) => File::open(parent)?.sync_all()?,
+        Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
+            if fs::symlink_metadata(&target)?.file_type().is_symlink() {
+                return Err(CoverWorkerError::AssetPathEscapesRoot { path: target });
+            }
+            let (actual_digest, actual_length) = digest_file(&target)?;
+            if actual_digest != digest || actual_length != byte_length {
+                return Err(CoverWorkerError::DigestCollision { storage_key });
+            }
+        }
+        Err(error) => return Err(error.into()),
+    }
+    Ok(CommittedAsset {
+        storage_key,
+        media_type,
+        width,
+        height,
+    })
+}
+
+fn inspect_image(
+    path: &Path,
+    policy: CoverFetchPolicy,
+) -> Result<(CoverMediaType, u32, u32), CoverWorkerError> {
+    let reader = ImageReader::open(path)?.with_guessed_format()?;
+    let format = reader
+        .format()
+        .ok_or(CoverWorkerError::UnsupportedImageFormat)?;
+    let media_type = match format {
+        ImageFormat::Jpeg => CoverMediaType::Jpeg,
+        ImageFormat::Png => CoverMediaType::Png,
+        ImageFormat::WebP => CoverMediaType::Webp,
+        _ => return Err(CoverWorkerError::UnsupportedImageFormat),
+    };
+    let (width, height) = reader.into_dimensions()?;
+    let pixels = u64::from(width)
+        .checked_mul(u64::from(height))
+        .ok_or(CoverWorkerError::ImageTooLarge)?;
+    if width == 0
+        || height == 0
+        || width > policy.max_dimension
+        || height > policy.max_dimension
+        || pixels > policy.max_pixels
+    {
+        return Err(CoverWorkerError::ImageTooLarge);
+    }
+
+    let mut limits = Limits::default();
+    limits.max_image_width = Some(policy.max_dimension);
+    limits.max_image_height = Some(policy.max_dimension);
+    limits.max_alloc = policy.max_pixels.checked_mul(4);
+    let mut reader = ImageReader::open(path)?.with_guessed_format()?;
+    reader.limits(limits);
+    reader.decode()?;
+    Ok((media_type, width, height))
+}
+
+fn digest_file(path: &Path) -> Result<(Digest, u64), CoverWorkerError> {
+    let mut file = File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut length = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let read = file.read(&mut buffer)?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+        length = length
+            .checked_add(read as u64)
+            .ok_or(CoverWorkerError::ImageTooLarge)?;
+    }
+    Ok((Digest::new(hasher.finalize().into()), length))
+}
+
+fn origin_label(value: &str) -> String {
+    Url::parse(value)
+        .ok()
+        .and_then(|url| {
+            url.host_str()
+                .map(|host| format!("{}://{host}", url.scheme()))
+        })
+        .unwrap_or_else(|| "remote origin".to_owned())
+}
+
+struct PendingFile {
+    path: PathBuf,
+    committed: bool,
+}
+
+impl PendingFile {
+    const fn new(path: PathBuf) -> Self {
+        Self {
+            path,
+            committed: false,
+        }
+    }
+}
+
+impl Drop for PendingFile {
+    fn drop(&mut self) {
+        if !self.committed {
+            let _ = fs::remove_file(&self.path);
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum CoverWorkerError {
+    #[error("invalid cover URL")]
+    InvalidUrl(#[source] url::ParseError),
+    #[error("cover downloads require HTTPS")]
+    HttpsRequired,
+    #[error("cover URL is missing a host")]
+    MissingHost,
+    #[error("cover URL cannot contain embedded credentials")]
+    EmbeddedCredentials,
+    #[error("could not resolve cover host {host}")]
+    Resolve {
+        host: String,
+        #[source]
+        source: std::io::Error,
+    },
+    #[error("cover host {host} resolved to forbidden address {address}")]
+    ForbiddenAddress { host: String, address: IpAddr },
+    #[error("cover host {host} resolved to no addresses")]
+    NoAddresses { host: String },
+    #[error("could not build cover HTTP client")]
+    Client(#[from] reqwest::Error),
+    #[error("cover request to {origin} failed")]
+    Request {
+        origin: String,
+        #[source]
+        source: reqwest::Error,
+    },
+    #[error("cover response from {origin} returned HTTP {status}")]
+    HttpStatus { status: u16, origin: String },
+    #[error("cover redirect is missing Location")]
+    RedirectWithoutLocation,
+    #[error("cover redirect Location is invalid")]
+    InvalidRedirectLocation,
+    #[error("cover response exceeded redirect limit")]
+    TooManyRedirects,
+    #[error("cover response exceeded {limit} encoded bytes")]
+    BodyTooLarge { limit: u64 },
+    #[error("cover response body is empty")]
+    EmptyBody,
+    #[error("downloaded cover format is unsupported")]
+    UnsupportedImageFormat,
+    #[error("downloaded cover exceeds configured image limits")]
+    ImageTooLarge,
+    #[error("verified cover storage key is invalid: {0}")]
+    InvalidStorageKey(String),
+    #[error("content digest collision at {storage_key}")]
+    DigestCollision { storage_key: String },
+    #[error("asset repository root is not a directory: {path}")]
+    AssetRootNotDirectory { path: PathBuf },
+    #[error("asset path resolves outside configured root: {path}")]
+    AssetPathEscapesRoot { path: PathBuf },
+    #[error("cover verifier task terminated unexpectedly")]
+    VerifierPanicked,
+    #[error(transparent)]
+    Image(#[from] image::ImageError),
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Cursor;
+
+    use image::{DynamicImage, ImageFormat};
+    use tempfile::tempdir;
+
+    use super::*;
+
+    #[test]
+    fn network_policy_rejects_local_and_non_https_targets() {
+        assert!(matches!(
+            validate_remote_url("http://example.com/cover.jpg"),
+            Err(CoverWorkerError::HttpsRequired)
+        ));
+        assert!(!is_public_ip("127.0.0.1".parse().unwrap()));
+        assert!(!is_public_ip("169.254.169.254".parse().unwrap()));
+        assert!(!is_public_ip("10.0.0.1".parse().unwrap()));
+        assert!(!is_public_ip("::1".parse().unwrap()));
+        assert!(!is_public_ip("fc00::1".parse().unwrap()));
+        assert!(is_public_ip("1.1.1.1".parse().unwrap()));
+        assert!(is_public_ip("2606:4700:4700::1111".parse().unwrap()));
+    }
+
+    #[test]
+    fn verified_image_is_deduplicated_without_overwrite() {
+        let root = tempdir().unwrap();
+        let store = AssetStore::open(root.path()).unwrap();
+        let image = DynamicImage::new_rgb8(8, 8);
+        let mut bytes = Cursor::new(Vec::new());
+        image.write_to(&mut bytes, ImageFormat::Png).unwrap();
+        let bytes = bytes.into_inner();
+        let digest = Digest::new(Sha256::digest(&bytes).into());
+        let pending = store.pending_path();
+        fs::write(&pending, &bytes).unwrap();
+
+        let committed = verify_and_commit(
+            &store,
+            &pending,
+            digest,
+            bytes.len() as u64,
+            CoverFetchPolicy::default(),
+        )
+        .unwrap();
+        assert_eq!(committed.media_type, CoverMediaType::Png);
+        assert_eq!((committed.width, committed.height), (8, 8));
+        assert_eq!(
+            fs::read(store.target_path(&committed.storage_key)).unwrap(),
+            bytes
+        );
+
+        let second = store.pending_path();
+        fs::write(&second, &bytes).unwrap();
+        let reused = verify_and_commit(
+            &store,
+            &second,
+            digest,
+            bytes.len() as u64,
+            CoverFetchPolicy::default(),
+        )
+        .unwrap();
+        assert_eq!(reused.storage_key, committed.storage_key);
+    }
+}
diff --git a/anni-ingest-worker/Cargo.toml b/anni-ingest-worker/Cargo.toml
new file mode 100644
index 00000000..fcc406d8
--- /dev/null
+++ b/anni-ingest-worker/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "anni-ingest-worker"
+version = "0.1.0"
+publish = false
+
+edition.workspace = true
+authors.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+anni-common.workspace = true
+anni-ingest.workspace = true
+anni-split.workspace = true
+sha2 = "0.10.9"
+thiserror.workspace = true
+uuid.workspace = true
+which = "8.0.4"
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/anni-ingest-worker/src/asset.rs b/anni-ingest-worker/src/asset.rs
new file mode 100644
index 00000000..6ccf7566
--- /dev/null
+++ b/anni-ingest-worker/src/asset.rs
@@ -0,0 +1,74 @@
+use std::{
+    fs::{self, File},
+    io::{Seek, SeekFrom},
+    path::{Path, PathBuf},
+};
+
+use anni_ingest::{Digest, SafeRelativePath};
+
+use crate::{join_protocol_path, source::digest_reader, WorkerError};
+
+/// A local, trusted repository of assets that were fetched and verified
+/// before an ingest plan was frozen.
+///
+/// This type intentionally exposes no network API. Every lookup is a safe
+/// relative path resolved beneath one canonical repository root.
+#[derive(Debug, Clone)]
+pub struct AssetRepository {
+    root: PathBuf,
+}
+
+impl AssetRepository {
+    pub fn open(root: impl AsRef<Path>) -> Result<Self, WorkerError> {
+        let root = fs::canonicalize(root)?;
+        if !root.is_dir() {
+            return Err(WorkerError::AssetRepositoryRootNotDirectory { path: root });
+        }
+        Ok(Self { root })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    pub(crate) fn open_verified(
+        &self,
+        path: &SafeRelativePath,
+        expected_digest: Digest,
+        expected_length: u64,
+    ) -> Result<File, WorkerError> {
+        let mut file = self.open_file(path)?;
+        let (actual_digest, actual_length) = digest_reader(&mut file)?;
+        if actual_length != expected_length {
+            return Err(WorkerError::AssetLengthMismatch {
+                path: path.clone(),
+                expected: expected_length,
+                actual: actual_length,
+            });
+        }
+        if actual_digest != expected_digest {
+            return Err(WorkerError::AssetDigestMismatch {
+                path: path.clone(),
+                expected: expected_digest,
+                actual: actual_digest,
+            });
+        }
+        file.seek(SeekFrom::Start(0))?;
+        Ok(file)
+    }
+
+    fn open_file(&self, path: &SafeRelativePath) -> Result<File, WorkerError> {
+        let joined = join_protocol_path(&self.root, path);
+        let resolved = fs::canonicalize(joined)?;
+        if !resolved.starts_with(&self.root) {
+            return Err(WorkerError::AssetEscapesRepository {
+                path: path.clone(),
+                root: self.root.clone(),
+            });
+        }
+        if !resolved.is_file() {
+            return Err(WorkerError::AssetNotFile { path: path.clone() });
+        }
+        Ok(File::open(resolved)?)
+    }
+}
diff --git a/anni-ingest-worker/src/executor.rs b/anni-ingest-worker/src/executor.rs
new file mode 100644
index 00000000..35937309
--- /dev/null
+++ b/anni-ingest-worker/src/executor.rs
@@ -0,0 +1,459 @@
+use std::{
+    fs::{self, File, OpenOptions},
+    io::{Cursor, Read, Seek, SeekFrom, Write},
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use anni_common::{
+    decode::raw_to_string,
+    traits::{Decode, Encode},
+};
+use anni_ingest::{
+    ExecutionPlan, InputManifest, PlanOperation, SafeRelativePath, SplitOutputFormat,
+};
+use anni_split::{
+    codec::{wav::WaveHeader, Encoder, FlacCommandEncoder},
+    CueSplitPlan, TrackRange,
+};
+
+use crate::{
+    join_protocol_path, source::digest_reader, AssetRepository, ExecutionReceipt, OutputReceipt,
+    SourceTree, WorkerError,
+};
+
+const PARTIAL_DIRECTORY: &str = ".anni-partials";
+
+pub struct StagingExecutor {
+    source: SourceTree,
+    asset_repository: Option<AssetRepository>,
+    staging_root: PathBuf,
+    partial_root: PathBuf,
+}
+
+impl StagingExecutor {
+    pub fn create(source: SourceTree, staging_root: impl AsRef<Path>) -> Result<Self, WorkerError> {
+        Self::create_inner(source, None, staging_root.as_ref())
+    }
+
+    /// Create an executor that can materialize already-verified assets from a
+    /// local repository. The repository is read-only from the worker's point
+    /// of view and may not contain the staging directory.
+    pub fn create_with_asset_repository(
+        source: SourceTree,
+        asset_repository: AssetRepository,
+        staging_root: impl AsRef<Path>,
+    ) -> Result<Self, WorkerError> {
+        Self::create_inner(source, Some(asset_repository), staging_root.as_ref())
+    }
+
+    fn create_inner(
+        source: SourceTree,
+        asset_repository: Option<AssetRepository>,
+        requested: &Path,
+    ) -> Result<Self, WorkerError> {
+        if requested.exists() {
+            return Err(WorkerError::StagingAlreadyExists {
+                path: requested.to_owned(),
+            });
+        }
+
+        let file_name = requested.file_name().ok_or_else(|| {
+            WorkerError::Io(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "staging path has no final component",
+            ))
+        })?;
+        let parent = requested
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+            .unwrap_or_else(|| Path::new("."));
+        let parent = fs::canonicalize(parent)?;
+        let staging_root = parent.join(file_name);
+        if staging_root.starts_with(source.root()) {
+            return Err(WorkerError::StagingInsideSource { path: staging_root });
+        }
+        if asset_repository
+            .as_ref()
+            .is_some_and(|repository| staging_root.starts_with(repository.root()))
+        {
+            return Err(WorkerError::StagingInsideAssetRepository { path: staging_root });
+        }
+
+        fs::create_dir(&staging_root)?;
+        let staging_root = fs::canonicalize(staging_root)?;
+        let partial_root = staging_root.join(PARTIAL_DIRECTORY);
+        fs::create_dir(&partial_root)?;
+
+        Ok(Self {
+            source,
+            asset_repository,
+            staging_root,
+            partial_root,
+        })
+    }
+
+    pub fn staging_root(&self) -> &Path {
+        &self.staging_root
+    }
+
+    pub fn execute(
+        &self,
+        plan: &ExecutionPlan,
+        manifest: &InputManifest,
+    ) -> Result<ExecutionReceipt, WorkerError> {
+        if plan.manifest_digest() != manifest.digest() {
+            return Err(WorkerError::ManifestMismatch {
+                plan: plan.manifest_digest(),
+                actual: manifest.digest(),
+            });
+        }
+        self.source.verify_manifest(manifest)?;
+
+        let mut receipts = Vec::new();
+        let mut partial_index = 0_usize;
+        for operation in plan.operations() {
+            match operation {
+                PlanOperation::CopyFile { source, target } => {
+                    receipts.push(self.copy_file(manifest, source, target, partial_index)?);
+                    partial_index += 1;
+                }
+                PlanOperation::MaterializeAsset {
+                    repository_path,
+                    digest,
+                    byte_length,
+                    target,
+                } => {
+                    receipts.push(self.materialize_asset(
+                        repository_path,
+                        *digest,
+                        *byte_length,
+                        target,
+                        partial_index,
+                    )?);
+                    partial_index += 1;
+                }
+                PlanOperation::SplitCueWave {
+                    cue,
+                    wave,
+                    outputs,
+                    format,
+                } => {
+                    let (mut split_receipts, used) =
+                        self.split_wave(manifest, cue, wave, outputs, *format, partial_index)?;
+                    receipts.append(&mut split_receipts);
+                    partial_index += used;
+                }
+            }
+        }
+
+        Ok(ExecutionReceipt::new(
+            plan.job_id(),
+            manifest.digest(),
+            plan.digest(),
+            receipts,
+        ))
+    }
+
+    fn copy_file(
+        &self,
+        manifest: &InputManifest,
+        source: &SafeRelativePath,
+        target: &SafeRelativePath,
+        partial_index: usize,
+    ) -> Result<OutputReceipt, WorkerError> {
+        let entry = manifest
+            .entry(source)
+            .expect("execution plan source was validated against this manifest");
+        let mut input = self.source.open_verified(entry)?;
+        let target_path = self.prepare_target(target)?;
+        let partial_path = self.partial_path(partial_index);
+        let mut output = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&partial_path)?;
+        std::io::copy(&mut input, &mut output)?;
+        output.flush()?;
+        output.sync_all()?;
+
+        let (digest, byte_length) = digest_file(&partial_path)?;
+        if byte_length != entry.byte_length() {
+            return Err(WorkerError::SourceLengthChanged {
+                path: source.clone(),
+                expected: entry.byte_length(),
+                actual: byte_length,
+            });
+        }
+        if digest != entry.digest() {
+            return Err(WorkerError::SourceDigestChanged {
+                path: source.clone(),
+                expected: entry.digest(),
+                actual: digest,
+            });
+        }
+
+        self.promote_partial(&partial_path, &target_path, target)?;
+        Ok(OutputReceipt::new(target.clone(), byte_length, digest))
+    }
+
+    fn materialize_asset(
+        &self,
+        repository_path: &SafeRelativePath,
+        expected_digest: anni_ingest::Digest,
+        expected_length: u64,
+        target: &SafeRelativePath,
+        partial_index: usize,
+    ) -> Result<OutputReceipt, WorkerError> {
+        let repository = self
+            .asset_repository
+            .as_ref()
+            .ok_or(WorkerError::AssetRepositoryNotConfigured)?;
+        let mut input =
+            repository.open_verified(repository_path, expected_digest, expected_length)?;
+        let target_path = self.prepare_target(target)?;
+        let partial_path = self.partial_path(partial_index);
+        let mut output = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(&partial_path)?;
+        std::io::copy(&mut input, &mut output)?;
+        output.flush()?;
+        output.sync_all()?;
+
+        // Verify the bytes in staging as well as the repository source. This
+        // catches repository changes that race with the copy and makes the
+        // receipt attest to the exact immutable plan input.
+        let (actual_digest, actual_length) = digest_file(&partial_path)?;
+        if actual_length != expected_length {
+            return Err(WorkerError::AssetLengthMismatch {
+                path: repository_path.clone(),
+                expected: expected_length,
+                actual: actual_length,
+            });
+        }
+        if actual_digest != expected_digest {
+            return Err(WorkerError::AssetDigestMismatch {
+                path: repository_path.clone(),
+                expected: expected_digest,
+                actual: actual_digest,
+            });
+        }
+
+        self.promote_partial(&partial_path, &target_path, target)?;
+        Ok(OutputReceipt::new(
+            target.clone(),
+            actual_length,
+            actual_digest,
+        ))
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn split_wave(
+        &self,
+        manifest: &InputManifest,
+        cue: &SafeRelativePath,
+        wave: &SafeRelativePath,
+        outputs: &[SafeRelativePath],
+        format: SplitOutputFormat,
+        first_partial_index: usize,
+    ) -> Result<(Vec<OutputReceipt>, usize), WorkerError> {
+        let cue_entry = manifest
+            .entry(cue)
+            .expect("execution plan CUE source was validated against this manifest");
+        let wave_entry = manifest
+            .entry(wave)
+            .expect("execution plan WAV source was validated against this manifest");
+
+        let mut cue_file = self.source.open_verified(cue_entry)?;
+        let mut cue_bytes = Vec::new();
+        cue_file.read_to_end(&mut cue_bytes)?;
+        let cue_text = raw_to_string(&cue_bytes);
+
+        let mut wave_file = self.source.open_verified(wave_entry)?;
+        let header = WaveHeader::from_reader(&mut wave_file)?;
+        let data_start = wave_file.stream_position()?;
+        let split_plan = CueSplitPlan::new(&cue_text, &header)?;
+        if split_plan.tracks().len() != outputs.len() {
+            return Err(WorkerError::SplitOutputCountMismatch {
+                expected: outputs.len(),
+                actual: split_plan.tracks().len(),
+            });
+        }
+        let planned_name = wave.as_str().rsplit('/').next().unwrap_or(wave.as_str());
+        let cue_name = split_plan
+            .source_file()
+            .rsplit(['/', '\\'])
+            .next()
+            .unwrap_or(split_plan.source_file());
+        if cue_name != planned_name {
+            return Err(WorkerError::CueWaveMismatch {
+                cue_file: split_plan.source_file().to_owned(),
+                planned_wave: wave.clone(),
+            });
+        }
+
+        let mut pending = Vec::with_capacity(outputs.len());
+        for (index, (range, target)) in split_plan.tracks().iter().zip(outputs.iter()).enumerate() {
+            let target_path = self.prepare_target(target)?;
+            let partial_path = self.partial_path(first_partial_index + index);
+            self.write_track(
+                &mut wave_file,
+                &header,
+                data_start,
+                range,
+                format,
+                &partial_path,
+            )?;
+            let (digest, byte_length) = digest_file(&partial_path)?;
+            pending.push((
+                target.clone(),
+                target_path,
+                partial_path,
+                byte_length,
+                digest,
+            ));
+        }
+
+        wave_file.seek(SeekFrom::Start(0))?;
+        let (actual_digest, actual_length) = digest_reader(&mut wave_file)?;
+        if actual_length != wave_entry.byte_length() {
+            return Err(WorkerError::SourceLengthChanged {
+                path: wave.clone(),
+                expected: wave_entry.byte_length(),
+                actual: actual_length,
+            });
+        }
+        if actual_digest != wave_entry.digest() {
+            return Err(WorkerError::SourceDigestChanged {
+                path: wave.clone(),
+                expected: wave_entry.digest(),
+                actual: actual_digest,
+            });
+        }
+
+        let mut receipts = Vec::with_capacity(pending.len());
+        for (target, target_path, partial_path, byte_length, digest) in pending {
+            self.promote_partial(&partial_path, &target_path, &target)?;
+            receipts.push(OutputReceipt::new(target, byte_length, digest));
+        }
+        Ok((receipts, outputs.len()))
+    }
+
+    fn write_track(
+        &self,
+        wave_file: &mut File,
+        header: &WaveHeader,
+        data_start: u64,
+        range: &TrackRange,
+        format: SplitOutputFormat,
+        partial_path: &Path,
+    ) -> Result<(), WorkerError> {
+        wave_file.seek(SeekFrom::Start(data_start + u64::from(range.start())))?;
+        let track_header = WaveHeader {
+            data_size: range.byte_length(),
+            ..header.clone()
+        };
+
+        match format {
+            SplitOutputFormat::Wav => {
+                let mut output = OpenOptions::new()
+                    .write(true)
+                    .create_new(true)
+                    .open(partial_path)?;
+                track_header.write_to(&mut output)?;
+                let actual = std::io::copy(
+                    &mut wave_file.take(u64::from(range.byte_length())),
+                    &mut output,
+                )?;
+                if actual != u64::from(range.byte_length()) {
+                    return Err(WorkerError::ShortTrackRead {
+                        track: range.track_number(),
+                        expected: u64::from(range.byte_length()),
+                        actual,
+                    });
+                }
+                output.flush()?;
+                output.sync_all()?;
+            }
+            SplitOutputFormat::Flac => {
+                let mut header_bytes = Cursor::new([0_u8; 44]);
+                track_header.write_to(&mut header_bytes)?;
+                header_bytes.set_position(0);
+                let body = wave_file.take(u64::from(range.byte_length()));
+                FlacCommandEncoder(partial_path).encode(header_bytes.chain(body))?;
+                verify_flac(partial_path)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn prepare_target(&self, target: &SafeRelativePath) -> Result<PathBuf, WorkerError> {
+        let target_path = join_protocol_path(&self.staging_root, target);
+        let parent = target_path
+            .parent()
+            .expect("safe relative path has a parent");
+        fs::create_dir_all(parent)?;
+        let resolved_parent = fs::canonicalize(parent)?;
+        if !resolved_parent.starts_with(&self.staging_root) {
+            return Err(WorkerError::TargetEscapesStaging {
+                path: target.clone(),
+            });
+        }
+        let target_path = resolved_parent.join(
+            target_path
+                .file_name()
+                .expect("safe relative path has a final component"),
+        );
+        if target_path.exists() {
+            return Err(WorkerError::TargetAlreadyExists {
+                path: target.clone(),
+            });
+        }
+        Ok(target_path)
+    }
+
+    fn partial_path(&self, index: usize) -> PathBuf {
+        self.partial_root.join(format!("{index:08}.tmp"))
+    }
+
+    fn promote_partial(
+        &self,
+        partial: &Path,
+        target_path: &Path,
+        target: &SafeRelativePath,
+    ) -> Result<(), WorkerError> {
+        match fs::hard_link(partial, target_path) {
+            Ok(()) => {
+                fs::remove_file(partial)?;
+                Ok(())
+            }
+            Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => {
+                Err(WorkerError::TargetAlreadyExists {
+                    path: target.clone(),
+                })
+            }
+            Err(error) => Err(error.into()),
+        }
+    }
+}
+
+fn digest_file(path: &Path) -> Result<(anni_ingest::Digest, u64), WorkerError> {
+    let mut file = File::open(path)?;
+    digest_reader(&mut file)
+}
+
+fn verify_flac(path: &Path) -> Result<(), WorkerError> {
+    let flac = which::which("flac").map_err(anni_split::error::SplitError::from)?;
+    let output = Command::new(flac)
+        .args(["--totally-silent", "--test"])
+        .arg(path)
+        .output()?;
+    if output.status.success() {
+        Ok(())
+    } else {
+        Err(WorkerError::FlacVerificationFailed {
+            status: output.status.code(),
+            stderr: String::from_utf8_lossy(&output.stderr).trim().to_owned(),
+        })
+    }
+}
diff --git a/anni-ingest-worker/src/lib.rs b/anni-ingest-worker/src/lib.rs
new file mode 100644
index 00000000..c659ecb5
--- /dev/null
+++ b/anni-ingest-worker/src/lib.rs
@@ -0,0 +1,111 @@
+//! Safe filesystem executor for immutable ingest plans.
+//!
+//! This crate is deliberately separate from `anni-ingest`: the latter defines
+//! pure domain rules, while this crate is the only layer allowed to read source
+//! files and write a job-specific staging directory.
+
+mod asset;
+mod executor;
+mod receipt;
+mod source;
+
+pub use asset::AssetRepository;
+pub use executor::StagingExecutor;
+pub use receipt::{ExecutionReceipt, OutputReceipt};
+pub use source::{SourceSpec, SourceTree};
+
+use std::{io, path::PathBuf};
+
+use anni_ingest::{Digest, ManifestError, SafeRelativePath};
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum WorkerError {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    Manifest(#[from] ManifestError),
+    #[error(transparent)]
+    WaveDecode(#[from] anni_common::decode::DecodeError),
+    #[error(transparent)]
+    CuePlan(#[from] anni_split::CueSplitPlanError),
+    #[error(transparent)]
+    Split(#[from] anni_split::error::SplitError),
+    #[error("source root is not a directory: {path}")]
+    SourceRootNotDirectory { path: PathBuf },
+    #[error("source path {path} resolves outside configured root {root}")]
+    SourceEscapesRoot {
+        path: SafeRelativePath,
+        root: PathBuf,
+    },
+    #[error("source path is not a regular file: {path}")]
+    SourceNotFile { path: SafeRelativePath },
+    #[error("source file {path} changed length: expected {expected}, actual {actual}")]
+    SourceLengthChanged {
+        path: SafeRelativePath,
+        expected: u64,
+        actual: u64,
+    },
+    #[error("source file {path} changed content: expected {expected}, actual {actual}")]
+    SourceDigestChanged {
+        path: SafeRelativePath,
+        expected: Digest,
+        actual: Digest,
+    },
+    #[error("no trusted asset repository was configured for this worker")]
+    AssetRepositoryNotConfigured,
+    #[error("asset repository root is not a directory: {path}")]
+    AssetRepositoryRootNotDirectory { path: PathBuf },
+    #[error("asset path {path} resolves outside configured repository {root}")]
+    AssetEscapesRepository {
+        path: SafeRelativePath,
+        root: PathBuf,
+    },
+    #[error("asset path is not a regular file: {path}")]
+    AssetNotFile { path: SafeRelativePath },
+    #[error("asset {path} has wrong length: expected {expected}, actual {actual}")]
+    AssetLengthMismatch {
+        path: SafeRelativePath,
+        expected: u64,
+        actual: u64,
+    },
+    #[error("asset {path} has wrong content: expected {expected}, actual {actual}")]
+    AssetDigestMismatch {
+        path: SafeRelativePath,
+        expected: Digest,
+        actual: Digest,
+    },
+    #[error("execution plan manifest {plan} does not match supplied manifest {actual}")]
+    ManifestMismatch { plan: Digest, actual: Digest },
+    #[error("staging path already exists: {path}")]
+    StagingAlreadyExists { path: PathBuf },
+    #[error("staging directory cannot be created inside immutable source root: {path}")]
+    StagingInsideSource { path: PathBuf },
+    #[error("staging directory cannot be created inside trusted asset repository: {path}")]
+    StagingInsideAssetRepository { path: PathBuf },
+    #[error("staging target resolves outside the job directory: {path}")]
+    TargetEscapesStaging { path: SafeRelativePath },
+    #[error("staging target already exists: {path}")]
+    TargetAlreadyExists { path: SafeRelativePath },
+    #[error("CUE describes {actual} tracks but plan declares {expected} outputs")]
+    SplitOutputCountMismatch { expected: usize, actual: usize },
+    #[error("CUE source file {cue_file:?} does not match planned WAV {planned_wave}")]
+    CueWaveMismatch {
+        cue_file: String,
+        planned_wave: SafeRelativePath,
+    },
+    #[error("track {track:02} produced {actual} PCM bytes, expected {expected}")]
+    ShortTrackRead {
+        track: u8,
+        expected: u64,
+        actual: u64,
+    },
+    #[error("FLAC verification failed with status {status:?}: {stderr}")]
+    FlacVerificationFailed { status: Option<i32>, stderr: String },
+}
+
+fn join_protocol_path(root: &std::path::Path, path: &SafeRelativePath) -> PathBuf {
+    path.as_str()
+        .split('/')
+        .fold(root.to_owned(), |joined, component| joined.join(component))
+}
diff --git a/anni-ingest-worker/src/receipt.rs b/anni-ingest-worker/src/receipt.rs
new file mode 100644
index 00000000..6b379ddd
--- /dev/null
+++ b/anni-ingest-worker/src/receipt.rs
@@ -0,0 +1,102 @@
+use sha2::{Digest as ShaDigest, Sha256};
+use uuid::Uuid;
+
+use anni_ingest::{Digest, SafeRelativePath};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct OutputReceipt {
+    path: SafeRelativePath,
+    byte_length: u64,
+    digest: Digest,
+}
+
+impl OutputReceipt {
+    pub const fn new(path: SafeRelativePath, byte_length: u64, digest: Digest) -> Self {
+        Self {
+            path,
+            byte_length,
+            digest,
+        }
+    }
+
+    pub const fn path(&self) -> &SafeRelativePath {
+        &self.path
+    }
+
+    pub const fn byte_length(&self) -> u64 {
+        self.byte_length
+    }
+
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExecutionReceipt {
+    job_id: Uuid,
+    manifest_digest: Digest,
+    plan_digest: Digest,
+    outputs: Vec<OutputReceipt>,
+    digest: Digest,
+}
+
+impl ExecutionReceipt {
+    pub(crate) fn new(
+        job_id: Uuid,
+        manifest_digest: Digest,
+        plan_digest: Digest,
+        mut outputs: Vec<OutputReceipt>,
+    ) -> Self {
+        outputs.sort_by(|left, right| left.path.cmp(&right.path));
+        let digest = receipt_digest(job_id, manifest_digest, plan_digest, &outputs);
+        Self {
+            job_id,
+            manifest_digest,
+            plan_digest,
+            outputs,
+            digest,
+        }
+    }
+
+    pub const fn job_id(&self) -> Uuid {
+        self.job_id
+    }
+
+    pub const fn manifest_digest(&self) -> Digest {
+        self.manifest_digest
+    }
+
+    pub const fn plan_digest(&self) -> Digest {
+        self.plan_digest
+    }
+
+    pub fn outputs(&self) -> &[OutputReceipt] {
+        &self.outputs
+    }
+
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+}
+
+fn receipt_digest(
+    job_id: Uuid,
+    manifest_digest: Digest,
+    plan_digest: Digest,
+    outputs: &[OutputReceipt],
+) -> Digest {
+    let mut hasher = Sha256::new();
+    hasher.update(b"anni-ingest-execution-receipt-v1\0");
+    hasher.update(job_id.as_bytes());
+    hasher.update(manifest_digest.as_bytes());
+    hasher.update(plan_digest.as_bytes());
+    hasher.update((outputs.len() as u64).to_be_bytes());
+    for output in outputs {
+        hasher.update((output.path.as_str().len() as u64).to_be_bytes());
+        hasher.update(output.path.as_str().as_bytes());
+        hasher.update(output.byte_length.to_be_bytes());
+        hasher.update(output.digest.as_bytes());
+    }
+    Digest::new(hasher.finalize().into())
+}
diff --git a/anni-ingest-worker/src/source.rs b/anni-ingest-worker/src/source.rs
new file mode 100644
index 00000000..bcc7cf49
--- /dev/null
+++ b/anni-ingest-worker/src/source.rs
@@ -0,0 +1,114 @@
+use std::{
+    fs::{self, File},
+    io::{Read, Seek, SeekFrom},
+    path::{Path, PathBuf},
+};
+
+use anni_ingest::{Digest, InputFileKind, InputManifest, ManifestEntry, SafeRelativePath};
+use sha2::{Digest as ShaDigest, Sha256};
+
+use crate::{join_protocol_path, WorkerError};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SourceSpec {
+    path: SafeRelativePath,
+    kind: InputFileKind,
+}
+
+impl SourceSpec {
+    pub const fn new(path: SafeRelativePath, kind: InputFileKind) -> Self {
+        Self { path, kind }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct SourceTree {
+    root: PathBuf,
+}
+
+impl SourceTree {
+    pub fn open(root: impl AsRef<Path>) -> Result<Self, WorkerError> {
+        let root = fs::canonicalize(root)?;
+        if !root.is_dir() {
+            return Err(WorkerError::SourceRootNotDirectory { path: root });
+        }
+        Ok(Self { root })
+    }
+
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    pub fn inspect(&self, specs: Vec<SourceSpec>) -> Result<InputManifest, WorkerError> {
+        let mut entries = Vec::with_capacity(specs.len());
+        for spec in specs {
+            let mut file = self.open_file(&spec.path)?;
+            let (digest, byte_length) = digest_reader(&mut file)?;
+            entries.push(ManifestEntry::new(
+                spec.path,
+                byte_length,
+                digest,
+                spec.kind,
+            ));
+        }
+        Ok(InputManifest::new(entries)?)
+    }
+
+    pub(crate) fn verify_manifest(&self, manifest: &InputManifest) -> Result<(), WorkerError> {
+        for entry in manifest.entries() {
+            self.open_verified(entry)?;
+        }
+        Ok(())
+    }
+
+    pub(crate) fn open_verified(&self, entry: &ManifestEntry) -> Result<File, WorkerError> {
+        let mut file = self.open_file(entry.path())?;
+        let (actual_digest, actual_length) = digest_reader(&mut file)?;
+        if actual_length != entry.byte_length() {
+            return Err(WorkerError::SourceLengthChanged {
+                path: entry.path().clone(),
+                expected: entry.byte_length(),
+                actual: actual_length,
+            });
+        }
+        if actual_digest != entry.digest() {
+            return Err(WorkerError::SourceDigestChanged {
+                path: entry.path().clone(),
+                expected: entry.digest(),
+                actual: actual_digest,
+            });
+        }
+        file.seek(SeekFrom::Start(0))?;
+        Ok(file)
+    }
+
+    fn open_file(&self, path: &SafeRelativePath) -> Result<File, WorkerError> {
+        let joined = join_protocol_path(&self.root, path);
+        let resolved = fs::canonicalize(joined)?;
+        if !resolved.starts_with(&self.root) {
+            return Err(WorkerError::SourceEscapesRoot {
+                path: path.clone(),
+                root: self.root.clone(),
+            });
+        }
+        if !resolved.is_file() {
+            return Err(WorkerError::SourceNotFile { path: path.clone() });
+        }
+        Ok(File::open(resolved)?)
+    }
+}
+
+pub(crate) fn digest_reader(reader: &mut impl Read) -> Result<(Digest, u64), WorkerError> {
+    let mut hasher = Sha256::new();
+    let mut byte_length = 0_u64;
+    let mut buffer = [0_u8; 64 * 1024];
+    loop {
+        let read = reader.read(&mut buffer)?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+        byte_length += read as u64;
+    }
+    Ok((Digest::new(hasher.finalize().into()), byte_length))
+}
diff --git a/anni-ingest-worker/tests/staging_executor.rs b/anni-ingest-worker/tests/staging_executor.rs
new file mode 100644
index 00000000..f20fb08a
--- /dev/null
+++ b/anni-ingest-worker/tests/staging_executor.rs
@@ -0,0 +1,346 @@
+use std::{fs, io::Read};
+
+use anni_common::traits::{Decode, Encode};
+use anni_ingest::{
+    AudioFormat, Digest, ExecutionPlan, InputFileKind, MetadataRevision, PlanOperation,
+    SafeRelativePath, SplitOutputFormat,
+};
+use anni_ingest_worker::{AssetRepository, SourceSpec, SourceTree, StagingExecutor, WorkerError};
+use anni_split::codec::wav::WaveHeader;
+use sha2::{Digest as ShaDigest, Sha256};
+use tempfile::tempdir;
+use uuid::Uuid;
+
+fn path(value: &str) -> SafeRelativePath {
+    SafeRelativePath::new(value).unwrap()
+}
+
+fn digest(bytes: &[u8]) -> Digest {
+    Digest::new(Sha256::digest(bytes).into())
+}
+
+fn write_test_wave(path: &std::path::Path) -> Vec<u8> {
+    let header = WaveHeader {
+        channels: 1,
+        sample_rate: 150,
+        byte_rate: 300,
+        block_align: 2,
+        bit_per_sample: 16,
+        data_size: 600,
+    };
+    let mut bytes = Vec::new();
+    header.write_to(&mut bytes).unwrap();
+    bytes.extend((0..600).map(|index| (index % 251) as u8));
+    fs::write(path, &bytes).unwrap();
+    bytes
+}
+
+#[test]
+fn executor_splits_and_copies_into_verified_staging_without_touching_sources() {
+    let root = tempdir().unwrap();
+    let source_root = root.path().join("source");
+    let staging_parent = root.path().join("staging");
+    fs::create_dir(&source_root).unwrap();
+    fs::create_dir(&staging_parent).unwrap();
+
+    let original_wave = write_test_wave(&source_root.join("album.wav"));
+    let cue = r#"FILE "album.wav" WAVE
+  TRACK 01 AUDIO
+    TITLE "第一曲（原文）"
+    INDEX 01 00:00:00
+  TRACK 02 AUDIO
+    TITLE "Second"
+    INDEX 01 00:01:00
+"#;
+    fs::write(source_root.join("album.cue"), cue).unwrap();
+    fs::write(source_root.join("cover.jpg"), b"cover bytes").unwrap();
+
+    let source = SourceTree::open(&source_root).unwrap();
+    let manifest = source
+        .inspect(vec![
+            SourceSpec::new(path("album.wav"), InputFileKind::Audio(AudioFormat::Wav)),
+            SourceSpec::new(path("album.cue"), InputFileKind::CueSheet),
+            SourceSpec::new(path("cover.jpg"), InputFileKind::CoverCandidate),
+        ])
+        .unwrap();
+    let job_id = Uuid::new_v4();
+    let plan = ExecutionPlan::new(
+        job_id,
+        MetadataRevision::INITIAL,
+        &manifest,
+        vec![
+            PlanOperation::SplitCueWave {
+                cue: path("album.cue"),
+                wave: path("album.wav"),
+                outputs: vec![path("tracks/01.wav"), path("tracks/02.wav")],
+                format: SplitOutputFormat::Wav,
+            },
+            PlanOperation::CopyFile {
+                source: path("cover.jpg"),
+                target: path("cover.jpg"),
+            },
+        ],
+    )
+    .unwrap();
+
+    let staging_root = staging_parent.join(job_id.to_string());
+    let executor = StagingExecutor::create(source, &staging_root).unwrap();
+    let receipt = executor.execute(&plan, &manifest).unwrap();
+
+    assert_eq!(receipt.job_id(), job_id);
+    assert_eq!(receipt.plan_digest(), plan.digest());
+    assert_eq!(receipt.outputs().len(), 3);
+    assert_ne!(receipt.digest(), Digest::new([0; Digest::LENGTH]));
+    assert_eq!(
+        fs::read(source_root.join("album.wav")).unwrap(),
+        original_wave
+    );
+    assert_eq!(
+        fs::read(source_root.join("album.cue")).unwrap(),
+        cue.as_bytes()
+    );
+    assert_eq!(
+        fs::read(source_root.join("cover.jpg")).unwrap(),
+        b"cover bytes"
+    );
+    assert_eq!(
+        fs::read(staging_root.join("cover.jpg")).unwrap(),
+        b"cover bytes"
+    );
+
+    for output in ["tracks/01.wav", "tracks/02.wav"] {
+        let mut file = fs::File::open(staging_root.join(output)).unwrap();
+        let header = WaveHeader::from_reader(&mut file).unwrap();
+        assert_eq!(header.data_size, 300);
+        let mut body = Vec::new();
+        file.read_to_end(&mut body).unwrap();
+        assert_eq!(body.len(), 300);
+    }
+}
+
+#[test]
+fn executor_refuses_changed_sources_and_leaves_them_in_place() {
+    let root = tempdir().unwrap();
+    let source_root = root.path().join("source");
+    let staging_parent = root.path().join("staging");
+    fs::create_dir(&source_root).unwrap();
+    fs::create_dir(&staging_parent).unwrap();
+    fs::write(source_root.join("cover.jpg"), b"original").unwrap();
+
+    let source = SourceTree::open(&source_root).unwrap();
+    let manifest = source
+        .inspect(vec![SourceSpec::new(
+            path("cover.jpg"),
+            InputFileKind::CoverCandidate,
+        )])
+        .unwrap();
+    let plan = ExecutionPlan::new(
+        Uuid::new_v4(),
+        MetadataRevision::INITIAL,
+        &manifest,
+        vec![PlanOperation::CopyFile {
+            source: path("cover.jpg"),
+            target: path("cover.jpg"),
+        }],
+    )
+    .unwrap();
+    fs::write(source_root.join("cover.jpg"), b"changed").unwrap();
+
+    let staging_root = staging_parent.join("job");
+    let executor = StagingExecutor::create(source, &staging_root).unwrap();
+    assert!(matches!(
+        executor.execute(&plan, &manifest),
+        Err(WorkerError::SourceDigestChanged { .. }) | Err(WorkerError::SourceLengthChanged { .. })
+    ));
+    assert_eq!(fs::read(source_root.join("cover.jpg")).unwrap(), b"changed");
+    assert!(!staging_root.join("cover.jpg").exists());
+}
+
+#[test]
+fn executor_materializes_verified_asset_without_modifying_or_overwriting_it() {
+    let root = tempdir().unwrap();
+    let source_root = root.path().join("source");
+    let asset_root = root.path().join("assets");
+    let staging_parent = root.path().join("staging");
+    fs::create_dir(&source_root).unwrap();
+    fs::create_dir_all(asset_root.join("sha256")).unwrap();
+    fs::create_dir(&staging_parent).unwrap();
+    fs::write(source_root.join("album.cue"), b"immutable input").unwrap();
+
+    let cover = b"verified high resolution cover";
+    let repository_path = path("sha256/cover-asset");
+    fs::write(asset_root.join(repository_path.as_str()), cover).unwrap();
+
+    let source = SourceTree::open(&source_root).unwrap();
+    let manifest = source
+        .inspect(vec![SourceSpec::new(
+            path("album.cue"),
+            InputFileKind::CueSheet,
+        )])
+        .unwrap();
+    let cover_digest = digest(cover);
+    let plan = ExecutionPlan::new(
+        Uuid::new_v4(),
+        MetadataRevision::INITIAL,
+        &manifest,
+        vec![PlanOperation::MaterializeAsset {
+            repository_path: repository_path.clone(),
+            digest: cover_digest,
+            byte_length: cover.len() as u64,
+            target: path("artwork/cover.jpg"),
+        }],
+    )
+    .unwrap();
+
+    let staging_root = staging_parent.join("asset-job");
+    let executor = StagingExecutor::create_with_asset_repository(
+        source,
+        AssetRepository::open(&asset_root).unwrap(),
+        &staging_root,
+    )
+    .unwrap();
+    let receipt = executor.execute(&plan, &manifest).unwrap();
+
+    assert_eq!(
+        fs::read(asset_root.join(repository_path.as_str())).unwrap(),
+        cover
+    );
+    assert_eq!(
+        fs::read(staging_root.join("artwork/cover.jpg")).unwrap(),
+        cover
+    );
+    assert_eq!(receipt.outputs().len(), 1);
+    assert_eq!(receipt.outputs()[0].digest(), cover_digest);
+    assert_eq!(receipt.outputs()[0].byte_length(), cover.len() as u64);
+
+    assert!(matches!(
+        executor.execute(&plan, &manifest),
+        Err(WorkerError::TargetAlreadyExists { .. })
+    ));
+    assert_eq!(
+        fs::read(staging_root.join("artwork/cover.jpg")).unwrap(),
+        cover
+    );
+    assert_eq!(
+        fs::read(asset_root.join(repository_path.as_str())).unwrap(),
+        cover
+    );
+}
+
+#[test]
+fn executor_rejects_asset_whose_sha256_no_longer_matches_the_plan() {
+    let root = tempdir().unwrap();
+    let source_root = root.path().join("source");
+    let asset_root = root.path().join("assets");
+    let staging_parent = root.path().join("staging");
+    fs::create_dir(&source_root).unwrap();
+    fs::create_dir(&asset_root).unwrap();
+    fs::create_dir(&staging_parent).unwrap();
+    fs::write(source_root.join("album.cue"), b"immutable input").unwrap();
+
+    let repository_path = path("cover-asset");
+    let original = b"original";
+    let tampered = b"modified";
+    assert_eq!(original.len(), tampered.len());
+    fs::write(asset_root.join(repository_path.as_str()), original).unwrap();
+
+    let source = SourceTree::open(&source_root).unwrap();
+    let manifest = source
+        .inspect(vec![SourceSpec::new(
+            path("album.cue"),
+            InputFileKind::CueSheet,
+        )])
+        .unwrap();
+    let plan = ExecutionPlan::new(
+        Uuid::new_v4(),
+        MetadataRevision::INITIAL,
+        &manifest,
+        vec![PlanOperation::MaterializeAsset {
+            repository_path: repository_path.clone(),
+            digest: digest(original),
+            byte_length: original.len() as u64,
+            target: path("cover.jpg"),
+        }],
+    )
+    .unwrap();
+    fs::write(asset_root.join(repository_path.as_str()), tampered).unwrap();
+
+    let staging_root = staging_parent.join("asset-job");
+    let executor = StagingExecutor::create_with_asset_repository(
+        source,
+        AssetRepository::open(&asset_root).unwrap(),
+        &staging_root,
+    )
+    .unwrap();
+    assert!(matches!(
+        executor.execute(&plan, &manifest),
+        Err(WorkerError::AssetDigestMismatch { .. })
+    ));
+    assert_eq!(
+        fs::read(asset_root.join(repository_path.as_str())).unwrap(),
+        tampered
+    );
+    assert!(!staging_root.join("cover.jpg").exists());
+}
+
+#[test]
+fn executor_encodes_and_verifies_flac_when_codec_is_available() {
+    if which::which("flac").is_err() {
+        eprintln!("skipping FLAC integration path because the codec is unavailable");
+        return;
+    }
+
+    let root = tempdir().unwrap();
+    let source_root = root.path().join("source");
+    let staging_parent = root.path().join("staging");
+    fs::create_dir(&source_root).unwrap();
+    fs::create_dir(&staging_parent).unwrap();
+    let original_wave = write_test_wave(&source_root.join("album.wav"));
+    let cue = r#"FILE "album.wav" WAVE
+  TRACK 01 AUDIO
+    INDEX 01 00:00:00
+  TRACK 02 AUDIO
+    INDEX 01 00:01:00
+"#;
+    fs::write(source_root.join("album.cue"), cue).unwrap();
+
+    let source = SourceTree::open(&source_root).unwrap();
+    let manifest = source
+        .inspect(vec![
+            SourceSpec::new(path("album.wav"), InputFileKind::Audio(AudioFormat::Wav)),
+            SourceSpec::new(path("album.cue"), InputFileKind::CueSheet),
+        ])
+        .unwrap();
+    let plan = ExecutionPlan::new(
+        Uuid::new_v4(),
+        MetadataRevision::INITIAL,
+        &manifest,
+        vec![PlanOperation::SplitCueWave {
+            cue: path("album.cue"),
+            wave: path("album.wav"),
+            outputs: vec![path("01.flac"), path("02.flac")],
+            format: SplitOutputFormat::Flac,
+        }],
+    )
+    .unwrap();
+
+    let staging_root = staging_parent.join("flac-job");
+    let receipt = StagingExecutor::create(source, &staging_root)
+        .unwrap()
+        .execute(&plan, &manifest)
+        .unwrap();
+
+    assert_eq!(receipt.outputs().len(), 2);
+    assert_eq!(
+        &fs::read(staging_root.join("01.flac")).unwrap()[..4],
+        b"fLaC"
+    );
+    assert_eq!(
+        &fs::read(staging_root.join("02.flac")).unwrap()[..4],
+        b"fLaC"
+    );
+    assert_eq!(
+        fs::read(source_root.join("album.wav")).unwrap(),
+        original_wave
+    );
+}
diff --git a/anni-ingest/Cargo.toml b/anni-ingest/Cargo.toml
new file mode 100644
index 00000000..fd8d1703
--- /dev/null
+++ b/anni-ingest/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "anni-ingest"
+version = "0.1.0"
+publish = false
+
+edition.workspace = true
+authors.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+anni-metadata.workspace = true
+serde.workspace = true
+sha2 = "0.10.9"
+thiserror.workspace = true
+uuid = { workspace = true, features = ["serde"] }
+
+[dev-dependencies]
+serde_json.workspace = true
diff --git a/anni-ingest/src/digest.rs b/anni-ingest/src/digest.rs
new file mode 100644
index 00000000..f45a061a
--- /dev/null
+++ b/anni-ingest/src/digest.rs
@@ -0,0 +1,109 @@
+use std::{fmt, str::FromStr};
+
+use thiserror::Error;
+
+/// A content digest used to bind manifests, plans, and verification receipts.
+///
+/// The workflow only needs a fixed-width identity here. Which hashing
+/// algorithm produced the bytes belongs to the protocol envelope and can
+/// evolve without weakening equality checks inside the state machine.
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+pub struct Digest([u8; 32]);
+
+impl Digest {
+    pub const LENGTH: usize = 32;
+
+    pub const fn new(bytes: [u8; Self::LENGTH]) -> Self {
+        Self(bytes)
+    }
+
+    pub const fn as_bytes(&self) -> &[u8; Self::LENGTH] {
+        &self.0
+    }
+}
+
+impl From<[u8; Digest::LENGTH]> for Digest {
+    fn from(value: [u8; Digest::LENGTH]) -> Self {
+        Self::new(value)
+    }
+}
+
+impl fmt::Display for Digest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        for byte in self.0 {
+            write!(formatter, "{byte:02x}")?;
+        }
+        Ok(())
+    }
+}
+
+impl fmt::Debug for Digest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "Digest({self})")
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+pub enum ParseDigestError {
+    #[error("digest must contain exactly 64 hexadecimal characters, got {actual} bytes")]
+    InvalidLength { actual: usize },
+    #[error("digest contains a non-hexadecimal byte {byte:#04x} at offset {index}")]
+    InvalidByte { index: usize, byte: u8 },
+}
+
+impl FromStr for Digest {
+    type Err = ParseDigestError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let encoded = value.as_bytes();
+        if encoded.len() != Self::LENGTH * 2 {
+            return Err(ParseDigestError::InvalidLength {
+                actual: encoded.len(),
+            });
+        }
+
+        let mut decoded = [0; Self::LENGTH];
+        for (index, pair) in encoded.chunks_exact(2).enumerate() {
+            let high = decode_nibble(pair[0], index * 2)?;
+            let low = decode_nibble(pair[1], index * 2 + 1)?;
+            decoded[index] = (high << 4) | low;
+        }
+        Ok(Self::new(decoded))
+    }
+}
+
+fn decode_nibble(byte: u8, index: usize) -> Result<u8, ParseDigestError> {
+    match byte {
+        b'0'..=b'9' => Ok(byte - b'0'),
+        b'a'..=b'f' => Ok(byte - b'a' + 10),
+        b'A'..=b'F' => Ok(byte - b'A' + 10),
+        _ => Err(ParseDigestError::InvalidByte { index, byte }),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn digest_hex_round_trip_is_strict_and_case_insensitive() {
+        let digest = Digest::new([0xab; Digest::LENGTH]);
+        let encoded = digest.to_string();
+
+        assert_eq!(encoded.parse(), Ok(digest));
+        assert_eq!(encoded.to_uppercase().parse(), Ok(digest));
+        assert_eq!(
+            "ab".parse::<Digest>(),
+            Err(ParseDigestError::InvalidLength { actual: 2 })
+        );
+
+        let invalid = format!("{}z", &encoded[..encoded.len() - 1]);
+        assert_eq!(
+            invalid.parse::<Digest>(),
+            Err(ParseDigestError::InvalidByte {
+                index: 63,
+                byte: b'z',
+            })
+        );
+    }
+}
diff --git a/anni-ingest/src/job.rs b/anni-ingest/src/job.rs
new file mode 100644
index 00000000..d06a71ab
--- /dev/null
+++ b/anni-ingest/src/job.rs
@@ -0,0 +1,852 @@
+use std::{fmt, str::FromStr};
+
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::Digest;
+
+/// A monotonic revision of the metadata being reviewed for an ingest job.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct MetadataRevision(u64);
+
+impl MetadataRevision {
+    pub const INITIAL: Self = Self(1);
+
+    pub const fn new(value: u64) -> Option<Self> {
+        if value == 0 {
+            None
+        } else {
+            Some(Self(value))
+        }
+    }
+
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+
+    fn next(self) -> Result<Self, JobError> {
+        self.0
+            .checked_add(1)
+            .map(Self)
+            .ok_or(JobError::RevisionExhausted)
+    }
+}
+
+impl fmt::Display for MetadataRevision {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+/// The externally visible state of an ingest job.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum JobState {
+    Created,
+    Reviewing,
+    Planned,
+    Executing,
+    Verifying,
+    ReadyToCommit,
+    Committing,
+    Published,
+    Quarantined,
+    Cancelled,
+}
+
+impl JobState {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Created => "created",
+            Self::Reviewing => "reviewing",
+            Self::Planned => "planned",
+            Self::Executing => "executing",
+            Self::Verifying => "verifying",
+            Self::ReadyToCommit => "ready_to_commit",
+            Self::Committing => "committing",
+            Self::Published => "published",
+            Self::Quarantined => "quarantined",
+            Self::Cancelled => "cancelled",
+        }
+    }
+}
+
+impl fmt::Display for JobState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl FromStr for JobState {
+    type Err = UnknownJobState;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "created" => Ok(Self::Created),
+            "reviewing" => Ok(Self::Reviewing),
+            "planned" => Ok(Self::Planned),
+            "executing" => Ok(Self::Executing),
+            "verifying" => Ok(Self::Verifying),
+            "ready_to_commit" => Ok(Self::ReadyToCommit),
+            "committing" => Ok(Self::Committing),
+            "published" => Ok(Self::Published),
+            "quarantined" => Ok(Self::Quarantined),
+            "cancelled" => Ok(Self::Cancelled),
+            _ => Err(UnknownJobState(value.to_owned())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[error("unknown ingest job state: {0}")]
+pub struct UnknownJobState(String);
+
+/// A plan is valid only for the approved metadata revision and input manifest
+/// from which it was produced.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PlanReference {
+    metadata_revision: MetadataRevision,
+    manifest_digest: Digest,
+    plan_digest: Digest,
+}
+
+impl PlanReference {
+    pub const fn metadata_revision(self) -> MetadataRevision {
+        self.metadata_revision
+    }
+
+    pub const fn manifest_digest(self) -> Digest {
+        self.manifest_digest
+    }
+
+    pub const fn plan_digest(self) -> Digest {
+        self.plan_digest
+    }
+}
+
+/// A verification receipt is bound to exactly one immutable plan.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct VerificationReference {
+    plan_digest: Digest,
+    receipt_digest: Digest,
+}
+
+/// Persistence-shaped representation of an ingest job.
+///
+/// This type deliberately mirrors only domain data. Database-specific fields
+/// such as an optimistic-lock version or timestamps belong to the repository
+/// layer and are not part of the workflow aggregate.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct IngestJobSnapshot {
+    id: Uuid,
+    state: JobState,
+    metadata_revision: MetadataRevision,
+    approved_revision: Option<MetadataRevision>,
+    manifest_digest: Option<Digest>,
+    plan_digest: Option<Digest>,
+    verification_digest: Option<Digest>,
+}
+
+impl IngestJobSnapshot {
+    #[allow(clippy::too_many_arguments)]
+    pub const fn new(
+        id: Uuid,
+        state: JobState,
+        metadata_revision: MetadataRevision,
+        approved_revision: Option<MetadataRevision>,
+        manifest_digest: Option<Digest>,
+        plan_digest: Option<Digest>,
+        verification_digest: Option<Digest>,
+    ) -> Self {
+        Self {
+            id,
+            state,
+            metadata_revision,
+            approved_revision,
+            manifest_digest,
+            plan_digest,
+            verification_digest,
+        }
+    }
+
+    pub const fn id(self) -> Uuid {
+        self.id
+    }
+
+    pub const fn state(self) -> JobState {
+        self.state
+    }
+
+    pub const fn metadata_revision(self) -> MetadataRevision {
+        self.metadata_revision
+    }
+
+    pub const fn approved_revision(self) -> Option<MetadataRevision> {
+        self.approved_revision
+    }
+
+    pub const fn manifest_digest(self) -> Option<Digest> {
+        self.manifest_digest
+    }
+
+    pub const fn plan_digest(self) -> Option<Digest> {
+        self.plan_digest
+    }
+
+    pub const fn verification_digest(self) -> Option<Digest> {
+        self.verification_digest
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum SnapshotError {
+    #[error("manifest and plan digests must either both be present or both be absent")]
+    IncompletePlan,
+    #[error("approved revision {approved} does not match current revision {current}")]
+    ApprovedRevisionMismatch {
+        approved: MetadataRevision,
+        current: MetadataRevision,
+    },
+    #[error("a persisted plan requires approval of the current metadata revision")]
+    PlanRequiresApproval,
+    #[error("a persisted verification receipt requires a plan")]
+    VerificationRequiresPlan,
+    #[error("state {state} requires an immutable plan")]
+    StateRequiresPlan { state: JobState },
+    #[error("state {state} requires an accepted verification receipt")]
+    StateRequiresVerification { state: JobState },
+    #[error("state {state} cannot contain plan or verification data")]
+    StateRejectsDerivedData { state: JobState },
+    #[error("state created cannot contain an approved revision")]
+    CreatedStateRejectsApproval,
+    #[error("state {state} cannot contain an accepted verification receipt")]
+    StateRejectsVerification { state: JobState },
+}
+
+impl VerificationReference {
+    pub const fn plan_digest(self) -> Digest {
+        self.plan_digest
+    }
+
+    pub const fn receipt_digest(self) -> Digest {
+        self.receipt_digest
+    }
+}
+
+/// Operations are typed so transition errors remain stable and machine-readable.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum JobOperation {
+    BeginReview,
+    ApproveRevision,
+    ReviseMetadata,
+    CreatePlan,
+    BeginExecution,
+    BeginVerification,
+    AcceptVerification,
+    BeginCommit,
+    Publish,
+    Quarantine,
+    Cancel,
+}
+
+impl fmt::Display for JobOperation {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::BeginReview => "begin review",
+            Self::ApproveRevision => "approve revision",
+            Self::ReviseMetadata => "revise metadata",
+            Self::CreatePlan => "create plan",
+            Self::BeginExecution => "begin execution",
+            Self::BeginVerification => "begin verification",
+            Self::AcceptVerification => "accept verification",
+            Self::BeginCommit => "begin commit",
+            Self::Publish => "publish",
+            Self::Quarantine => "quarantine",
+            Self::Cancel => "cancel",
+        })
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum JobError {
+    #[error("cannot {operation} while job is {state}")]
+    InvalidTransition {
+        state: JobState,
+        operation: JobOperation,
+    },
+    #[error("metadata revision conflict: expected {expected}, actual {actual}")]
+    RevisionConflict {
+        expected: MetadataRevision,
+        actual: MetadataRevision,
+    },
+    #[error("metadata revision {actual} has not been approved")]
+    RevisionNotApproved { actual: MetadataRevision },
+    #[error("job has no immutable import plan")]
+    MissingPlan,
+    #[error("plan digest mismatch: expected {expected}, actual {actual}")]
+    PlanMismatch { expected: Digest, actual: Digest },
+    #[error("job has no accepted verification receipt")]
+    MissingVerification,
+    #[error("verification digest mismatch: expected {expected}, actual {actual}")]
+    VerificationMismatch { expected: Digest, actual: Digest },
+    #[error("metadata revision counter is exhausted")]
+    RevisionExhausted,
+}
+
+/// The side-effect-free workflow aggregate used by the backend.
+///
+/// Only methods on this type may change workflow state. HTTP handlers and
+/// workers are expected to submit commands to the backend rather than mutate
+/// persisted fields independently.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IngestJob {
+    id: Uuid,
+    state: JobState,
+    metadata_revision: MetadataRevision,
+    approved_revision: Option<MetadataRevision>,
+    plan: Option<PlanReference>,
+    verification: Option<VerificationReference>,
+}
+
+impl IngestJob {
+    pub fn new(id: Uuid) -> Self {
+        Self {
+            id,
+            state: JobState::Created,
+            metadata_revision: MetadataRevision::INITIAL,
+            approved_revision: None,
+            plan: None,
+            verification: None,
+        }
+    }
+
+    /// Restore a job from durable storage while rechecking all domain
+    /// invariants. Corrupt rows therefore fail at the repository boundary
+    /// instead of creating an impossible in-memory state.
+    pub fn restore(snapshot: IngestJobSnapshot) -> Result<Self, SnapshotError> {
+        if let Some(approved) = snapshot.approved_revision
+            && approved != snapshot.metadata_revision
+        {
+            return Err(SnapshotError::ApprovedRevisionMismatch {
+                approved,
+                current: snapshot.metadata_revision,
+            });
+        }
+
+        let plan = match (snapshot.manifest_digest, snapshot.plan_digest) {
+            (Some(manifest_digest), Some(plan_digest)) => {
+                if snapshot.approved_revision != Some(snapshot.metadata_revision) {
+                    return Err(SnapshotError::PlanRequiresApproval);
+                }
+                Some(PlanReference {
+                    metadata_revision: snapshot.metadata_revision,
+                    manifest_digest,
+                    plan_digest,
+                })
+            }
+            (None, None) => None,
+            _ => return Err(SnapshotError::IncompletePlan),
+        };
+
+        let verification = match snapshot.verification_digest {
+            Some(receipt_digest) => {
+                let plan = plan.ok_or(SnapshotError::VerificationRequiresPlan)?;
+                Some(VerificationReference {
+                    plan_digest: plan.plan_digest,
+                    receipt_digest,
+                })
+            }
+            None => None,
+        };
+
+        match snapshot.state {
+            JobState::Created => {
+                if snapshot.approved_revision.is_some() {
+                    return Err(SnapshotError::CreatedStateRejectsApproval);
+                }
+                if plan.is_some() || verification.is_some() {
+                    return Err(SnapshotError::StateRejectsDerivedData {
+                        state: snapshot.state,
+                    });
+                }
+            }
+            JobState::Reviewing => {
+                if plan.is_some() || verification.is_some() {
+                    return Err(SnapshotError::StateRejectsDerivedData {
+                        state: snapshot.state,
+                    });
+                }
+            }
+            JobState::Planned | JobState::Executing | JobState::Verifying => {
+                if plan.is_none() {
+                    return Err(SnapshotError::StateRequiresPlan {
+                        state: snapshot.state,
+                    });
+                }
+                if verification.is_some() {
+                    return Err(SnapshotError::StateRejectsVerification {
+                        state: snapshot.state,
+                    });
+                }
+            }
+            JobState::ReadyToCommit | JobState::Committing | JobState::Published => {
+                if plan.is_none() {
+                    return Err(SnapshotError::StateRequiresPlan {
+                        state: snapshot.state,
+                    });
+                }
+                if verification.is_none() {
+                    return Err(SnapshotError::StateRequiresVerification {
+                        state: snapshot.state,
+                    });
+                }
+            }
+            // Terminal interruption states preserve whichever valid evidence
+            // existed at the moment the job was stopped.
+            JobState::Quarantined | JobState::Cancelled => {}
+        }
+
+        Ok(Self {
+            id: snapshot.id,
+            state: snapshot.state,
+            metadata_revision: snapshot.metadata_revision,
+            approved_revision: snapshot.approved_revision,
+            plan,
+            verification,
+        })
+    }
+
+    pub fn snapshot(&self) -> IngestJobSnapshot {
+        IngestJobSnapshot::new(
+            self.id,
+            self.state,
+            self.metadata_revision,
+            self.approved_revision,
+            self.plan.map(|plan| plan.manifest_digest),
+            self.plan.map(|plan| plan.plan_digest),
+            self.verification
+                .map(|verification| verification.receipt_digest),
+        )
+    }
+
+    pub const fn id(&self) -> Uuid {
+        self.id
+    }
+
+    pub const fn state(&self) -> JobState {
+        self.state
+    }
+
+    pub const fn metadata_revision(&self) -> MetadataRevision {
+        self.metadata_revision
+    }
+
+    pub const fn approved_revision(&self) -> Option<MetadataRevision> {
+        self.approved_revision
+    }
+
+    pub const fn plan(&self) -> Option<PlanReference> {
+        self.plan
+    }
+
+    pub const fn verification(&self) -> Option<VerificationReference> {
+        self.verification
+    }
+
+    pub fn begin_review(&mut self) -> Result<(), JobError> {
+        self.require_state(JobState::Created, JobOperation::BeginReview)?;
+        self.state = JobState::Reviewing;
+        Ok(())
+    }
+
+    pub fn approve_revision(
+        &mut self,
+        expected_revision: MetadataRevision,
+    ) -> Result<(), JobError> {
+        self.require_state(JobState::Reviewing, JobOperation::ApproveRevision)?;
+        self.require_revision(expected_revision)?;
+        self.approved_revision = Some(self.metadata_revision);
+        Ok(())
+    }
+
+    /// Start a new metadata revision and invalidate all derived approvals.
+    ///
+    /// Revisions cannot change while a worker is actively executing or while a
+    /// commit is in progress. The backend must first move such work to a safe
+    /// checkpoint or quarantine it.
+    pub fn revise_metadata(
+        &mut self,
+        expected_revision: MetadataRevision,
+    ) -> Result<MetadataRevision, JobError> {
+        if !matches!(
+            self.state,
+            JobState::Reviewing
+                | JobState::Planned
+                | JobState::ReadyToCommit
+                | JobState::Quarantined
+        ) {
+            return Err(self.invalid_transition(JobOperation::ReviseMetadata));
+        }
+        self.require_revision(expected_revision)?;
+
+        self.metadata_revision = self.metadata_revision.next()?;
+        self.approved_revision = None;
+        self.plan = None;
+        self.verification = None;
+        self.state = JobState::Reviewing;
+        Ok(self.metadata_revision)
+    }
+
+    pub fn create_plan(
+        &mut self,
+        expected_revision: MetadataRevision,
+        manifest_digest: Digest,
+        plan_digest: Digest,
+    ) -> Result<PlanReference, JobError> {
+        self.require_state(JobState::Reviewing, JobOperation::CreatePlan)?;
+        self.require_revision(expected_revision)?;
+        if self.approved_revision != Some(self.metadata_revision) {
+            return Err(JobError::RevisionNotApproved {
+                actual: self.metadata_revision,
+            });
+        }
+
+        let plan = PlanReference {
+            metadata_revision: self.metadata_revision,
+            manifest_digest,
+            plan_digest,
+        };
+        self.plan = Some(plan);
+        self.verification = None;
+        self.state = JobState::Planned;
+        Ok(plan)
+    }
+
+    pub fn begin_execution(&mut self, plan_digest: Digest) -> Result<(), JobError> {
+        self.require_state(JobState::Planned, JobOperation::BeginExecution)?;
+        self.require_plan(plan_digest)?;
+        self.state = JobState::Executing;
+        Ok(())
+    }
+
+    pub fn begin_verification(&mut self, plan_digest: Digest) -> Result<(), JobError> {
+        self.require_state(JobState::Executing, JobOperation::BeginVerification)?;
+        self.require_plan(plan_digest)?;
+        self.state = JobState::Verifying;
+        Ok(())
+    }
+
+    pub fn accept_verification(
+        &mut self,
+        plan_digest: Digest,
+        receipt_digest: Digest,
+    ) -> Result<VerificationReference, JobError> {
+        self.require_state(JobState::Verifying, JobOperation::AcceptVerification)?;
+        self.require_plan(plan_digest)?;
+
+        let verification = VerificationReference {
+            plan_digest,
+            receipt_digest,
+        };
+        self.verification = Some(verification);
+        self.state = JobState::ReadyToCommit;
+        Ok(verification)
+    }
+
+    pub fn begin_commit(
+        &mut self,
+        plan_digest: Digest,
+        verification_digest: Digest,
+    ) -> Result<(), JobError> {
+        self.require_state(JobState::ReadyToCommit, JobOperation::BeginCommit)?;
+        self.require_plan(plan_digest)?;
+        self.require_verification(plan_digest, verification_digest)?;
+        self.state = JobState::Committing;
+        Ok(())
+    }
+
+    pub fn publish(
+        &mut self,
+        plan_digest: Digest,
+        verification_digest: Digest,
+    ) -> Result<(), JobError> {
+        self.require_state(JobState::Committing, JobOperation::Publish)?;
+        self.require_plan(plan_digest)?;
+        self.require_verification(plan_digest, verification_digest)?;
+        self.state = JobState::Published;
+        Ok(())
+    }
+
+    pub fn quarantine(&mut self) -> Result<(), JobError> {
+        // Once commit begins, recovery must move forward from durable receipts;
+        // changing the job to a generic quarantine state would hide that fact.
+        if matches!(
+            self.state,
+            JobState::Committing | JobState::Published | JobState::Cancelled
+        ) {
+            return Err(self.invalid_transition(JobOperation::Quarantine));
+        }
+        self.state = JobState::Quarantined;
+        Ok(())
+    }
+
+    pub fn cancel(&mut self) -> Result<(), JobError> {
+        if matches!(
+            self.state,
+            JobState::Committing | JobState::Published | JobState::Cancelled
+        ) {
+            return Err(self.invalid_transition(JobOperation::Cancel));
+        }
+        self.state = JobState::Cancelled;
+        Ok(())
+    }
+
+    fn require_state(&self, expected: JobState, operation: JobOperation) -> Result<(), JobError> {
+        if self.state == expected {
+            Ok(())
+        } else {
+            Err(self.invalid_transition(operation))
+        }
+    }
+
+    fn require_revision(&self, expected: MetadataRevision) -> Result<(), JobError> {
+        if self.metadata_revision == expected {
+            Ok(())
+        } else {
+            Err(JobError::RevisionConflict {
+                expected,
+                actual: self.metadata_revision,
+            })
+        }
+    }
+
+    fn require_plan(&self, actual: Digest) -> Result<PlanReference, JobError> {
+        let plan = self.plan.ok_or(JobError::MissingPlan)?;
+        if plan.plan_digest == actual {
+            Ok(plan)
+        } else {
+            Err(JobError::PlanMismatch {
+                expected: plan.plan_digest,
+                actual,
+            })
+        }
+    }
+
+    fn require_verification(
+        &self,
+        plan_digest: Digest,
+        actual: Digest,
+    ) -> Result<VerificationReference, JobError> {
+        let verification = self.verification.ok_or(JobError::MissingVerification)?;
+        if verification.plan_digest != plan_digest {
+            return Err(JobError::PlanMismatch {
+                expected: verification.plan_digest,
+                actual: plan_digest,
+            });
+        }
+        if verification.receipt_digest != actual {
+            return Err(JobError::VerificationMismatch {
+                expected: verification.receipt_digest,
+                actual,
+            });
+        }
+        Ok(verification)
+    }
+
+    fn invalid_transition(&self, operation: JobOperation) -> JobError {
+        JobError::InvalidTransition {
+            state: self.state,
+            operation,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn digest(byte: u8) -> Digest {
+        Digest::new([byte; Digest::LENGTH])
+    }
+
+    fn ready_to_commit_job() -> IngestJob {
+        let mut job = IngestJob::new(Uuid::new_v4());
+        job.begin_review().unwrap();
+        job.approve_revision(MetadataRevision::INITIAL).unwrap();
+        job.create_plan(MetadataRevision::INITIAL, digest(1), digest(2))
+            .unwrap();
+        job.begin_execution(digest(2)).unwrap();
+        job.begin_verification(digest(2)).unwrap();
+        job.accept_verification(digest(2), digest(3)).unwrap();
+        job
+    }
+
+    #[test]
+    fn approved_job_reaches_published_with_matching_receipts() {
+        let mut job = ready_to_commit_job();
+
+        job.begin_commit(digest(2), digest(3)).unwrap();
+        job.publish(digest(2), digest(3)).unwrap();
+
+        assert_eq!(job.state(), JobState::Published);
+    }
+
+    #[test]
+    fn invalid_transitions_are_rejected_at_the_domain_boundary() {
+        let mut job = IngestJob::new(Uuid::new_v4());
+
+        let error = job
+            .create_plan(MetadataRevision::INITIAL, digest(1), digest(2))
+            .unwrap_err();
+        assert_eq!(
+            error,
+            JobError::InvalidTransition {
+                state: JobState::Created,
+                operation: JobOperation::CreatePlan,
+            }
+        );
+
+        job.begin_review().unwrap();
+        assert_eq!(
+            job.publish(digest(2), digest(3)).unwrap_err(),
+            JobError::InvalidTransition {
+                state: JobState::Reviewing,
+                operation: JobOperation::Publish,
+            }
+        );
+    }
+
+    #[test]
+    fn persisted_state_names_round_trip() {
+        let states = [
+            JobState::Created,
+            JobState::Reviewing,
+            JobState::Planned,
+            JobState::Executing,
+            JobState::Verifying,
+            JobState::ReadyToCommit,
+            JobState::Committing,
+            JobState::Published,
+            JobState::Quarantined,
+            JobState::Cancelled,
+        ];
+
+        for state in states {
+            assert_eq!(state.as_str().parse(), Ok(state));
+        }
+    }
+
+    #[test]
+    fn revising_metadata_invalidates_plan_and_verification() {
+        let mut job = ready_to_commit_job();
+
+        let revision = job.revise_metadata(MetadataRevision::INITIAL).unwrap();
+
+        assert_eq!(revision.get(), 2);
+        assert_eq!(job.state(), JobState::Reviewing);
+        assert_eq!(job.approved_revision(), None);
+        assert_eq!(job.plan(), None);
+        assert_eq!(job.verification(), None);
+    }
+
+    #[test]
+    fn stale_revision_and_receipt_hashes_are_rejected() {
+        let mut job = IngestJob::new(Uuid::new_v4());
+        job.begin_review().unwrap();
+        job.revise_metadata(MetadataRevision::INITIAL).unwrap();
+
+        assert_eq!(
+            job.approve_revision(MetadataRevision::INITIAL).unwrap_err(),
+            JobError::RevisionConflict {
+                expected: MetadataRevision::INITIAL,
+                actual: MetadataRevision::new(2).unwrap(),
+            }
+        );
+
+        let mut job = ready_to_commit_job();
+        assert_eq!(
+            job.begin_commit(digest(9), digest(3)).unwrap_err(),
+            JobError::PlanMismatch {
+                expected: digest(2),
+                actual: digest(9),
+            }
+        );
+        assert_eq!(
+            job.begin_commit(digest(2), digest(9)).unwrap_err(),
+            JobError::VerificationMismatch {
+                expected: digest(3),
+                actual: digest(9),
+            }
+        );
+    }
+
+    #[test]
+    fn quarantine_keeps_diagnostics_but_blocks_direct_publish() {
+        let mut job = ready_to_commit_job();
+        let plan = job.plan();
+        let verification = job.verification();
+
+        job.quarantine().unwrap();
+
+        assert_eq!(job.state(), JobState::Quarantined);
+        assert_eq!(job.plan(), plan);
+        assert_eq!(job.verification(), verification);
+        assert!(matches!(
+            job.publish(digest(2), digest(3)),
+            Err(JobError::InvalidTransition {
+                state: JobState::Quarantined,
+                operation: JobOperation::Publish,
+            })
+        ));
+
+        let mut committing = ready_to_commit_job();
+        committing.begin_commit(digest(2), digest(3)).unwrap();
+        assert!(matches!(
+            committing.quarantine(),
+            Err(JobError::InvalidTransition {
+                state: JobState::Committing,
+                operation: JobOperation::Quarantine,
+            })
+        ));
+    }
+
+    #[test]
+    fn snapshot_round_trip_preserves_a_reachable_job() {
+        let job = ready_to_commit_job();
+
+        assert_eq!(IngestJob::restore(job.snapshot()), Ok(job));
+    }
+
+    #[test]
+    fn restoring_snapshot_rejects_impossible_persisted_state() {
+        let id = Uuid::new_v4();
+        let incomplete_plan = IngestJobSnapshot::new(
+            id,
+            JobState::Planned,
+            MetadataRevision::INITIAL,
+            Some(MetadataRevision::INITIAL),
+            Some(digest(1)),
+            None,
+            None,
+        );
+        assert_eq!(
+            IngestJob::restore(incomplete_plan),
+            Err(SnapshotError::IncompletePlan)
+        );
+
+        let published_without_receipt = IngestJobSnapshot::new(
+            id,
+            JobState::Published,
+            MetadataRevision::INITIAL,
+            Some(MetadataRevision::INITIAL),
+            Some(digest(1)),
+            Some(digest(2)),
+            None,
+        );
+        assert_eq!(
+            IngestJob::restore(published_without_receipt),
+            Err(SnapshotError::StateRequiresVerification {
+                state: JobState::Published,
+            })
+        );
+    }
+}
diff --git a/anni-ingest/src/lib.rs b/anni-ingest/src/lib.rs
new file mode 100644
index 00000000..274376e0
--- /dev/null
+++ b/anni-ingest/src/lib.rs
@@ -0,0 +1,27 @@
+//! Domain rules shared by the Anni ingest backend and workers.
+//!
+//! This crate deliberately contains no database, HTTP, AI, or filesystem code.
+//! Keeping the workflow state machine free of side effects makes its safety
+//! invariants reviewable and cheap to test.
+
+mod digest;
+mod job;
+mod manifest;
+mod metadata;
+mod path;
+mod plan;
+
+pub use digest::{Digest, ParseDigestError};
+pub use job::{
+    IngestJob, IngestJobSnapshot, JobError, JobOperation, JobState, MetadataRevision,
+    PlanReference, SnapshotError, UnknownJobState, VerificationReference,
+};
+pub use manifest::{AudioFormat, InputFileKind, InputManifest, ManifestEntry, ManifestError};
+pub use metadata::{
+    AlbumField, AlbumLayout, CompletenessReport, Confidence, DiscField, Evidence, EvidenceMethod,
+    EvidenceSourceKind, FieldPath, MetadataCandidate, MetadataDecision, MetadataDraft,
+    MetadataDraftSnapshot, MetadataError, MetadataProfile, MetadataRequirements,
+    MetadataReviewContext, MetadataValue, MetadataValueKind, TrackField,
+};
+pub use path::{PathError, SafeRelativePath};
+pub use plan::{ExecutionPlan, PlanError, PlanOperation, SplitOutputFormat};
diff --git a/anni-ingest/src/manifest.rs b/anni-ingest/src/manifest.rs
new file mode 100644
index 00000000..1cfe5360
--- /dev/null
+++ b/anni-ingest/src/manifest.rs
@@ -0,0 +1,185 @@
+use sha2::{Digest as ShaDigest, Sha256};
+use thiserror::Error;
+
+use crate::{Digest, SafeRelativePath};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum AudioFormat {
+    Wav,
+    Flac,
+    Alac,
+    Aac,
+    Mp3,
+    Other,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum InputFileKind {
+    Audio(AudioFormat),
+    CueSheet,
+    Booklet,
+    CoverCandidate,
+    Other,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ManifestEntry {
+    path: SafeRelativePath,
+    byte_length: u64,
+    digest: Digest,
+    kind: InputFileKind,
+}
+
+impl ManifestEntry {
+    pub const fn new(
+        path: SafeRelativePath,
+        byte_length: u64,
+        digest: Digest,
+        kind: InputFileKind,
+    ) -> Self {
+        Self {
+            path,
+            byte_length,
+            digest,
+            kind,
+        }
+    }
+
+    pub const fn path(&self) -> &SafeRelativePath {
+        &self.path
+    }
+
+    pub const fn byte_length(&self) -> u64 {
+        self.byte_length
+    }
+
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+
+    pub const fn kind(&self) -> InputFileKind {
+        self.kind
+    }
+}
+
+/// Immutable inventory of every file visible to an ingest worker.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct InputManifest {
+    entries: Vec<ManifestEntry>,
+    digest: Digest,
+}
+
+impl InputManifest {
+    pub fn new(mut entries: Vec<ManifestEntry>) -> Result<Self, ManifestError> {
+        if entries.is_empty() {
+            return Err(ManifestError::Empty);
+        }
+
+        entries.sort_by(|left, right| left.path.cmp(&right.path));
+        for pair in entries.windows(2) {
+            if pair[0].path == pair[1].path {
+                return Err(ManifestError::DuplicatePath {
+                    path: pair[0].path.clone(),
+                });
+            }
+        }
+
+        let digest = digest_entries(&entries);
+        Ok(Self { entries, digest })
+    }
+
+    pub fn entries(&self) -> &[ManifestEntry] {
+        &self.entries
+    }
+
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+
+    pub fn entry(&self, path: &SafeRelativePath) -> Option<&ManifestEntry> {
+        self.entries
+            .binary_search_by(|entry| entry.path.cmp(path))
+            .ok()
+            .map(|index| &self.entries[index])
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum ManifestError {
+    #[error("input manifest cannot be empty")]
+    Empty,
+    #[error("input manifest contains duplicate path {path}")]
+    DuplicatePath { path: SafeRelativePath },
+}
+
+fn digest_entries(entries: &[ManifestEntry]) -> Digest {
+    let mut hasher = Sha256::new();
+    hasher.update(b"anni-ingest-manifest-v1\0");
+    hash_u64(&mut hasher, entries.len() as u64);
+    for entry in entries {
+        hash_string(&mut hasher, entry.path.as_str());
+        hash_u64(&mut hasher, entry.byte_length);
+        hasher.update(entry.digest.as_bytes());
+        hash_kind(&mut hasher, entry.kind);
+    }
+    Digest::new(hasher.finalize().into())
+}
+
+fn hash_kind(hasher: &mut Sha256, kind: InputFileKind) {
+    let bytes = match kind {
+        InputFileKind::Audio(format) => [0, audio_format_tag(format)],
+        InputFileKind::CueSheet => [1, 0],
+        InputFileKind::Booklet => [2, 0],
+        InputFileKind::CoverCandidate => [3, 0],
+        InputFileKind::Other => [4, 0],
+    };
+    hasher.update(bytes);
+}
+
+fn audio_format_tag(format: AudioFormat) -> u8 {
+    match format {
+        AudioFormat::Wav => 0,
+        AudioFormat::Flac => 1,
+        AudioFormat::Alac => 2,
+        AudioFormat::Aac => 3,
+        AudioFormat::Mp3 => 4,
+        AudioFormat::Other => 5,
+    }
+}
+
+pub(crate) fn hash_string(hasher: &mut Sha256, value: &str) {
+    hash_u64(hasher, value.len() as u64);
+    hasher.update(value.as_bytes());
+}
+
+pub(crate) fn hash_u64(hasher: &mut Sha256, value: u64) {
+    hasher.update(value.to_be_bytes());
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn entry(path: &str, length: u64) -> ManifestEntry {
+        ManifestEntry::new(
+            SafeRelativePath::new(path).unwrap(),
+            length,
+            Digest::new([length as u8; Digest::LENGTH]),
+            InputFileKind::Audio(AudioFormat::Wav),
+        )
+    }
+
+    #[test]
+    fn manifest_identity_is_order_independent_but_content_sensitive() {
+        let forward =
+            InputManifest::new(vec![entry("disc.wav", 10), entry("disc.cue", 20)]).unwrap();
+        let reverse =
+            InputManifest::new(vec![entry("disc.cue", 20), entry("disc.wav", 10)]).unwrap();
+        let changed =
+            InputManifest::new(vec![entry("disc.wav", 11), entry("disc.cue", 20)]).unwrap();
+
+        assert_eq!(forward.digest(), reverse.digest());
+        assert_ne!(forward.digest(), changed.digest());
+        assert_eq!(forward.entries()[0].path().as_str(), "disc.cue");
+    }
+}
diff --git a/anni-ingest/src/metadata.rs b/anni-ingest/src/metadata.rs
new file mode 100644
index 00000000..3102f003
--- /dev/null
+++ b/anni-ingest/src/metadata.rs
@@ -0,0 +1,1116 @@
+use std::{
+    cmp::Ordering,
+    collections::{BTreeMap, BTreeSet, HashSet},
+    num::NonZeroU16,
+};
+
+use anni_metadata::model::{AnniDate, TrackType};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::MetadataRevision;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AlbumField {
+    Title,
+    Edition,
+    Artist,
+    Artists,
+    ReleaseDate,
+    TrackType,
+    Catalog,
+    Tags,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DiscField {
+    Title,
+    Catalog,
+    Artist,
+    Artists,
+    TrackType,
+    Tags,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum TrackField {
+    Title,
+    Artist,
+    Artists,
+    TrackType,
+    Tags,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case", tag = "scope", content = "location")]
+pub enum FieldPath {
+    Album(AlbumField),
+    Disc {
+        disc: NonZeroU16,
+        field: DiscField,
+    },
+    Track {
+        disc: NonZeroU16,
+        track: NonZeroU16,
+        field: TrackField,
+    },
+}
+
+impl FieldPath {
+    pub const fn value_kind(self) -> MetadataValueKind {
+        match self {
+            Self::Album(AlbumField::Title)
+            | Self::Album(AlbumField::Edition)
+            | Self::Album(AlbumField::Artist)
+            | Self::Album(AlbumField::Catalog)
+            | Self::Disc {
+                field: DiscField::Title | DiscField::Catalog | DiscField::Artist,
+                ..
+            }
+            | Self::Track {
+                field: TrackField::Title | TrackField::Artist,
+                ..
+            } => MetadataValueKind::Text,
+            Self::Album(AlbumField::Artists)
+            | Self::Disc {
+                field: DiscField::Artists,
+                ..
+            }
+            | Self::Track {
+                field: TrackField::Artists,
+                ..
+            } => MetadataValueKind::TextMap,
+            Self::Album(AlbumField::ReleaseDate) => MetadataValueKind::Date,
+            Self::Album(AlbumField::TrackType)
+            | Self::Disc {
+                field: DiscField::TrackType,
+                ..
+            }
+            | Self::Track {
+                field: TrackField::TrackType,
+                ..
+            } => MetadataValueKind::TrackType,
+            Self::Album(AlbumField::Tags)
+            | Self::Disc {
+                field: DiscField::Tags,
+                ..
+            }
+            | Self::Track {
+                field: TrackField::Tags,
+                ..
+            } => MetadataValueKind::TextList,
+        }
+    }
+
+    const fn allows_absent(self) -> bool {
+        matches!(
+            self,
+            Self::Album(AlbumField::Edition)
+                | Self::Disc {
+                    field: DiscField::Title
+                        | DiscField::Artist
+                        | DiscField::Artists
+                        | DiscField::TrackType,
+                    ..
+                }
+                | Self::Track {
+                    field: TrackField::Artist | TrackField::Artists | TrackField::TrackType,
+                    ..
+                }
+        )
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum MetadataValueKind {
+    Text,
+    Date,
+    TrackType,
+    TextList,
+    TextMap,
+    Absent,
+}
+
+/// Exact metadata value as observed. Text is never normalized or rewritten.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case", tag = "type", content = "value")]
+pub enum MetadataValue {
+    Text(String),
+    Date(AnniDate),
+    TrackType(TrackType),
+    TextList(Vec<String>),
+    TextMap(BTreeMap<String, String>),
+    Absent,
+}
+
+impl MetadataValue {
+    pub const fn kind(&self) -> MetadataValueKind {
+        match self {
+            Self::Text(_) => MetadataValueKind::Text,
+            Self::Date(_) => MetadataValueKind::Date,
+            Self::TrackType(_) => MetadataValueKind::TrackType,
+            Self::TextList(_) => MetadataValueKind::TextList,
+            Self::TextMap(_) => MetadataValueKind::TextMap,
+            Self::Absent => MetadataValueKind::Absent,
+        }
+    }
+
+    fn is_present(&self) -> bool {
+        match self {
+            Self::Text(value) => !value.is_empty(),
+            Self::TextList(values) => !values.is_empty(),
+            Self::TextMap(values) => !values.is_empty(),
+            Self::Date(value) => value.year() != 0,
+            Self::Absent => false,
+            Self::TrackType(_) => true,
+        }
+    }
+}
+
+/// Authority of the underlying source, independent from who collected it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EvidenceSourceKind {
+    CdBooklet,
+    CdPackaging,
+    OfficialLabel,
+    OfficialArtist,
+    OfficialStore,
+    StreamingService,
+    Vgmdb,
+    CommunitySource,
+    Filename,
+    DerivedInference,
+}
+
+impl EvidenceSourceKind {
+    pub const fn authority_rank(self) -> u8 {
+        match self {
+            Self::CdBooklet => 0,
+            Self::CdPackaging => 1,
+            Self::OfficialLabel | Self::OfficialArtist => 2,
+            Self::OfficialStore => 3,
+            Self::StreamingService => 4,
+            Self::Vgmdb => 5,
+            Self::CommunitySource => 6,
+            Self::Filename => 7,
+            Self::DerivedInference => 8,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EvidenceMethod {
+    ManualTranscription,
+    AutomatedExtraction,
+    WebImport,
+    Inference,
+}
+
+impl EvidenceMethod {
+    const fn rank(self) -> u8 {
+        match self {
+            Self::ManualTranscription => 0,
+            Self::AutomatedExtraction => 1,
+            Self::WebImport => 2,
+            Self::Inference => 3,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Evidence {
+    source_kind: EvidenceSourceKind,
+    locator: String,
+    detail: Option<String>,
+    method: EvidenceMethod,
+}
+
+impl Evidence {
+    pub fn new(
+        source_kind: EvidenceSourceKind,
+        locator: impl Into<String>,
+        detail: Option<String>,
+        method: EvidenceMethod,
+    ) -> Self {
+        Self {
+            source_kind,
+            locator: locator.into(),
+            detail,
+            method,
+        }
+    }
+
+    pub const fn source_kind(&self) -> EvidenceSourceKind {
+        self.source_kind
+    }
+
+    pub fn locator(&self) -> &str {
+        &self.locator
+    }
+
+    pub fn detail(&self) -> Option<&str> {
+        self.detail.as_deref()
+    }
+
+    pub const fn method(&self) -> EvidenceMethod {
+        self.method
+    }
+
+    fn method_matches_source(&self) -> bool {
+        match self.source_kind {
+            EvidenceSourceKind::CdBooklet | EvidenceSourceKind::CdPackaging => matches!(
+                self.method,
+                EvidenceMethod::ManualTranscription | EvidenceMethod::AutomatedExtraction
+            ),
+            EvidenceSourceKind::OfficialLabel
+            | EvidenceSourceKind::OfficialArtist
+            | EvidenceSourceKind::OfficialStore
+            | EvidenceSourceKind::StreamingService
+            | EvidenceSourceKind::Vgmdb
+            | EvidenceSourceKind::CommunitySource => {
+                !matches!(self.method, EvidenceMethod::Inference)
+            }
+            EvidenceSourceKind::Filename => !matches!(self.method, EvidenceMethod::WebImport),
+            EvidenceSourceKind::DerivedInference => self.method == EvidenceMethod::Inference,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct Confidence(u16);
+
+impl Confidence {
+    pub const MAX: u16 = 10_000;
+
+    pub const fn new(basis_points: u16) -> Option<Self> {
+        if basis_points <= Self::MAX {
+            Some(Self(basis_points))
+        } else {
+            None
+        }
+    }
+
+    pub const fn basis_points(self) -> u16 {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MetadataCandidate {
+    id: Uuid,
+    field: FieldPath,
+    value: MetadataValue,
+    evidence: Evidence,
+    confidence: Confidence,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum MetadataDecision {
+    Pending,
+    Accepted,
+    Rejected,
+}
+
+impl MetadataCandidate {
+    pub fn new(
+        id: Uuid,
+        field: FieldPath,
+        value: MetadataValue,
+        evidence: Evidence,
+        confidence: Confidence,
+    ) -> Result<Self, MetadataError> {
+        if !evidence.method_matches_source() {
+            return Err(MetadataError::EvidenceMethodMismatch {
+                source_kind: evidence.source_kind,
+                method: evidence.method,
+            });
+        }
+        let actual = value.kind();
+        let expected = field.value_kind();
+        if actual != expected && !(actual == MetadataValueKind::Absent && field.allows_absent()) {
+            return Err(MetadataError::ValueKindMismatch {
+                field,
+                expected,
+                actual,
+            });
+        }
+        Ok(Self {
+            id,
+            field,
+            value,
+            evidence,
+            confidence,
+        })
+    }
+
+    pub fn track_type_suggestion(
+        id: Uuid,
+        field: FieldPath,
+        title: &str,
+        source_candidate_id: Uuid,
+        confidence: Confidence,
+    ) -> Result<Option<Self>, MetadataError> {
+        if !matches!(
+            field,
+            FieldPath::Track {
+                field: TrackField::TrackType,
+                ..
+            }
+        ) {
+            return Err(MetadataError::InvalidTrackTypeSuggestionTarget { field });
+        }
+        let Some(track_type) = TrackType::guess(title) else {
+            return Ok(None);
+        };
+        Ok(Some(Self::new(
+            id,
+            field,
+            MetadataValue::TrackType(track_type),
+            Evidence::new(
+                EvidenceSourceKind::DerivedInference,
+                format!("candidate:{source_candidate_id}"),
+                Some("TrackType::guess title heuristic".to_owned()),
+                EvidenceMethod::Inference,
+            ),
+            confidence,
+        )?))
+    }
+
+    pub const fn id(&self) -> Uuid {
+        self.id
+    }
+
+    pub const fn field(&self) -> FieldPath {
+        self.field
+    }
+
+    pub const fn value(&self) -> &MetadataValue {
+        &self.value
+    }
+
+    pub const fn evidence(&self) -> &Evidence {
+        &self.evidence
+    }
+
+    pub const fn confidence(&self) -> Confidence {
+        self.confidence
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MetadataDraft {
+    revision: MetadataRevision,
+    review_context: Option<MetadataReviewContext>,
+    candidates: Vec<MetadataCandidate>,
+    accepted: BTreeMap<FieldPath, Uuid>,
+    rejected: HashSet<Uuid>,
+}
+
+const METADATA_SNAPSHOT_SCHEMA_VERSION: u16 = 1;
+
+/// Persistence-shaped metadata document.
+///
+/// Deserializing this type does not make it trusted. Call
+/// [`MetadataDraft::restore`] to re-run all domain invariants before use.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MetadataDraftSnapshot {
+    schema_version: u16,
+    revision: u64,
+    #[serde(default)]
+    review_context: Option<MetadataReviewContext>,
+    candidates: Vec<MetadataCandidateSnapshot>,
+    accepted: Vec<AcceptedCandidateSnapshot>,
+    rejected: Vec<Uuid>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+struct MetadataCandidateSnapshot {
+    id: Uuid,
+    field: FieldPath,
+    value: MetadataValue,
+    evidence: Evidence,
+    confidence_basis_points: u16,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+struct AcceptedCandidateSnapshot {
+    field: FieldPath,
+    candidate_id: Uuid,
+}
+
+impl MetadataDraft {
+    pub fn new(revision: MetadataRevision) -> Self {
+        Self {
+            revision,
+            review_context: None,
+            candidates: Vec::new(),
+            accepted: BTreeMap::new(),
+            rejected: HashSet::new(),
+        }
+    }
+
+    pub const fn revision(&self) -> MetadataRevision {
+        self.revision
+    }
+
+    pub const fn review_context(&self) -> Option<&MetadataReviewContext> {
+        self.review_context.as_ref()
+    }
+
+    pub fn set_review_context(
+        &mut self,
+        context: MetadataReviewContext,
+    ) -> Result<(), MetadataError> {
+        if self
+            .review_context
+            .as_ref()
+            .is_some_and(|current| current != &context)
+            && !self.candidates.is_empty()
+        {
+            return Err(MetadataError::ReviewContextChangeRequiresRevision);
+        }
+        for candidate in &self.candidates {
+            context.validate_field(candidate.field)?;
+        }
+        self.review_context = Some(context);
+        Ok(())
+    }
+
+    pub fn candidates(&self) -> &[MetadataCandidate] {
+        &self.candidates
+    }
+
+    pub fn add_candidate(&mut self, candidate: MetadataCandidate) -> Result<(), MetadataError> {
+        if self.candidate(candidate.id).is_some() {
+            return Err(MetadataError::DuplicateCandidate { id: candidate.id });
+        }
+        if let Some(context) = &self.review_context {
+            context.validate_field(candidate.field)?;
+        }
+        self.candidates.push(candidate);
+        Ok(())
+    }
+
+    pub fn candidate(&self, id: Uuid) -> Option<&MetadataCandidate> {
+        self.candidates.iter().find(|candidate| candidate.id == id)
+    }
+
+    pub fn recommendation(&self, field: FieldPath) -> Option<&MetadataCandidate> {
+        self.candidates
+            .iter()
+            .filter(|candidate| candidate.field == field && !self.rejected.contains(&candidate.id))
+            .min_by(compare_candidates)
+    }
+
+    pub fn accept(&mut self, candidate_id: Uuid) -> Result<(), MetadataError> {
+        let field = self
+            .candidate(candidate_id)
+            .ok_or(MetadataError::UnknownCandidate { id: candidate_id })?
+            .field;
+        self.rejected.remove(&candidate_id);
+        self.accepted.insert(field, candidate_id);
+        Ok(())
+    }
+
+    pub fn reject(&mut self, candidate_id: Uuid) -> Result<(), MetadataError> {
+        let field = self
+            .candidate(candidate_id)
+            .ok_or(MetadataError::UnknownCandidate { id: candidate_id })?
+            .field;
+        self.rejected.insert(candidate_id);
+        if self.accepted.get(&field) == Some(&candidate_id) {
+            self.accepted.remove(&field);
+        }
+        Ok(())
+    }
+
+    pub fn accepted_candidate(&self, field: FieldPath) -> Option<&MetadataCandidate> {
+        self.accepted
+            .get(&field)
+            .and_then(|candidate_id| self.candidate(*candidate_id))
+    }
+
+    pub fn accepted_value(&self, field: FieldPath) -> Option<&MetadataValue> {
+        self.accepted_candidate(field).map(MetadataCandidate::value)
+    }
+
+    pub fn decision(&self, candidate_id: Uuid) -> Result<MetadataDecision, MetadataError> {
+        let candidate = self
+            .candidate(candidate_id)
+            .ok_or(MetadataError::UnknownCandidate { id: candidate_id })?;
+        if self.accepted.get(&candidate.field) == Some(&candidate_id) {
+            Ok(MetadataDecision::Accepted)
+        } else if self.rejected.contains(&candidate_id) {
+            Ok(MetadataDecision::Rejected)
+        } else {
+            Ok(MetadataDecision::Pending)
+        }
+    }
+
+    pub fn fork(&self, revision: MetadataRevision) -> Result<Self, MetadataError> {
+        if revision <= self.revision {
+            return Err(MetadataError::RevisionNotAdvanced {
+                current: self.revision,
+                requested: revision,
+            });
+        }
+        let mut next = self.clone();
+        next.revision = revision;
+        Ok(next)
+    }
+
+    pub fn completeness(&self, requirements: &MetadataRequirements) -> CompletenessReport {
+        let missing = requirements
+            .required
+            .iter()
+            .copied()
+            .filter(|field| {
+                !self
+                    .accepted_value(*field)
+                    .is_some_and(MetadataValue::is_present)
+            })
+            .collect();
+        CompletenessReport {
+            total_required: requirements.required.len(),
+            missing,
+        }
+    }
+
+    pub fn review_completeness(&self) -> Result<CompletenessReport, MetadataError> {
+        let context = self
+            .review_context
+            .as_ref()
+            .ok_or(MetadataError::ReviewContextMissing)?;
+        Ok(self.completeness(&context.requirements()))
+    }
+
+    pub fn snapshot(&self) -> MetadataDraftSnapshot {
+        let accepted = self
+            .accepted
+            .iter()
+            .map(|(field, candidate_id)| AcceptedCandidateSnapshot {
+                field: *field,
+                candidate_id: *candidate_id,
+            })
+            .collect();
+        let mut rejected: Vec<_> = self.rejected.iter().copied().collect();
+        rejected.sort_by(|left, right| left.as_bytes().cmp(right.as_bytes()));
+
+        MetadataDraftSnapshot {
+            schema_version: METADATA_SNAPSHOT_SCHEMA_VERSION,
+            revision: self.revision.get(),
+            review_context: self.review_context.clone(),
+            candidates: self
+                .candidates
+                .iter()
+                .map(|candidate| MetadataCandidateSnapshot {
+                    id: candidate.id,
+                    field: candidate.field,
+                    value: candidate.value.clone(),
+                    evidence: candidate.evidence.clone(),
+                    confidence_basis_points: candidate.confidence.basis_points(),
+                })
+                .collect(),
+            accepted,
+            rejected,
+        }
+    }
+
+    pub fn restore(snapshot: MetadataDraftSnapshot) -> Result<Self, MetadataError> {
+        if snapshot.schema_version != METADATA_SNAPSHOT_SCHEMA_VERSION {
+            return Err(MetadataError::UnsupportedSnapshotVersion {
+                actual: snapshot.schema_version,
+            });
+        }
+        let revision = MetadataRevision::new(snapshot.revision).ok_or(
+            MetadataError::InvalidSnapshotRevision {
+                actual: snapshot.revision,
+            },
+        )?;
+        let mut draft = Self::new(revision);
+        if let Some(context) = snapshot.review_context {
+            draft.set_review_context(context)?;
+        }
+
+        for candidate in snapshot.candidates {
+            let confidence = Confidence::new(candidate.confidence_basis_points).ok_or(
+                MetadataError::InvalidSnapshotConfidence {
+                    candidate_id: candidate.id,
+                    actual: candidate.confidence_basis_points,
+                },
+            )?;
+            draft.add_candidate(MetadataCandidate::new(
+                candidate.id,
+                candidate.field,
+                candidate.value,
+                candidate.evidence,
+                confidence,
+            )?)?;
+        }
+
+        for candidate_id in snapshot.rejected {
+            if !draft.rejected.insert(candidate_id) {
+                return Err(MetadataError::DuplicateRejectedCandidate { candidate_id });
+            }
+            if draft.candidate(candidate_id).is_none() {
+                return Err(MetadataError::UnknownCandidate { id: candidate_id });
+            }
+        }
+
+        for accepted in snapshot.accepted {
+            let candidate =
+                draft
+                    .candidate(accepted.candidate_id)
+                    .ok_or(MetadataError::UnknownCandidate {
+                        id: accepted.candidate_id,
+                    })?;
+            if candidate.field != accepted.field {
+                return Err(MetadataError::AcceptedFieldMismatch {
+                    candidate_id: accepted.candidate_id,
+                    declared: accepted.field,
+                    actual: candidate.field,
+                });
+            }
+            if draft.rejected.contains(&accepted.candidate_id) {
+                return Err(MetadataError::CandidateAcceptedAndRejected {
+                    candidate_id: accepted.candidate_id,
+                });
+            }
+            if draft
+                .accepted
+                .insert(accepted.field, accepted.candidate_id)
+                .is_some()
+            {
+                return Err(MetadataError::DuplicateAcceptedField {
+                    field: accepted.field,
+                });
+            }
+        }
+
+        Ok(draft)
+    }
+}
+
+fn compare_candidates(left: &&MetadataCandidate, right: &&MetadataCandidate) -> Ordering {
+    left.evidence
+        .source_kind
+        .authority_rank()
+        .cmp(&right.evidence.source_kind.authority_rank())
+        .then_with(|| {
+            left.evidence
+                .method
+                .rank()
+                .cmp(&right.evidence.method.rank())
+        })
+        .then_with(|| right.confidence.cmp(&left.confidence))
+        .then_with(|| left.id.as_bytes().cmp(right.id.as_bytes()))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AlbumLayout {
+    track_counts: Vec<NonZeroU16>,
+}
+
+impl AlbumLayout {
+    pub fn new(track_counts: Vec<NonZeroU16>) -> Result<Self, MetadataError> {
+        if track_counts.is_empty() {
+            return Err(MetadataError::EmptyAlbumLayout);
+        }
+        if track_counts.len() > usize::from(u16::MAX) {
+            return Err(MetadataError::TooManyDiscs {
+                actual: track_counts.len(),
+            });
+        }
+        Ok(Self { track_counts })
+    }
+
+    pub fn track_counts(&self) -> &[NonZeroU16] {
+        &self.track_counts
+    }
+
+    fn contains(&self, field: FieldPath) -> bool {
+        match field {
+            FieldPath::Album(_) => true,
+            FieldPath::Disc { disc, .. } => {
+                self.track_counts.get(usize::from(disc.get() - 1)).is_some()
+            }
+            FieldPath::Track { disc, track, .. } => self
+                .track_counts
+                .get(usize::from(disc.get() - 1))
+                .is_some_and(|track_count| track.get() <= track_count.get()),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum MetadataProfile {
+    Cd,
+    Streaming,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MetadataReviewContext {
+    profile: MetadataProfile,
+    layout: AlbumLayout,
+}
+
+impl MetadataReviewContext {
+    pub const fn new(profile: MetadataProfile, layout: AlbumLayout) -> Self {
+        Self { profile, layout }
+    }
+
+    pub const fn profile(&self) -> MetadataProfile {
+        self.profile
+    }
+
+    pub const fn layout(&self) -> &AlbumLayout {
+        &self.layout
+    }
+
+    pub fn requirements(&self) -> MetadataRequirements {
+        MetadataRequirements::for_review(self.profile, &self.layout)
+    }
+
+    fn validate_field(&self, field: FieldPath) -> Result<(), MetadataError> {
+        if self.layout.contains(field) {
+            Ok(())
+        } else {
+            Err(MetadataError::FieldOutsideAlbumLayout { field })
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MetadataRequirements {
+    required: BTreeSet<FieldPath>,
+}
+
+impl MetadataRequirements {
+    pub fn for_album(layout: &AlbumLayout) -> Self {
+        Self::for_review(MetadataProfile::Cd, layout)
+    }
+
+    pub fn for_review(profile: MetadataProfile, layout: &AlbumLayout) -> Self {
+        let mut required = BTreeSet::from([
+            FieldPath::Album(AlbumField::Title),
+            FieldPath::Album(AlbumField::Artist),
+            FieldPath::Album(AlbumField::ReleaseDate),
+            FieldPath::Album(AlbumField::TrackType),
+        ]);
+        if profile == MetadataProfile::Cd {
+            required.insert(FieldPath::Album(AlbumField::Catalog));
+        }
+        for (disc_index, track_count) in layout.track_counts.iter().enumerate() {
+            let disc = NonZeroU16::new((disc_index + 1) as u16)
+                .expect("album layout cannot contain more than u16::MAX discs");
+            if profile == MetadataProfile::Cd {
+                required.insert(FieldPath::Disc {
+                    disc,
+                    field: DiscField::Catalog,
+                });
+            }
+            for track in 1..=track_count.get() {
+                let track = NonZeroU16::new(track).expect("track number starts at one");
+                required.insert(FieldPath::Track {
+                    disc,
+                    track,
+                    field: TrackField::Title,
+                });
+                required.insert(FieldPath::Track {
+                    disc,
+                    track,
+                    field: TrackField::TrackType,
+                });
+            }
+        }
+        Self { required }
+    }
+
+    pub fn required(&self) -> &BTreeSet<FieldPath> {
+        &self.required
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CompletenessReport {
+    total_required: usize,
+    missing: Vec<FieldPath>,
+}
+
+impl CompletenessReport {
+    pub const fn total_required(&self) -> usize {
+        self.total_required
+    }
+
+    pub const fn accepted_required(&self) -> usize {
+        self.total_required - self.missing.len()
+    }
+
+    pub fn missing(&self) -> &[FieldPath] {
+        &self.missing
+    }
+
+    pub fn is_complete(&self) -> bool {
+        self.missing.is_empty()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum MetadataError {
+    #[error("metadata field {field:?} expects {expected:?}, got {actual:?}")]
+    ValueKindMismatch {
+        field: FieldPath,
+        expected: MetadataValueKind,
+        actual: MetadataValueKind,
+    },
+    #[error("metadata candidate {id} already exists")]
+    DuplicateCandidate { id: Uuid },
+    #[error("metadata candidate {id} does not exist")]
+    UnknownCandidate { id: Uuid },
+    #[error("evidence source {source_kind:?} cannot use collection method {method:?}")]
+    EvidenceMethodMismatch {
+        source_kind: EvidenceSourceKind,
+        method: EvidenceMethod,
+    },
+    #[error("track type suggestion cannot target {field:?}")]
+    InvalidTrackTypeSuggestionTarget { field: FieldPath },
+    #[error("metadata revision must advance beyond {current}, got {requested}")]
+    RevisionNotAdvanced {
+        current: MetadataRevision,
+        requested: MetadataRevision,
+    },
+    #[error("album layout must contain at least one disc")]
+    EmptyAlbumLayout,
+    #[error("album layout contains {actual} discs, exceeding the u16 limit")]
+    TooManyDiscs { actual: usize },
+    #[error("metadata review context has not been configured")]
+    ReviewContextMissing,
+    #[error("metadata review context cannot change after candidates exist; start a new revision")]
+    ReviewContextChangeRequiresRevision,
+    #[error("metadata field {field:?} falls outside the configured album layout")]
+    FieldOutsideAlbumLayout { field: FieldPath },
+    #[error("metadata snapshot schema version {actual} is unsupported")]
+    UnsupportedSnapshotVersion { actual: u16 },
+    #[error("metadata snapshot revision {actual} is invalid")]
+    InvalidSnapshotRevision { actual: u64 },
+    #[error("metadata candidate {candidate_id} has invalid confidence {actual}; maximum is 10000")]
+    InvalidSnapshotConfidence { candidate_id: Uuid, actual: u16 },
+    #[error("metadata snapshot rejects candidate {candidate_id} more than once")]
+    DuplicateRejectedCandidate { candidate_id: Uuid },
+    #[error(
+        "metadata snapshot accepts candidate {candidate_id} for {declared:?}, but it belongs to {actual:?}"
+    )]
+    AcceptedFieldMismatch {
+        candidate_id: Uuid,
+        declared: FieldPath,
+        actual: FieldPath,
+    },
+    #[error("metadata snapshot both accepts and rejects candidate {candidate_id}")]
+    CandidateAcceptedAndRejected { candidate_id: Uuid },
+    #[error("metadata snapshot accepts more than one candidate for {field:?}")]
+    DuplicateAcceptedField { field: FieldPath },
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn confidence(value: u16) -> Confidence {
+        Confidence::new(value).unwrap()
+    }
+
+    fn evidence(kind: EvidenceSourceKind, locator: &str) -> Evidence {
+        Evidence::new(
+            kind,
+            locator,
+            None,
+            match kind {
+                EvidenceSourceKind::CdBooklet => EvidenceMethod::ManualTranscription,
+                EvidenceSourceKind::DerivedInference => EvidenceMethod::Inference,
+                _ => EvidenceMethod::WebImport,
+            },
+        )
+    }
+
+    #[test]
+    fn accepted_text_preserves_original_unicode_exactly() {
+        let value = "曲名（Booklet） / 曲名(Booklet)・A〜B～C";
+        let candidate = MetadataCandidate::new(
+            Uuid::new_v4(),
+            FieldPath::Album(AlbumField::Title),
+            MetadataValue::Text(value.to_owned()),
+            evidence(EvidenceSourceKind::CdBooklet, "booklet.pdf#page=2"),
+            confidence(10_000),
+        )
+        .unwrap();
+        let id = candidate.id();
+        let mut draft = MetadataDraft::new(MetadataRevision::INITIAL);
+        draft.add_candidate(candidate).unwrap();
+        draft.accept(id).unwrap();
+
+        let document = serde_json::to_string(&draft.snapshot()).unwrap();
+        let snapshot = serde_json::from_str(&document).unwrap();
+        let restored = MetadataDraft::restore(snapshot).unwrap();
+
+        assert_eq!(
+            restored.accepted_value(FieldPath::Album(AlbumField::Title)),
+            Some(&MetadataValue::Text(value.to_owned()))
+        );
+        assert_eq!(restored, draft);
+    }
+
+    #[test]
+    fn booklet_candidate_is_recommended_over_web_and_inference() {
+        let field = FieldPath::Album(AlbumField::Title);
+        assert!(matches!(
+            MetadataCandidate::new(
+                Uuid::new_v4(),
+                field,
+                MetadataValue::Text("AI title".to_owned()),
+                Evidence::new(
+                    EvidenceSourceKind::DerivedInference,
+                    "agent:run-1",
+                    None,
+                    EvidenceMethod::WebImport,
+                ),
+                confidence(10_000),
+            ),
+            Err(MetadataError::EvidenceMethodMismatch { .. })
+        ));
+        let mut draft = MetadataDraft::new(MetadataRevision::INITIAL);
+        for (kind, value, confidence_value) in [
+            (
+                EvidenceSourceKind::StreamingService,
+                "Streaming title",
+                10_000,
+            ),
+            (EvidenceSourceKind::DerivedInference, "AI title", 10_000),
+            (EvidenceSourceKind::CdBooklet, "Booklet Title", 8_000),
+        ] {
+            draft
+                .add_candidate(
+                    MetadataCandidate::new(
+                        Uuid::new_v4(),
+                        field,
+                        MetadataValue::Text(value.to_owned()),
+                        evidence(kind, value),
+                        confidence(confidence_value),
+                    )
+                    .unwrap(),
+                )
+                .unwrap();
+        }
+
+        assert_eq!(
+            draft.recommendation(field).unwrap().value(),
+            &MetadataValue::Text("Booklet Title".to_owned())
+        );
+        assert_eq!(draft.accepted_value(field), None);
+    }
+
+    #[test]
+    fn restore_rejects_corrupt_snapshot_confidence() {
+        let candidate_id = Uuid::new_v4();
+        let mut draft = MetadataDraft::new(MetadataRevision::INITIAL);
+        draft
+            .add_candidate(
+                MetadataCandidate::new(
+                    candidate_id,
+                    FieldPath::Album(AlbumField::Title),
+                    MetadataValue::Text("Title".to_owned()),
+                    evidence(EvidenceSourceKind::CdBooklet, "booklet.pdf#page=2"),
+                    confidence(10_000),
+                )
+                .unwrap(),
+            )
+            .unwrap();
+
+        let mut snapshot = draft.snapshot();
+        snapshot.candidates[0].confidence_basis_points = 10_001;
+
+        assert!(matches!(
+            MetadataDraft::restore(snapshot),
+            Err(MetadataError::InvalidSnapshotConfidence {
+                candidate_id: actual_id,
+                actual: 10_001,
+            }) if actual_id == candidate_id
+        ));
+    }
+
+    #[test]
+    fn review_context_distinguishes_cd_requirements_and_rejects_unknown_tracks() {
+        assert!(!MetadataValue::Date(AnniDate::UNKNOWN).is_present());
+        let layout = AlbumLayout::new(vec![NonZeroU16::new(2).unwrap()]).unwrap();
+        let cd = MetadataReviewContext::new(MetadataProfile::Cd, layout.clone());
+        let streaming = MetadataReviewContext::new(MetadataProfile::Streaming, layout);
+        assert!(cd
+            .requirements()
+            .required()
+            .contains(&FieldPath::Album(AlbumField::Catalog)));
+        assert!(!streaming
+            .requirements()
+            .required()
+            .contains(&FieldPath::Album(AlbumField::Catalog)));
+
+        let mut draft = MetadataDraft::new(MetadataRevision::INITIAL);
+        draft.set_review_context(cd).unwrap();
+        let outside_layout = MetadataCandidate::new(
+            Uuid::new_v4(),
+            FieldPath::Track {
+                disc: NonZeroU16::new(1).unwrap(),
+                track: NonZeroU16::new(3).unwrap(),
+                field: TrackField::Title,
+            },
+            MetadataValue::Text("Unknown track".to_owned()),
+            evidence(EvidenceSourceKind::CdBooklet, "booklet.pdf#page=3"),
+            confidence(10_000),
+        )
+        .unwrap();
+
+        assert!(matches!(
+            draft.add_candidate(outside_layout),
+            Err(MetadataError::FieldOutsideAlbumLayout { .. })
+        ));
+    }
+
+    #[test]
+    fn inferred_track_type_remains_a_candidate_until_reviewed() {
+        let disc = NonZeroU16::new(1).unwrap();
+        let track = NonZeroU16::new(1).unwrap();
+        let field = FieldPath::Track {
+            disc,
+            track,
+            field: TrackField::TrackType,
+        };
+        let suggestion = MetadataCandidate::track_type_suggestion(
+            Uuid::new_v4(),
+            field,
+            "Song (Instrumental)",
+            Uuid::new_v4(),
+            confidence(7_500),
+        )
+        .unwrap()
+        .unwrap();
+        let suggestion_id = suggestion.id();
+        let mut draft = MetadataDraft::new(MetadataRevision::INITIAL);
+        draft.add_candidate(suggestion).unwrap();
+
+        let requirements = MetadataRequirements {
+            required: BTreeSet::from([field]),
+        };
+        assert!(!draft.completeness(&requirements).is_complete());
+        draft.accept(suggestion_id).unwrap();
+        assert!(draft.completeness(&requirements).is_complete());
+        assert_eq!(
+            draft.accepted_value(field),
+            Some(&MetadataValue::TrackType(TrackType::Instrumental))
+        );
+    }
+}
diff --git a/anni-ingest/src/path.rs b/anni-ingest/src/path.rs
new file mode 100644
index 00000000..be5a3c34
--- /dev/null
+++ b/anni-ingest/src/path.rs
@@ -0,0 +1,96 @@
+use std::fmt;
+
+use thiserror::Error;
+
+/// A protocol path relative to either the immutable source root or a job's
+/// staging root.
+///
+/// The string is preserved byte-for-byte as UTF-8. In particular, this type
+/// performs no Unicode normalization or punctuation replacement.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct SafeRelativePath(Box<str>);
+
+impl SafeRelativePath {
+    pub fn new(path: impl Into<String>) -> Result<Self, PathError> {
+        let path = path.into();
+        if path.is_empty() {
+            return Err(PathError::Empty);
+        }
+        if path.starts_with('/') {
+            return Err(PathError::Absolute);
+        }
+
+        for (index, byte) in path.bytes().enumerate() {
+            match byte {
+                0 => return Err(PathError::NulByte { index }),
+                b'\\' => return Err(PathError::Backslash { index }),
+                _ => {}
+            }
+        }
+
+        for (index, component) in path.split('/').enumerate() {
+            match component {
+                "" => return Err(PathError::EmptyComponent { index }),
+                "." | ".." => {
+                    return Err(PathError::TraversalComponent {
+                        index,
+                        component: component.to_owned(),
+                    });
+                }
+                _ => {}
+            }
+        }
+
+        Ok(Self(path.into_boxed_str()))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Display for SafeRelativePath {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+impl fmt::Debug for SafeRelativePath {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_tuple("SafeRelativePath")
+            .field(&self.0)
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum PathError {
+    #[error("relative path cannot be empty")]
+    Empty,
+    #[error("absolute paths are not allowed")]
+    Absolute,
+    #[error("relative path contains a NUL byte at offset {index}")]
+    NulByte { index: usize },
+    #[error("relative path contains a backslash at offset {index}; use '/' as the separator")]
+    Backslash { index: usize },
+    #[error("relative path contains an empty component at index {index}")]
+    EmptyComponent { index: usize },
+    #[error("relative path contains traversal component {component:?} at index {index}")]
+    TraversalComponent { index: usize, component: String },
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn path_preserves_unicode_but_rejects_ambiguous_or_traversing_inputs() {
+        let original = "歌詞／画像/Ａ・Ｂ〜Ｃ（初回盤）.png";
+        assert_eq!(SafeRelativePath::new(original).unwrap().as_str(), original);
+
+        for invalid in ["", "/absolute.wav", "../track.wav", "a/./b", "a//b", "a\\b"] {
+            assert!(SafeRelativePath::new(invalid).is_err(), "{invalid:?}");
+        }
+    }
+}
diff --git a/anni-ingest/src/plan.rs b/anni-ingest/src/plan.rs
new file mode 100644
index 00000000..7079c8c9
--- /dev/null
+++ b/anni-ingest/src/plan.rs
@@ -0,0 +1,422 @@
+use std::collections::BTreeSet;
+
+use sha2::{Digest as ShaDigest, Sha256};
+use thiserror::Error;
+use uuid::Uuid;
+
+use crate::{
+    manifest::{hash_string, hash_u64},
+    AudioFormat, Digest, InputFileKind, InputManifest, MetadataRevision, SafeRelativePath,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum SplitOutputFormat {
+    Wav,
+    Flac,
+}
+
+/// Side-effect operations allowed inside a job-specific staging directory.
+/// There is intentionally no delete or source-move operation.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PlanOperation {
+    CopyFile {
+        source: SafeRelativePath,
+        target: SafeRelativePath,
+    },
+    /// Copy a previously verified asset from the worker's trusted content
+    /// repository into staging.
+    ///
+    /// The repository path is deliberately relative: resolving remote URLs or
+    /// downloading data is outside the immutable plan and worker boundary.
+    MaterializeAsset {
+        repository_path: SafeRelativePath,
+        digest: Digest,
+        byte_length: u64,
+        target: SafeRelativePath,
+    },
+    SplitCueWave {
+        cue: SafeRelativePath,
+        wave: SafeRelativePath,
+        outputs: Vec<SafeRelativePath>,
+        format: SplitOutputFormat,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExecutionPlan {
+    job_id: Uuid,
+    metadata_revision: MetadataRevision,
+    manifest_digest: Digest,
+    operations: Vec<PlanOperation>,
+    digest: Digest,
+}
+
+impl ExecutionPlan {
+    pub fn new(
+        job_id: Uuid,
+        metadata_revision: MetadataRevision,
+        manifest: &InputManifest,
+        operations: Vec<PlanOperation>,
+    ) -> Result<Self, PlanError> {
+        if operations.is_empty() {
+            return Err(PlanError::Empty);
+        }
+
+        let mut targets = BTreeSet::new();
+        for operation in &operations {
+            match operation {
+                PlanOperation::CopyFile { source, target } => {
+                    require_source(manifest, source, None)?;
+                    insert_target(&mut targets, target)?;
+                }
+                PlanOperation::MaterializeAsset { target, .. } => {
+                    insert_target(&mut targets, target)?;
+                }
+                PlanOperation::SplitCueWave {
+                    cue, wave, outputs, ..
+                } => {
+                    require_source(manifest, cue, Some(InputFileKind::CueSheet))?;
+                    require_source(manifest, wave, Some(InputFileKind::Audio(AudioFormat::Wav)))?;
+                    if outputs.is_empty() {
+                        return Err(PlanError::EmptySplitOutputs);
+                    }
+                    for output in outputs {
+                        insert_target(&mut targets, output)?;
+                    }
+                }
+            }
+        }
+
+        let manifest_digest = manifest.digest();
+        let digest = digest_plan(job_id, metadata_revision, manifest_digest, &operations);
+        Ok(Self {
+            job_id,
+            metadata_revision,
+            manifest_digest,
+            operations,
+            digest,
+        })
+    }
+
+    pub const fn job_id(&self) -> Uuid {
+        self.job_id
+    }
+
+    pub const fn metadata_revision(&self) -> MetadataRevision {
+        self.metadata_revision
+    }
+
+    pub const fn manifest_digest(&self) -> Digest {
+        self.manifest_digest
+    }
+
+    pub fn operations(&self) -> &[PlanOperation] {
+        &self.operations
+    }
+
+    pub const fn digest(&self) -> Digest {
+        self.digest
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum PlanError {
+    #[error("execution plan cannot be empty")]
+    Empty,
+    #[error("execution plan references source not present in manifest: {path}")]
+    UnknownSource { path: SafeRelativePath },
+    #[error("source {path} has kind {actual:?}, expected {expected:?}")]
+    SourceKindMismatch {
+        path: SafeRelativePath,
+        expected: InputFileKind,
+        actual: InputFileKind,
+    },
+    #[error("CUE/WAV split operation must declare at least one output")]
+    EmptySplitOutputs,
+    #[error("multiple operations write the same staging target: {path}")]
+    DuplicateTarget { path: SafeRelativePath },
+    #[error("staging target uses worker-reserved path: {path}")]
+    ReservedTargetPath { path: SafeRelativePath },
+}
+
+fn require_source(
+    manifest: &InputManifest,
+    path: &SafeRelativePath,
+    expected: Option<InputFileKind>,
+) -> Result<(), PlanError> {
+    let entry = manifest
+        .entry(path)
+        .ok_or_else(|| PlanError::UnknownSource { path: path.clone() })?;
+    if let Some(expected) = expected
+        && entry.kind() != expected
+    {
+        return Err(PlanError::SourceKindMismatch {
+            path: path.clone(),
+            expected,
+            actual: entry.kind(),
+        });
+    }
+    Ok(())
+}
+
+fn insert_target(
+    targets: &mut BTreeSet<SafeRelativePath>,
+    target: &SafeRelativePath,
+) -> Result<(), PlanError> {
+    if target.as_str() == ".anni-partials" || target.as_str().starts_with(".anni-partials/") {
+        return Err(PlanError::ReservedTargetPath {
+            path: target.clone(),
+        });
+    }
+    if targets.insert(target.clone()) {
+        Ok(())
+    } else {
+        Err(PlanError::DuplicateTarget {
+            path: target.clone(),
+        })
+    }
+}
+
+fn digest_plan(
+    job_id: Uuid,
+    metadata_revision: MetadataRevision,
+    manifest_digest: Digest,
+    operations: &[PlanOperation],
+) -> Digest {
+    let mut hasher = Sha256::new();
+    hasher.update(b"anni-ingest-execution-plan-v1\0");
+    hasher.update(job_id.as_bytes());
+    hash_u64(&mut hasher, metadata_revision.get());
+    hasher.update(manifest_digest.as_bytes());
+    hash_u64(&mut hasher, operations.len() as u64);
+
+    for operation in operations {
+        match operation {
+            PlanOperation::CopyFile { source, target } => {
+                hasher.update([0]);
+                hash_string(&mut hasher, source.as_str());
+                hash_string(&mut hasher, target.as_str());
+            }
+            PlanOperation::MaterializeAsset {
+                repository_path,
+                digest,
+                byte_length,
+                target,
+            } => {
+                hasher.update([2]);
+                hash_string(&mut hasher, repository_path.as_str());
+                hasher.update(digest.as_bytes());
+                hash_u64(&mut hasher, *byte_length);
+                hash_string(&mut hasher, target.as_str());
+            }
+            PlanOperation::SplitCueWave {
+                cue,
+                wave,
+                outputs,
+                format,
+            } => {
+                hasher.update([1]);
+                hash_string(&mut hasher, cue.as_str());
+                hash_string(&mut hasher, wave.as_str());
+                hasher.update([match format {
+                    SplitOutputFormat::Wav => 0,
+                    SplitOutputFormat::Flac => 1,
+                }]);
+                hash_u64(&mut hasher, outputs.len() as u64);
+                for output in outputs {
+                    hash_string(&mut hasher, output.as_str());
+                }
+            }
+        }
+    }
+
+    Digest::new(hasher.finalize().into())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{ManifestEntry, MetadataRevision};
+
+    fn path(value: &str) -> SafeRelativePath {
+        SafeRelativePath::new(value).unwrap()
+    }
+
+    fn manifest() -> InputManifest {
+        InputManifest::new(vec![
+            ManifestEntry::new(
+                path("disc.wav"),
+                100,
+                Digest::new([1; Digest::LENGTH]),
+                InputFileKind::Audio(AudioFormat::Wav),
+            ),
+            ManifestEntry::new(
+                path("disc.cue"),
+                20,
+                Digest::new([2; Digest::LENGTH]),
+                InputFileKind::CueSheet,
+            ),
+            ManifestEntry::new(
+                path("cover.jpg"),
+                30,
+                Digest::new([3; Digest::LENGTH]),
+                InputFileKind::CoverCandidate,
+            ),
+        ])
+        .unwrap()
+    }
+
+    fn split_operation() -> PlanOperation {
+        PlanOperation::SplitCueWave {
+            cue: path("disc.cue"),
+            wave: path("disc.wav"),
+            outputs: vec![path("tracks/01.flac"), path("tracks/02.flac")],
+            format: SplitOutputFormat::Flac,
+        }
+    }
+
+    #[test]
+    fn plan_digest_binds_job_revision_manifest_and_exact_outputs() {
+        let job_id = Uuid::new_v4();
+        let manifest = manifest();
+        let plan = ExecutionPlan::new(
+            job_id,
+            MetadataRevision::INITIAL,
+            &manifest,
+            vec![split_operation()],
+        )
+        .unwrap();
+        let same = ExecutionPlan::new(
+            job_id,
+            MetadataRevision::INITIAL,
+            &manifest,
+            vec![split_operation()],
+        )
+        .unwrap();
+        let changed = ExecutionPlan::new(
+            job_id,
+            MetadataRevision::new(2).unwrap(),
+            &manifest,
+            vec![split_operation()],
+        )
+        .unwrap();
+
+        assert_eq!(plan.digest(), same.digest());
+        assert_ne!(plan.digest(), changed.digest());
+        assert_eq!(plan.manifest_digest(), manifest.digest());
+    }
+
+    #[test]
+    fn plan_rejects_unknown_sources_wrong_roles_and_target_collisions() {
+        let manifest = manifest();
+        let job_id = Uuid::new_v4();
+
+        let unknown = PlanOperation::CopyFile {
+            source: path("missing.jpg"),
+            target: path("cover.jpg"),
+        };
+        assert!(matches!(
+            ExecutionPlan::new(job_id, MetadataRevision::INITIAL, &manifest, vec![unknown]),
+            Err(PlanError::UnknownSource { .. })
+        ));
+
+        let wrong_role = PlanOperation::SplitCueWave {
+            cue: path("cover.jpg"),
+            wave: path("disc.wav"),
+            outputs: vec![path("01.flac")],
+            format: SplitOutputFormat::Flac,
+        };
+        assert!(matches!(
+            ExecutionPlan::new(
+                job_id,
+                MetadataRevision::INITIAL,
+                &manifest,
+                vec![wrong_role]
+            ),
+            Err(PlanError::SourceKindMismatch { .. })
+        ));
+
+        let collision = PlanOperation::CopyFile {
+            source: path("cover.jpg"),
+            target: path("tracks/01.flac"),
+        };
+        assert!(matches!(
+            ExecutionPlan::new(
+                job_id,
+                MetadataRevision::INITIAL,
+                &manifest,
+                vec![split_operation(), collision]
+            ),
+            Err(PlanError::DuplicateTarget { .. })
+        ));
+
+        let reserved = PlanOperation::CopyFile {
+            source: path("cover.jpg"),
+            target: path(".anni-partials/cover.jpg"),
+        };
+        assert!(matches!(
+            ExecutionPlan::new(job_id, MetadataRevision::INITIAL, &manifest, vec![reserved]),
+            Err(PlanError::ReservedTargetPath { .. })
+        ));
+    }
+
+    #[test]
+    fn asset_operation_digest_binds_content_length_and_target() {
+        let job_id = Uuid::new_v4();
+        let manifest = manifest();
+        let operation = |digest, byte_length, target| PlanOperation::MaterializeAsset {
+            repository_path: path("sha256/verified-cover"),
+            digest,
+            byte_length,
+            target: path(target),
+        };
+        let plan = |operation| {
+            ExecutionPlan::new(
+                job_id,
+                MetadataRevision::INITIAL,
+                &manifest,
+                vec![operation],
+            )
+            .unwrap()
+            .digest()
+        };
+
+        let original = plan(operation(
+            Digest::new([4; Digest::LENGTH]),
+            1_024,
+            "cover.jpg",
+        ));
+        assert_eq!(
+            original,
+            plan(operation(
+                Digest::new([4; Digest::LENGTH]),
+                1_024,
+                "cover.jpg"
+            ))
+        );
+        assert_ne!(
+            original,
+            plan(operation(
+                Digest::new([5; Digest::LENGTH]),
+                1_024,
+                "cover.jpg"
+            ))
+        );
+        assert_ne!(
+            original,
+            plan(operation(
+                Digest::new([4; Digest::LENGTH]),
+                2_048,
+                "cover.jpg"
+            ))
+        );
+        assert_ne!(
+            original,
+            plan(operation(
+                Digest::new([4; Digest::LENGTH]),
+                1_024,
+                "booklet/cover.jpg"
+            ))
+        );
+    }
+}
diff --git a/anni-metadata/src/annim/client.rs b/anni-metadata/src/annim/client.rs
index 826b6f5b..8bccf54e 100644
--- a/anni-metadata/src/annim/client.rs
+++ b/anni-metadata/src/annim/client.rs
@@ -3,14 +3,26 @@ use crate::{
     model,
 };
 use cynic::{http::ReqwestExt, MutationBuilder, QueryBuilder};
+use reqwest::header::{HeaderMap, HeaderValue, AUTHORIZATION};
+use thiserror::Error;
 
 use super::query::album::MetadataOrganizeLevel;
 
 pub struct AnnimClient {
-    client: reqwest::Client,
+    client: Result<reqwest::Client, AnnimClientConfigurationError>,
     endpoint: String,
 }
 
+#[derive(Clone, Copy, Debug, Eq, Error, PartialEq)]
+pub enum AnnimClientConfigurationError {
+    #[error("Annim bearer token cannot be empty")]
+    EmptyBearerToken,
+    #[error("Annim bearer token contains characters that are not allowed by RFC 6750")]
+    InvalidBearerToken,
+    #[error("failed to build the Annim HTTP client")]
+    HttpClient,
+}
+
 enum TagLocation {
     Album,
     Disc,
@@ -19,28 +31,37 @@ enum TagLocation {
 
 impl AnnimClient {
     pub fn new(endpoint: String, auth: Option<&str>) -> Self {
-        let mut client = reqwest::Client::builder();
-        if let Some(auth) = auth {
-            let mut headers = reqwest::header::HeaderMap::new();
-            headers.insert(
-                reqwest::header::AUTHORIZATION,
-                reqwest::header::HeaderValue::from_str(auth).unwrap(),
-            );
-            client = client.default_headers(headers);
-        }
-
         Self {
-            client: client.build().unwrap(),
+            client: build_http_client(auth),
             endpoint,
         }
     }
 
+    /// Creates a client and reports invalid authentication configuration immediately.
+    pub fn try_new(
+        endpoint: String,
+        auth: Option<&str>,
+    ) -> Result<Self, AnnimClientConfigurationError> {
+        Ok(Self {
+            client: Ok(build_http_client(auth)?),
+            endpoint,
+        })
+    }
+
+    fn post(&self) -> anyhow::Result<reqwest::RequestBuilder> {
+        let client = self
+            .client
+            .as_ref()
+            .map_err(|error| anyhow::Error::new(*error))?;
+        Ok(client.post(&self.endpoint))
+    }
+
     pub async fn album(
         &self,
         album_id: uuid::Uuid,
     ) -> anyhow::Result<Option<query::album::AlbumFragment>> {
         let query = query::album::AlbumQuery::build(query::album::AlbumVariables { album_id });
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -57,7 +78,7 @@ impl AnnimClient {
             first: Some(album_ids.len() as i32),
             album_ids: Some(album_ids),
         });
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -116,7 +137,7 @@ impl AnnimClient {
                 album: input,
                 commit: Some(commit),
             });
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -133,12 +154,7 @@ impl AnnimClient {
             name: &name,
             type_: tag_type,
         });
-        let response = self
-            .client
-            .post(&self.endpoint)
-            .run_graphql(query)
-            .await
-            .unwrap();
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -155,7 +171,7 @@ impl AnnimClient {
             name: &name,
             type_: tag_type,
         });
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -203,7 +219,7 @@ impl AnnimClient {
                 tags,
             },
         );
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -223,7 +239,7 @@ impl AnnimClient {
                 remove: false,
             },
         );
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -239,7 +255,7 @@ impl AnnimClient {
                 remove: true,
             },
         );
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -255,7 +271,7 @@ impl AnnimClient {
         let query = mutation::set_organize_level::SetMetadataTags::build(
             mutation::set_organize_level::SetMetadataTagsVariables { id: album, level },
         );
-        let response = self.client.post(&self.endpoint).run_graphql(query).await?;
+        let response = self.post()?.run_graphql(query).await?;
         if let Some(errors) = response.errors {
             anyhow::bail!("GraphQL error: {:?}", errors);
         }
@@ -264,12 +280,86 @@ impl AnnimClient {
     }
 }
 
+fn build_http_client(auth: Option<&str>) -> Result<reqwest::Client, AnnimClientConfigurationError> {
+    let mut client = reqwest::Client::builder();
+    if let Some(token) = auth {
+        let mut headers = HeaderMap::new();
+        headers.insert(AUTHORIZATION, bearer_authorization_header(token)?);
+        client = client.default_headers(headers);
+    }
+
+    client
+        .build()
+        .map_err(|_| AnnimClientConfigurationError::HttpClient)
+}
+
+fn bearer_authorization_header(token: &str) -> Result<HeaderValue, AnnimClientConfigurationError> {
+    if token.is_empty() {
+        return Err(AnnimClientConfigurationError::EmptyBearerToken);
+    }
+
+    let mut padding_started = false;
+    for byte in token.bytes() {
+        if byte == b'=' {
+            padding_started = true;
+            continue;
+        }
+
+        let is_token_character =
+            byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'.' | b'_' | b'~' | b'+' | b'/');
+        if padding_started || !is_token_character {
+            return Err(AnnimClientConfigurationError::InvalidBearerToken);
+        }
+    }
+
+    let mut value = HeaderValue::from_bytes(format!("Bearer {token}").as_bytes())
+        .map_err(|_| AnnimClientConfigurationError::InvalidBearerToken)?;
+    value.set_sensitive(true);
+    Ok(value)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use std::str::FromStr;
     use uuid::Uuid;
 
+    #[test]
+    fn authorization_header_uses_bearer_scheme_and_is_sensitive() {
+        let header = bearer_authorization_header("test-token_123").unwrap();
+
+        assert_eq!(header.to_str().unwrap(), "Bearer test-token_123");
+        assert!(header.is_sensitive());
+    }
+
+    #[tokio::test]
+    async fn invalid_bearer_tokens_return_redacted_errors() {
+        assert_eq!(
+            bearer_authorization_header(""),
+            Err(AnnimClientConfigurationError::EmptyBearerToken)
+        );
+
+        let token = "do-not-leak token";
+        let immediate_error =
+            match AnnimClient::try_new("http://127.0.0.1:9/graphql".to_owned(), Some(token)) {
+                Ok(_) => panic!("an invalid bearer token must be rejected"),
+                Err(error) => error,
+            };
+        let rendered_error = format!("{immediate_error:?}: {immediate_error}");
+        assert_eq!(
+            immediate_error,
+            AnnimClientConfigurationError::InvalidBearerToken
+        );
+        assert!(!rendered_error.contains(token));
+
+        let compatible_client =
+            AnnimClient::new("http://127.0.0.1:9/graphql".to_owned(), Some(token));
+        let request_error = compatible_client.album(Uuid::nil()).await.unwrap_err();
+        let rendered_request_error = format!("{request_error:?}: {request_error}");
+        assert!(rendered_request_error.contains("RFC 6750"));
+        assert!(!rendered_request_error.contains(token));
+    }
+
     #[tokio::test]
     #[ignore = "requires a running annim service with the fixture album"]
     async fn test_album() -> anyhow::Result<()> {
diff --git a/anni-split/src/codec/command.rs b/anni-split/src/codec/command.rs
index cbc8bbc8..fa99c50a 100644
--- a/anni-split/src/codec/command.rs
+++ b/anni-split/src/codec/command.rs
@@ -80,21 +80,31 @@ where
     P: AsRef<Path>,
 {
     fn encode(self, mut input: impl Read) -> Result<(), SplitError> {
+        let command = self.command.as_ref().to_string_lossy().into_owned();
         let args = self
             .arguments
             .into_iter()
             .map(|arg| Replacer(arg, self.path.as_ref().as_os_str()));
 
-        let mut process = Command::new(self.command)
+        let mut process = Command::new(&command)
             .args(args)
             .stdin(Stdio::piped())
             .stdout(Stdio::null())
-            .stderr(Stdio::null())
+            .stderr(Stdio::piped())
             .spawn()?;
 
         let mut stdin = process.stdin.take().unwrap();
         std::io::copy(&mut input, &mut stdin)?;
-        process.wait()?;
+        drop(stdin);
+
+        let output = process.wait_with_output()?;
+        if !output.status.success() {
+            return Err(SplitError::CommandFailed {
+                command,
+                status: output.status.code(),
+                stderr: String::from_utf8_lossy(&output.stderr).trim().to_owned(),
+            });
+        }
 
         Ok(())
     }
@@ -150,7 +160,13 @@ where
 
 #[cfg(test)]
 mod tests {
-    use crate::codec::command::{Replacer, FILE_PLACEHOLDER};
+    use crate::{
+        codec::{
+            command::{CommandCodec, Replacer, FILE_PLACEHOLDER},
+            Encoder,
+        },
+        error::SplitError,
+    };
 
     #[test]
     fn test_replacer() {
@@ -164,4 +180,24 @@ mod tests {
         assert_eq!(result.next().unwrap().as_ref(), "d");
         assert!(result.next().is_none());
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn encoder_reports_non_zero_command_status() {
+        let encoder = CommandCodec::new(
+            "sh",
+            ["-c", "cat >/dev/null; echo encoder-failed >&2; exit 7"],
+            "unused",
+        )
+        .unwrap();
+
+        assert!(matches!(
+            encoder.encode(&b"pcm"[..]),
+            Err(SplitError::CommandFailed {
+                status: Some(7),
+                ref stderr,
+                ..
+            }) if stderr == "encoder-failed"
+        ));
+    }
 }
diff --git a/anni-split/src/codec/wav.rs b/anni-split/src/codec/wav.rs
index 76aa102a..184b26d1 100644
--- a/anni-split/src/codec/wav.rs
+++ b/anni-split/src/codec/wav.rs
@@ -79,7 +79,13 @@ impl Encode for WaveHeader {
 
     fn write_to<W: Write>(&self, writer: &mut W) -> Result<(), Self::Err> {
         btoken_w(writer, b"RIFF")?;
-        u32_le_w(writer, self.data_size + 16)?; // chunk size
+        let chunk_size = self.data_size.checked_add(36).ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "WAV data is too large for a RIFF chunk",
+            )
+        })?;
+        u32_le_w(writer, chunk_size)?;
         btoken_w(writer, b"WAVE")?;
         btoken_w(writer, b"fmt ")?;
         u32_le_w(writer, 16)?; // PCM chunk size
@@ -96,6 +102,10 @@ impl Encode for WaveHeader {
 }
 
 impl WaveHeader {
+    pub fn byte_offset_from_cd_frames(&self, frames: u32) -> u64 {
+        u64::from(self.byte_rate) * u64::from(frames) / 75
+    }
+
     pub fn offset_from_second_frames(&self, s: u32, f: u32) -> u32 {
         let br = self.byte_rate;
         br * s + br * f / 75
@@ -121,3 +131,26 @@ impl<P: AsRef<Path>> Encoder for WavEncoder<P> {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn encoded_header_uses_the_standard_riff_chunk_size() {
+        let header = WaveHeader {
+            channels: 2,
+            sample_rate: 44_100,
+            byte_rate: 176_400,
+            block_align: 4,
+            bit_per_sample: 16,
+            data_size: 600,
+        };
+        let mut encoded = Vec::new();
+
+        header.write_to(&mut encoded).unwrap();
+
+        assert_eq!(encoded.len(), 44);
+        assert_eq!(u32::from_le_bytes(encoded[4..8].try_into().unwrap()), 636);
+    }
+}
diff --git a/anni-split/src/cue.rs b/anni-split/src/cue.rs
index 531f6d87..e0bcba0a 100644
--- a/anni-split/src/cue.rs
+++ b/anni-split/src/cue.rs
@@ -1,6 +1,203 @@
 use crate::error::SplitError;
 use crate::{codec::wav::WaveHeader, split::Breakpoint};
 use cuna::Cuna;
+use thiserror::Error;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TrackRange {
+    track_number: u8,
+    cue_index_offset: u32,
+    start: u32,
+    end: u32,
+    title: Option<String>,
+}
+
+impl TrackRange {
+    pub const fn track_number(&self) -> u8 {
+        self.track_number
+    }
+
+    pub const fn cue_index_offset(&self) -> u32 {
+        self.cue_index_offset
+    }
+
+    pub const fn start(&self) -> u32 {
+        self.start
+    }
+
+    pub const fn end(&self) -> u32 {
+        self.end
+    }
+
+    pub const fn byte_length(&self) -> u32 {
+        self.end - self.start
+    }
+
+    pub fn title(&self) -> Option<&str> {
+        self.title.as_deref()
+    }
+}
+
+/// Validated byte ranges for one WAV file described by one CUE `FILE` block.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CueSplitPlan {
+    source_file: String,
+    tracks: Vec<TrackRange>,
+}
+
+impl CueSplitPlan {
+    pub fn new(cue: &str, header: &WaveHeader) -> Result<Self, CueSplitPlanError> {
+        if header.block_align == 0 || header.byte_rate == 0 || header.data_size == 0 {
+            return Err(CueSplitPlanError::InvalidWaveHeader);
+        }
+        if !header
+            .data_size
+            .is_multiple_of(u32::from(header.block_align))
+        {
+            return Err(CueSplitPlanError::MisalignedDataSize {
+                data_size: header.data_size,
+                block_align: header.block_align,
+            });
+        }
+
+        let cue = Cuna::new(cue)?;
+        if cue.files.len() != 1 {
+            return Err(CueSplitPlanError::UnsupportedFileCount {
+                actual: cue.files.len(),
+            });
+        }
+        let file = &cue.files[0];
+        if file.tracks.is_empty() {
+            return Err(CueSplitPlanError::NoTracks);
+        }
+
+        let mut cue_offsets = Vec::with_capacity(file.tracks.len());
+        let mut previous_track = None;
+        let mut previous_offset = None;
+        for track in &file.tracks {
+            if let Some(previous_track) = previous_track
+                && track.id() <= previous_track
+            {
+                return Err(CueSplitPlanError::NonIncreasingTrackNumber {
+                    previous: previous_track,
+                    current: track.id(),
+                });
+            }
+
+            let index = track
+                .get_index(1)
+                .ok_or(CueSplitPlanError::MissingIndexOne { track: track.id() })?;
+            let byte_offset = header.byte_offset_from_cd_frames(index.begin_time().total_frames());
+            if byte_offset > u64::from(header.data_size) {
+                return Err(CueSplitPlanError::OffsetOutOfBounds {
+                    track: track.id(),
+                    offset: byte_offset,
+                    data_size: header.data_size,
+                });
+            }
+            let byte_offset =
+                u32::try_from(byte_offset).expect("offset bounded by the u32 WAV data size");
+            if byte_offset % u32::from(header.block_align) != 0 {
+                return Err(CueSplitPlanError::MisalignedOffset {
+                    track: track.id(),
+                    offset: byte_offset,
+                    block_align: header.block_align,
+                });
+            }
+            if let Some(previous_offset) = previous_offset
+                && byte_offset <= previous_offset
+            {
+                return Err(CueSplitPlanError::NonIncreasingOffset {
+                    previous_track: previous_track.expect("previous offset has a track"),
+                    track: track.id(),
+                    previous_offset,
+                    offset: byte_offset,
+                });
+            }
+
+            cue_offsets.push((track, byte_offset));
+            previous_track = Some(track.id());
+            previous_offset = Some(byte_offset);
+        }
+
+        let mut tracks = Vec::with_capacity(cue_offsets.len());
+        for (index, (track, cue_index_offset)) in cue_offsets.iter().enumerate() {
+            let start = if index == 0 { 0 } else { *cue_index_offset };
+            let end = cue_offsets
+                .get(index + 1)
+                .map(|(_, offset)| *offset)
+                .unwrap_or(header.data_size);
+            if start >= end {
+                return Err(CueSplitPlanError::EmptyTrackRange {
+                    track: track.id(),
+                    start,
+                    end,
+                });
+            }
+            tracks.push(TrackRange {
+                track_number: track.id(),
+                cue_index_offset: *cue_index_offset,
+                start,
+                end,
+                title: track.title().first().cloned(),
+            });
+        }
+
+        Ok(Self {
+            source_file: file.name.clone(),
+            tracks,
+        })
+    }
+
+    pub fn source_file(&self) -> &str {
+        &self.source_file
+    }
+
+    pub fn tracks(&self) -> &[TrackRange] {
+        &self.tracks
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum CueSplitPlanError {
+    #[error(transparent)]
+    Cue(#[from] cuna::error::Error),
+    #[error("WAV header has zero byte rate, block alignment, or data size")]
+    InvalidWaveHeader,
+    #[error("WAV data size {data_size} is not aligned to {block_align} bytes")]
+    MisalignedDataSize { data_size: u32, block_align: u16 },
+    #[error("single-input splitting requires exactly one CUE FILE block, got {actual}")]
+    UnsupportedFileCount { actual: usize },
+    #[error("CUE FILE block contains no tracks")]
+    NoTracks,
+    #[error("track {track:02} has no INDEX 01")]
+    MissingIndexOne { track: u8 },
+    #[error("track number {current:02} does not follow {previous:02}")]
+    NonIncreasingTrackNumber { previous: u8, current: u8 },
+    #[error("track {track:02} offset {offset} is beyond WAV data size {data_size}")]
+    OffsetOutOfBounds {
+        track: u8,
+        offset: u64,
+        data_size: u32,
+    },
+    #[error("track {track:02} offset {offset} is not aligned to {block_align} bytes")]
+    MisalignedOffset {
+        track: u8,
+        offset: u32,
+        block_align: u16,
+    },
+    #[error(
+        "track {track:02} offset {offset} is not after track {previous_track:02} offset {previous_offset}"
+    )]
+    NonIncreasingOffset {
+        previous_track: u8,
+        track: u8,
+        previous_offset: u32,
+        offset: u32,
+    },
+    #[error("track {track:02} has empty byte range {start}..{end}")]
+    EmptyTrackRange { track: u8, start: u32, end: u32 },
+}
 
 /// `Cue` files uses format like `mm:ss.ff` to describe time of tracks.
 /// [CueBreakpoint] reuses this value, and can be used to split wave files, depending on its byte-rate.
@@ -27,6 +224,12 @@ where
 {
     let cue = Cuna::new(cue.as_ref())?;
 
+    if cue.files.len() != 1 {
+        return Err(SplitError::UnsupportedCueFileCount {
+            actual: cue.files.len(),
+        });
+    }
+
     let total_tracks = cue.files.iter().map(|f| f.tracks.len()).sum();
     let mut result = Vec::with_capacity(total_tracks);
 
@@ -47,10 +250,97 @@ where
     if let Some(CueBreakpoint {
         seconds: 0,
         frames: 0,
-    }) = result.get(0)
+    }) = result.first()
     {
         result.remove(0);
     }
 
     Ok((result, cue))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn header(seconds: u32) -> WaveHeader {
+        WaveHeader {
+            channels: 2,
+            sample_rate: 44_100,
+            byte_rate: 176_400,
+            block_align: 4,
+            bit_per_sample: 16,
+            data_size: 176_400 * seconds,
+        }
+    }
+
+    #[test]
+    fn cue_plan_produces_aligned_ranges_and_preserves_titles() {
+        let cue = r#"
+FILE "album.wav" WAVE
+  TRACK 01 AUDIO
+    TITLE "第一曲（原文）"
+    INDEX 01 00:00:00
+  TRACK 02 AUDIO
+    TITLE "Second Track"
+    INDEX 01 01:00:00
+"#;
+
+        let plan = CueSplitPlan::new(cue, &header(120)).unwrap();
+
+        assert_eq!(plan.source_file(), "album.wav");
+        assert_eq!(plan.tracks().len(), 2);
+        assert_eq!(plan.tracks()[0].start(), 0);
+        assert_eq!(plan.tracks()[0].end(), 176_400 * 60);
+        assert_eq!(plan.tracks()[0].title(), Some("第一曲（原文）"));
+        assert_eq!(plan.tracks()[1].start(), 176_400 * 60);
+        assert_eq!(plan.tracks()[1].end(), 176_400 * 120);
+    }
+
+    #[test]
+    fn cue_plan_rejects_multiple_file_timelines() {
+        let cue = r#"
+FILE "disc-a.wav" WAVE
+  TRACK 01 AUDIO
+    INDEX 01 00:00:00
+FILE "disc-b.wav" WAVE
+  TRACK 02 AUDIO
+    INDEX 01 00:00:00
+"#;
+
+        assert!(matches!(
+            CueSplitPlan::new(cue, &header(120)),
+            Err(CueSplitPlanError::UnsupportedFileCount { actual: 2 })
+        ));
+        assert!(matches!(
+            cue_breakpoints(cue),
+            Err(SplitError::UnsupportedCueFileCount { actual: 2 })
+        ));
+    }
+
+    #[test]
+    fn cue_plan_rejects_non_increasing_and_out_of_bounds_offsets() {
+        let non_increasing = r#"
+FILE "album.wav" WAVE
+  TRACK 01 AUDIO
+    INDEX 01 01:00:00
+  TRACK 02 AUDIO
+    INDEX 01 00:30:00
+"#;
+        assert!(matches!(
+            CueSplitPlan::new(non_increasing, &header(120)),
+            Err(CueSplitPlanError::NonIncreasingOffset { .. })
+        ));
+
+        let out_of_bounds = r#"
+FILE "album.wav" WAVE
+  TRACK 01 AUDIO
+    INDEX 01 00:00:00
+  TRACK 02 AUDIO
+    INDEX 01 03:00:00
+"#;
+        assert!(matches!(
+            CueSplitPlan::new(out_of_bounds, &header(120)),
+            Err(CueSplitPlanError::OffsetOutOfBounds { track: 2, .. })
+        ));
+    }
+}
diff --git a/anni-split/src/error.rs b/anni-split/src/error.rs
index e9ecb7b9..675009f5 100644
--- a/anni-split/src/error.rs
+++ b/anni-split/src/error.rs
@@ -9,6 +9,19 @@ pub enum SplitError {
     #[error(transparent)]
     CueError(#[from] cuna::error::Error),
 
+    #[error("single-input splitting requires exactly one CUE FILE block, got {actual}")]
+    UnsupportedCueFileCount { actual: usize },
+
+    #[error(
+        "codec command {command:?} failed with status {status:?}{stderr_suffix}",
+        stderr_suffix = if stderr.is_empty() { String::new() } else { format!(": {stderr}") }
+    )]
+    CommandFailed {
+        command: String,
+        status: Option<i32>,
+        stderr: String,
+    },
+
     #[error(transparent)]
     DecodeError(#[from] anni_common::decode::DecodeError),
 
diff --git a/anni-split/src/lib.rs b/anni-split/src/lib.rs
index 509b2fb1..3b1b0fa8 100644
--- a/anni-split/src/lib.rs
+++ b/anni-split/src/lib.rs
@@ -3,5 +3,5 @@ pub mod cue;
 pub mod error;
 pub mod split;
 
-pub use cue::cue_breakpoints;
+pub use cue::{cue_breakpoints, CueSplitPlan, CueSplitPlanError, TrackRange};
 pub use split::split;
diff --git a/annim-web/app.js b/annim-web/app.js
new file mode 100644
index 00000000..3b8abaa2
--- /dev/null
+++ b/annim-web/app.js
@@ -0,0 +1,2758 @@
+const SESSION_KEY = "annim.adminToken";
+const VIEWS = new Set(["workflow", "intake", "artists"]);
+
+const state = {
+  token: sessionStorage.getItem(SESSION_KEY) ?? "",
+  jobs: [],
+  artists: [],
+  selectedArtistId: null,
+  selectedRelease: null,
+  selectedCollection: null,
+  catalogSources: [],
+  catalogSourcesStatus: "idle",
+  catalogSourcesError: "",
+  catalogRunsBySource: {},
+  catalogHistoryStateBySource: {},
+  catalogRefreshTimer: null,
+  catalogPollGeneration: 0,
+  artistLoadGeneration: 0,
+  view: "workflow",
+  reviewMutationPending: false,
+  catalogMutationPending: false,
+};
+
+const elements = {
+  serverLamp: document.querySelector("#server-lamp"),
+  serverLabel: document.querySelector("#server-label"),
+  sessionButton: document.querySelector("#session-button"),
+  sessionState: document.querySelector("#session-state"),
+  sessionDialog: document.querySelector("#session-dialog"),
+  sessionForm: document.querySelector("#session-form"),
+  sessionError: document.querySelector("#session-error"),
+  adminToken: document.querySelector("#admin-token"),
+  forgetSession: document.querySelector("#forget-session"),
+  intakeCount: document.querySelector("#intake-count"),
+  artistCount: document.querySelector("#artist-count"),
+  queueSummary: document.querySelector("#queue-summary"),
+  intakeList: document.querySelector("#intake-list"),
+  ingestDetail: document.querySelector("#ingest-detail"),
+  ingestDetailContent: document.querySelector("#ingest-detail-content"),
+  artistSearchForm: document.querySelector("#artist-search-form"),
+  artistSearch: document.querySelector("#artist-search"),
+  artistList: document.querySelector("#artist-list"),
+  collectionSheet: document.querySelector("#collection-sheet"),
+  createArtistButton: document.querySelector("#create-artist-button"),
+  artistDialog: document.querySelector("#artist-dialog"),
+  artistCreateForm: document.querySelector("#artist-create-form"),
+  artistFormError: document.querySelector("#artist-form-error"),
+  releaseDialog: document.querySelector("#release-dialog"),
+  releaseCreateForm: document.querySelector("#release-create-form"),
+  releaseFormError: document.querySelector("#release-form-error"),
+  releaseDialogArtist: document.querySelector("#release-dialog-artist"),
+  releaseManageDialog: document.querySelector("#release-manage-dialog"),
+  releaseManageTitle: document.querySelector("#release-manage-title"),
+  releaseManageState: document.querySelector("#release-manage-state"),
+  collectionCopyForm: document.querySelector("#collection-copy-form"),
+  collectionCopyFormError: document.querySelector("#collection-copy-form-error"),
+  catalogSourceDialog: document.querySelector("#catalog-source-dialog"),
+  catalogSourceForm: document.querySelector("#catalog-source-form"),
+  catalogSourceArtist: document.querySelector("#catalog-source-artist"),
+  catalogSourceFormError: document.querySelector("#catalog-source-form-error"),
+  toastRegion: document.querySelector("#toast-region"),
+};
+
+const METADATA_FIELD_OPTIONS = {
+  ALBUM: ["TITLE", "EDITION", "ARTIST", "ARTISTS", "RELEASE_DATE", "TRACK_TYPE", "CATALOG", "TAGS"],
+  DISC: ["TITLE", "CATALOG", "ARTIST", "ARTISTS", "TRACK_TYPE", "TAGS"],
+  TRACK: ["TITLE", "ARTIST", "ARTISTS", "TRACK_TYPE", "TAGS"],
+};
+
+const TRACK_TYPE_OPTIONS = [
+  ["NORMAL", "Normal · 普通歌曲 / 网播"],
+  ["INSTRUMENTAL", "Instrumental · 伴奏"],
+  ["ABSOLUTE", "Absolute · 纯音乐"],
+  ["DRAMA", "Drama · 广播剧"],
+  ["RADIO", "Radio · 广播节目"],
+  ["VOCAL", "Vocal · 人声"],
+];
+
+const CATALOG_SOURCE_KIND_LABELS = {
+  APPLE_MUSIC: "Apple Music",
+  RECORD_LABEL: "唱片公司官网",
+  ARTIST_WEBSITE: "艺人官网",
+  VGMDB: "VGMDB",
+  MANUAL: "人工目录",
+};
+
+const CATALOG_PROVISIONING_LABELS = {
+  READY_TO_QUEUE: "可执行",
+  DISABLED: "已停用",
+  CREDENTIAL_NOT_CONFIGURED: "服务端凭据未配置",
+  CREDENTIAL_BINDING_INVALID: "凭据引用无效",
+  ADAPTER_UNAVAILABLE: "Worker adapter 未安装",
+};
+
+const CATALOG_RUN_STATUS_LABELS = {
+  QUEUED: "排队中",
+  RUNNING: "同步中",
+  SUCCEEDED: "已完成",
+  FAILED: "失败",
+  CANCELLED: "已取消",
+};
+
+const ACTIVE_CATALOG_RUN_STATES = new Set(["QUEUED", "RUNNING"]);
+
+const EVIDENCE_SOURCE_OPTIONS = [
+  ["CD_BOOKLET", "CD Booklet"],
+  ["CD_PACKAGING", "CD 盘面 / 包装"],
+  ["OFFICIAL_LABEL", "唱片公司官网"],
+  ["OFFICIAL_ARTIST", "艺人官网"],
+  ["OFFICIAL_STORE", "官方商店"],
+  ["STREAMING_SERVICE", "流媒体服务"],
+  ["VGMDB", "VGMDB"],
+  ["COMMUNITY_SOURCE", "社区来源"],
+  ["FILENAME", "文件名"],
+  ["DERIVED_INFERENCE", "推断"],
+];
+
+const EVIDENCE_METHOD_OPTIONS = {
+  CD_BOOKLET: [["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  CD_PACKAGING: [["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  OFFICIAL_LABEL: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  OFFICIAL_ARTIST: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  OFFICIAL_STORE: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  STREAMING_SERVICE: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  VGMDB: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  COMMUNITY_SOURCE: [["WEB_IMPORT", "网页导入"], ["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"]],
+  FILENAME: [["MANUAL_TRANSCRIPTION", "人工转录"], ["AUTOMATED_EXTRACTION", "自动提取"], ["INFERENCE", "推断"]],
+  DERIVED_INFERENCE: [["INFERENCE", "推断"]],
+};
+
+const ABSENT_METADATA_FIELDS = new Set([
+  "ALBUM:EDITION",
+  "DISC:TITLE",
+  "DISC:ARTIST",
+  "DISC:ARTISTS",
+  "DISC:TRACK_TYPE",
+  "TRACK:ARTIST",
+  "TRACK:ARTISTS",
+  "TRACK:TRACK_TYPE",
+]);
+
+const INTAKE_QUERY = `
+  query WebIntakeJobs($limit: Int!, $offset: Int!) {
+    ingestJobs(limit: $limit, offset: $offset) {
+      jobId
+      state
+      metadataRevision
+      approvedRevision
+      manifestDigest
+      planDigest
+      verificationDigest
+      rowVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+const INGEST_REVIEW_QUERY = `
+  query WebIngestReview($jobId: UUID!) {
+    ingestJob(jobId: $jobId) {
+      jobId
+      state
+      metadataRevision
+      approvedRevision
+      manifestDigest
+      planDigest
+      verificationDigest
+      rowVersion
+      createdAt
+      updatedAt
+    }
+    ingestMetadataDraft(jobId: $jobId) {
+      job {
+        jobId
+        state
+        metadataRevision
+        approvedRevision
+        rowVersion
+        updatedAt
+      }
+      draft {
+        revision
+        profile
+        trackCounts
+        requirementsConfigured
+        totalRequired
+        acceptedRequired
+        complete
+        missingFields {
+          scope
+          disc
+          track
+          field
+        }
+        candidates {
+          candidateId
+          field {
+            scope
+            disc
+            track
+            field
+          }
+          value {
+            kind
+            text
+            date
+            trackType
+            textList
+            textMap {
+              key
+              value
+            }
+          }
+          evidence {
+            sourceKind
+            locator
+            detail
+            method
+          }
+          confidenceBasisPoints
+          decision
+          recommended
+        }
+        createdAt
+        updatedAt
+      }
+    }
+  }
+`;
+
+const ARTISTS_QUERY = `
+  query WebCatalogArtists($search: String, $limit: Int!, $offset: Int!) {
+    catalogArtists(search: $search, limit: $limit, offset: $offset) {
+      artistId
+      displayName
+      sortName
+      notes
+      rowVersion
+      updatedAt
+    }
+  }
+`;
+
+const COLLECTION_QUERY = `
+  query WebArtistCollection($artistId: UUID!, $limit: Int!, $offset: Int!) {
+    catalogArtistCollection(artistId: $artistId, limit: $limit, offset: $offset) {
+      artist {
+        artistId
+        displayName
+        sortName
+        notes
+        rowVersion
+      }
+      summary {
+        total
+        missing
+        wanted
+        acquired
+        ingesting
+        published
+        unavailable
+        collected
+      }
+      releaseTotalCount
+      releases {
+        releaseId
+        title
+        edition
+        catalog
+        releaseDate
+        kind
+        collectionState
+        wanted
+        unavailable
+        matchedAlbumId
+        activeIngestJobId
+        notes
+        rowVersion
+        copies {
+          copyId
+          sourceKind
+          sourceLabel
+          codec
+          qualityTier
+          sampleRateHz
+          bitDepth
+          channels
+          trackCount
+          byteLength
+          qualityVerified
+          notes
+          acquiredAt
+        }
+      }
+    }
+  }
+`;
+
+const CATALOG_SYNC_SOURCES_QUERY = `
+  query WebCatalogSyncSources($artistId: UUID!) {
+    catalogSyncSources(artistId: $artistId) {
+      sourceId
+      artistId
+      kind
+      storefront
+      locale
+      enabled
+      provisioningState
+      rowVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+const CATALOG_SYNC_SOURCE_QUERY = `
+  query WebCatalogSyncSource($sourceId: UUID!) {
+    catalogSyncSource(sourceId: $sourceId) {
+      sourceId
+      artistId
+      kind
+      storefront
+      locale
+      enabled
+      provisioningState
+      rowVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+const CATALOG_SYNC_RUNS_QUERY = `
+  query WebCatalogSyncRuns($sourceId: UUID!, $limit: Int!, $offset: Int!) {
+    catalogSyncRuns(sourceId: $sourceId, limit: $limit, offset: $offset) {
+      runId
+      sourceId
+      status
+      coverage
+      startedFromRoot
+      snapshotComplete
+      observedCount
+      attemptCount
+      nextAttemptAt
+      rowVersion
+      createdAt
+      startedAt
+      finishedAt
+    }
+  }
+`;
+
+const CATALOG_SYNC_RUN_QUERY = `
+  query WebCatalogSyncRun($runId: UUID!) {
+    catalogSyncRun(runId: $runId) {
+      runId
+      sourceId
+      status
+      coverage
+      startedFromRoot
+      snapshotComplete
+      observedCount
+      attemptCount
+      nextAttemptAt
+      rowVersion
+      createdAt
+      startedAt
+      finishedAt
+    }
+  }
+`;
+
+const CREATE_CATALOG_ARTIST_MUTATION = `
+  mutation WebCreateCatalogArtist($input: CreateCatalogArtistInput!) {
+    createCatalogArtist(input: $input) {
+      artistId
+      displayName
+      sortName
+      notes
+      rowVersion
+      updatedAt
+    }
+  }
+`;
+
+const CREATE_CATALOG_RELEASE_MUTATION = `
+  mutation WebCreateCatalogRelease($input: CreateCatalogReleaseInput!) {
+    createCatalogRelease(input: $input) {
+      releaseId
+      artistId
+      title
+      edition
+      catalog
+      releaseDate
+      kind
+      collectionState
+      rowVersion
+      updatedAt
+    }
+  }
+`;
+
+const CREATE_CATALOG_SYNC_SOURCE_MUTATION = `
+  mutation WebCreateCatalogSyncSource($input: CreateCatalogSyncSourceInput!) {
+    createCatalogSyncSource(input: $input) {
+      sourceId
+      artistId
+      kind
+      storefront
+      locale
+      enabled
+      provisioningState
+      rowVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+const START_CATALOG_SYNC_RUN_MUTATION = `
+  mutation WebStartCatalogSyncRun($input: StartCatalogSyncRunInput!) {
+    startCatalogSyncRun(input: $input) {
+      runId
+      sourceId
+      status
+      coverage
+      startedFromRoot
+      snapshotComplete
+      observedCount
+      attemptCount
+      nextAttemptAt
+      rowVersion
+      createdAt
+      startedAt
+      finishedAt
+    }
+  }
+`;
+
+const SET_CATALOG_SYNC_SOURCE_ENABLED_MUTATION = `
+  mutation WebSetCatalogSyncSourceEnabled($input: SetCatalogSyncSourceEnabledInput!) {
+    setCatalogSyncSourceEnabled(input: $input) {
+      sourceId
+      artistId
+      kind
+      storefront
+      locale
+      enabled
+      provisioningState
+      rowVersion
+      createdAt
+      updatedAt
+    }
+  }
+`;
+
+const EXECUTE_CATALOG_RELEASE_COMMAND_MUTATION = `
+  mutation WebExecuteCatalogReleaseCommand($input: ExecuteCatalogReleaseCommandInput!) {
+    executeCatalogReleaseCommand(input: $input) {
+      releaseId
+      artistId
+      title
+      collectionState
+      rowVersion
+      copies {
+        copyId
+        sourceKind
+        sourceLabel
+        codec
+        qualityTier
+        sampleRateHz
+        bitDepth
+        channels
+        trackCount
+        byteLength
+        manifestDigest
+        qualityVerified
+        ingestJobId
+        notes
+        acquiredAt
+      }
+    }
+  }
+`;
+
+const EDIT_METADATA_MUTATION = `
+  mutation WebEditIngestMetadata($input: EditIngestMetadataInput!) {
+    editIngestMetadata(input: $input) {
+      job {
+        jobId
+        rowVersion
+      }
+      draft {
+        revision
+      }
+    }
+  }
+`;
+
+const EXECUTE_INGEST_COMMAND_MUTATION = `
+  mutation WebExecuteIngestCommand($input: ExecuteIngestJobCommandInput!) {
+    executeIngestJobCommand(input: $input) {
+      jobId
+      state
+      metadataRevision
+      approvedRevision
+      rowVersion
+    }
+  }
+`;
+
+const APPROVE_METADATA_MUTATION = `
+  mutation WebApproveIngestMetadata($input: IngestMetadataRevisionActionInput!) {
+    approveIngestMetadata(input: $input) {
+      job {
+        jobId
+        rowVersion
+        approvedRevision
+      }
+      draft {
+        revision
+        complete
+      }
+    }
+  }
+`;
+
+const REVISE_METADATA_MUTATION = `
+  mutation WebReviseIngestMetadata($input: IngestMetadataRevisionActionInput!) {
+    reviseIngestMetadata(input: $input) {
+      job {
+        jobId
+        rowVersion
+        metadataRevision
+      }
+      draft {
+        revision
+      }
+    }
+  }
+`;
+
+class SessionRequiredError extends Error {}
+
+class GraphqlRequestError extends Error {
+  constructor(message, code = "GRAPHQL_REQUEST_FAILED") {
+    super(message);
+    this.code = code;
+  }
+}
+
+function node(tag, options = {}, children = []) {
+  const element = document.createElement(tag);
+  if (options.className) element.className = options.className;
+  if (options.text !== undefined) element.textContent = String(options.text);
+  for (const [name, value] of Object.entries(options.attributes ?? {})) {
+    if (value !== null && value !== undefined) {
+      element.setAttribute(name, String(value));
+    }
+  }
+  const childList = Array.isArray(children) ? children : [children];
+  for (const child of childList) {
+    if (child !== null && child !== undefined) element.append(child);
+  }
+  return element;
+}
+
+function replaceSelectOptions(select, options, selected = null) {
+  select.replaceChildren(
+    ...options.map(([value, label]) =>
+      node("option", {
+        text: label,
+        attributes: { value },
+      }),
+    ),
+  );
+  if (selected !== null && options.some(([value]) => value === selected)) {
+    select.value = selected;
+  }
+}
+
+function selectControl(name, options, selected = null) {
+  const select = node("select", { attributes: { name } });
+  replaceSelectOptions(select, options, selected);
+  return select;
+}
+
+function labeledControl(label, control, hint = null) {
+  const children = [node("span", { text: label }), control];
+  if (hint) children.push(node("small", { text: hint }));
+  return node("label", { className: "review-form__field" }, children);
+}
+
+function parseTrackCounts(value) {
+  const parts = value.split(/[,，+\s]+/u).filter(Boolean);
+  if (!parts.length) throw new Error("请至少填写一张碟片的轨道数。");
+  return parts.map((part) => {
+    if (!/^\d+$/.test(part)) throw new Error("轨道数只接受正整数，例如 12, 11。");
+    const count = Number(part);
+    if (!Number.isSafeInteger(count) || count < 1 || count > 65535) {
+      throw new Error("每张碟片的轨道数必须在 1–65535 之间。");
+    }
+    return count;
+  });
+}
+
+function metadataValueKind(field) {
+  if (field === "RELEASE_DATE") return "DATE";
+  if (field === "TRACK_TYPE") return "TRACK_TYPE";
+  if (field === "ARTISTS") return "TEXT_MAP";
+  if (field === "TAGS") return "TEXT_LIST";
+  return "TEXT";
+}
+
+function textOrDash(value) {
+  return value === null || value === undefined || value === "" ? "—" : String(value);
+}
+
+function humanizeEnum(value) {
+  if (!value) return "—";
+  return value
+    .toLowerCase()
+    .split("_")
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join(" ");
+}
+
+function formatCodec(value) {
+  return ["FLAC", "WAV", "ALAC", "AAC", "MP3", "OPUS"].includes(value)
+    ? value
+    : humanizeEnum(value);
+}
+
+function compactId(value) {
+  if (!value || value.length < 15) return textOrDash(value);
+  return `${value.slice(0, 8)}…${value.slice(-6)}`;
+}
+
+function formatDateTime(value) {
+  if (!value) return "—";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  return new Intl.DateTimeFormat("zh-CN", {
+    dateStyle: "medium",
+    timeStyle: "short",
+  }).format(date);
+}
+
+function formatField(field) {
+  const location = [
+    field.scope,
+    field.disc ? `D${field.disc}` : null,
+    field.track ? `T${field.track}` : null,
+  ]
+    .filter(Boolean)
+    .join(" · ");
+  return `${location} / ${field.field}`;
+}
+
+function formatCandidateValue(value) {
+  switch (value.kind) {
+    case "TEXT":
+      return textOrDash(value.text);
+    case "DATE":
+      return textOrDash(value.date);
+    case "TRACK_TYPE":
+      return humanizeEnum(value.trackType);
+    case "TEXT_LIST":
+      return value.textList.length ? value.textList.join(" / ") : "（空列表）";
+    case "TEXT_MAP":
+      return value.textMap.length
+        ? value.textMap.map((entry) => `${entry.key}: ${entry.value}`).join(" / ")
+        : "（空映射）";
+    case "ABSENT":
+      return "明确缺省";
+    default:
+      return "不支持的值类型";
+  }
+}
+
+function showToast(message, type = "info") {
+  const toast = node("div", {
+    className: `toast${type === "error" ? " toast--error" : ""}`,
+    text: message,
+  });
+  elements.toastRegion.append(toast);
+  window.setTimeout(() => toast.remove(), 4200);
+}
+
+function renderMessage(target, kind, title, detail) {
+  target.replaceChildren(
+    node("div", { className: `${kind}-state` }, [
+      node("strong", { text: title }),
+      node("p", { text: detail }),
+    ]),
+  );
+}
+
+function updateSessionUi() {
+  const connected = Boolean(state.token);
+  elements.sessionState.textContent = connected ? "当前标签页已连接" : "未连接";
+  elements.sessionButton.classList.toggle("is-connected", connected);
+}
+
+function openSessionDialog(message = "") {
+  elements.sessionError.textContent = message;
+  elements.adminToken.value = "";
+  if (!elements.sessionDialog.open) elements.sessionDialog.showModal();
+  window.setTimeout(() => elements.adminToken.focus(), 0);
+}
+
+function stopCatalogRefresh() {
+  if (state.catalogRefreshTimer !== null) {
+    window.clearTimeout(state.catalogRefreshTimer);
+    state.catalogRefreshTimer = null;
+  }
+  state.catalogPollGeneration += 1;
+}
+
+function clearSession({ notify = true } = {}) {
+  stopCatalogRefresh();
+  sessionStorage.removeItem(SESSION_KEY);
+  state.token = "";
+  state.jobs = [];
+  state.artists = [];
+  state.selectedArtistId = null;
+  state.selectedRelease = null;
+  state.selectedCollection = null;
+  state.catalogSources = [];
+  state.catalogSourcesStatus = "idle";
+  state.catalogSourcesError = "";
+  state.catalogRunsBySource = {};
+  state.catalogHistoryStateBySource = {};
+  state.artistLoadGeneration += 1;
+  updateSessionUi();
+  elements.intakeCount.textContent = "—";
+  elements.artistCount.textContent = "—";
+  renderMessage(elements.intakeList, "empty", "连接 Annim 后读取队列", "令牌只保存在当前浏览器标签页。");
+  renderMessage(elements.artistList, "empty", "尚未读取艺人", "建立管理会话后读取 Artist 列表。");
+  renderMessage(elements.collectionSheet, "empty", "选择一位艺人", "查看发行列表、来源与音质。");
+  if (notify) showToast("当前管理会话已清除");
+}
+
+async function graphql(query, variables = {}, tokenOverride = null) {
+  const token = tokenOverride ?? state.token;
+  if (!token) throw new SessionRequiredError("需要管理会话");
+
+  let response;
+  try {
+    response = await fetch("/", {
+      method: "POST",
+      cache: "no-store",
+      credentials: "same-origin",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ query, variables }),
+    });
+  } catch {
+    throw new GraphqlRequestError("无法连接 Annim，请检查服务状态。", "NETWORK_ERROR");
+  }
+
+  if (response.status === 401) {
+    if (tokenOverride === null) clearSession({ notify: false });
+    throw new SessionRequiredError("管理令牌无效或已更换。");
+  }
+  if (!response.ok) {
+    throw new GraphqlRequestError(`Annim 返回 HTTP ${response.status}。`, "HTTP_ERROR");
+  }
+
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new GraphqlRequestError("Annim 返回了无法解析的响应。", "INVALID_RESPONSE");
+  }
+  if (payload.errors?.length) {
+    const error = payload.errors[0];
+    const code = error.extensions?.code ?? "GRAPHQL_ERROR";
+    throw new GraphqlRequestError(error.message || "GraphQL 请求失败。", code);
+  }
+  return payload.data;
+}
+
+async function checkServer() {
+  try {
+    const response = await fetch("/health/ready", {
+      cache: "no-store",
+      credentials: "same-origin",
+    });
+    if (!response.ok) throw new Error("not ready");
+    elements.serverLamp.className = "state-lamp is-ready";
+    elements.serverLabel.textContent = "Annim 已就绪";
+  } catch {
+    elements.serverLamp.className = "state-lamp is-down";
+    elements.serverLabel.textContent = "Annim 暂不可用";
+  }
+}
+
+function setView(view) {
+  const safeView = VIEWS.has(view) ? view : "workflow";
+  state.view = safeView;
+  if (safeView !== "artists") stopCatalogRefresh();
+  for (const section of document.querySelectorAll("[data-view]")) {
+    section.hidden = section.dataset.view !== safeView;
+  }
+  for (const link of document.querySelectorAll("[data-view-link]")) {
+    const active = link.dataset.viewLink === safeView;
+    link.classList.toggle("is-active", active);
+    if (active) link.setAttribute("aria-current", "page");
+    else link.removeAttribute("aria-current");
+  }
+  document.querySelector("#main-content")?.focus({ preventScroll: true });
+
+  if (safeView === "intake") void ensureIntakeLoaded();
+  if (safeView === "artists") {
+    void ensureArtistsLoaded();
+    if (state.selectedArtistId) void selectArtist(state.selectedArtistId, { background: true });
+  }
+}
+
+function routeFromHash() {
+  const view = window.location.hash.slice(1).split("/")[0];
+  setView(view || "workflow");
+}
+
+function stateLabel(value) {
+  return (
+    {
+      CREATED: "已创建",
+      REVIEWING: "审阅中",
+      PLANNED: "计划已冻结",
+      EXECUTING: "执行中",
+      VERIFYING: "验证中",
+      READY_TO_COMMIT: "等待提交",
+      COMMITTING: "提交中",
+      PUBLISHED: "已发布",
+      QUARANTINED: "已隔离",
+      CANCELLED: "已取消",
+    }[value] ?? humanizeEnum(value)
+  );
+}
+
+function renderQueueSummary(jobs) {
+  const groups = [
+    ["全部", jobs.length],
+    ["待审阅", jobs.filter((job) => ["CREATED", "REVIEWING"].includes(job.state)).length],
+    ["处理中", jobs.filter((job) => ["PLANNED", "EXECUTING", "VERIFYING", "READY_TO_COMMIT", "COMMITTING"].includes(job.state)).length],
+    ["已发布", jobs.filter((job) => job.state === "PUBLISHED").length],
+    ["需处理", jobs.filter((job) => job.state === "QUARANTINED").length],
+  ];
+  elements.queueSummary.replaceChildren(
+    ...groups.map(([label, value]) =>
+      node("div", { className: "summary-cell" }, [
+        node("span", { text: label }),
+        node("strong", { text: value }),
+      ]),
+    ),
+  );
+}
+
+function renderIntake(jobs) {
+  elements.intakeCount.textContent = String(jobs.length);
+  renderQueueSummary(jobs);
+  if (!jobs.length) {
+    renderMessage(elements.intakeList, "empty", "当前没有入库任务", "从 staging 接收新任务后会显示在这里。");
+    return;
+  }
+
+  const rows = jobs.map((job) => {
+    const row = node(
+      "button",
+      {
+        className: "queue-row",
+        attributes: { type: "button", "aria-label": `查看入库任务 ${job.jobId}` },
+      },
+      [
+        node("span", { className: "queue-row__id", text: job.jobId }),
+        node("span", { className: "queue-row__state", text: stateLabel(job.state) }),
+        node("span", { className: "queue-row__time", text: formatDateTime(job.updatedAt) }),
+        node("span", { className: "queue-row__revision", text: `rev ${job.metadataRevision}` }),
+      ],
+    );
+    row.addEventListener("click", () => void openIngestDetail(job.jobId));
+    return row;
+  });
+  elements.intakeList.replaceChildren(...rows);
+}
+
+async function loadIntake() {
+  if (!state.token) {
+    openSessionDialog("查看入库队列需要管理令牌。");
+    throw new SessionRequiredError();
+  }
+  renderMessage(elements.intakeList, "loading", "正在读取入库队列", "读取 Annim 中最新的任务状态。");
+  const data = await graphql(INTAKE_QUERY, { limit: 200, offset: 0 });
+  state.jobs = data.ingestJobs;
+  renderIntake(state.jobs);
+}
+
+async function ensureIntakeLoaded(force = false) {
+  if (!force && state.jobs.length) return;
+  try {
+    await loadIntake();
+  } catch (error) {
+    if (error instanceof SessionRequiredError) return;
+    renderMessage(elements.intakeList, "error", "无法读取入库队列", error.message);
+  }
+}
+
+function reviewIsEditable(job, draft) {
+  return job.state === "REVIEWING" && job.approvedRevision !== draft.revision;
+}
+
+async function runReviewMutation({ query, input, jobId, successMessage }) {
+  if (state.reviewMutationPending) return;
+  state.reviewMutationPending = true;
+  elements.ingestDetailContent.setAttribute("aria-busy", "true");
+  const controls = Array.from(
+    elements.ingestDetailContent.querySelectorAll("button, input, select, textarea"),
+  );
+  const priorDisabledStates = controls.map((control) => control.disabled);
+  for (const control of controls) {
+    control.disabled = true;
+  }
+  try {
+    await graphql(query, { input });
+    showToast(successMessage);
+    await openIngestDetail(jobId);
+    await ensureIntakeLoaded(true);
+  } catch (error) {
+    const conflict = error instanceof GraphqlRequestError && error.code === "INGEST_JOB_CONFLICT";
+    showToast(conflict ? "审阅稿已被其他会话更新，已重新载入。" : error.message, "error");
+    if (error instanceof SessionRequiredError) {
+      openSessionDialog(error.message);
+    } else {
+      await openIngestDetail(jobId);
+    }
+  } finally {
+    state.reviewMutationPending = false;
+    elements.ingestDetailContent.removeAttribute("aria-busy");
+    controls.forEach((control, index) => {
+      if (control.isConnected) control.disabled = priorDisabledStates[index];
+    });
+  }
+}
+
+function candidateNode(candidate, job, draft) {
+  const decision = candidate.recommended
+    ? `${humanizeEnum(candidate.decision)} · 推荐`
+    : humanizeEnum(candidate.decision);
+  const evidence = [
+    humanizeEnum(candidate.evidence.sourceKind),
+    humanizeEnum(candidate.evidence.method),
+    candidate.evidence.locator,
+    candidate.evidence.detail,
+    `${(candidate.confidenceBasisPoints / 100).toFixed(2)}%`,
+  ].filter(Boolean);
+  const article = node("article", { className: "candidate-row" }, [
+    node("div", { className: "candidate-row__head" }, [
+      node("span", { className: "candidate-row__field", text: formatField(candidate.field) }),
+      node("span", { className: "candidate-row__decision", text: decision }),
+    ]),
+    node("div", { className: "candidate-row__value", text: formatCandidateValue(candidate.value) }),
+    node("div", {
+      className: "candidate-row__source",
+      text: evidence.join(" · "),
+    }),
+  ]);
+
+  if (reviewIsEditable(job, draft)) {
+    const accept = node("button", {
+      className: "candidate-action candidate-action--accept",
+      text: candidate.decision === "ACCEPTED" ? "已接受" : "接受",
+      attributes: {
+        type: "button",
+        disabled: candidate.decision === "ACCEPTED" ? "" : null,
+      },
+    });
+    const reject = node("button", {
+      className: "candidate-action candidate-action--reject",
+      text: candidate.decision === "REJECTED" ? "已拒绝" : "拒绝",
+      attributes: {
+        type: "button",
+        disabled: candidate.decision === "REJECTED" ? "" : null,
+      },
+    });
+    accept.addEventListener("click", () =>
+      void runReviewMutation({
+        query: EDIT_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+          edit: { acceptCandidate: { candidateId: candidate.candidateId } },
+        },
+        jobId: job.jobId,
+        successMessage: "候选值已接受",
+      }),
+    );
+    reject.addEventListener("click", () =>
+      void runReviewMutation({
+        query: EDIT_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+          edit: { rejectCandidate: { candidateId: candidate.candidateId } },
+        },
+        jobId: job.jobId,
+        successMessage: "候选值已拒绝",
+      }),
+    );
+    article.append(node("div", { className: "candidate-row__actions" }, [accept, reject]));
+  }
+  return article;
+}
+
+function reviewConfigurationNode(job, draft) {
+  const profile = selectControl(
+    "profile",
+    [
+      ["CD", "CD · 以 Booklet / 包装为最高权威"],
+      ["STREAMING", "Streaming · 以官方流媒体版本为对象"],
+    ],
+    "CD",
+  );
+  const trackCounts = node("input", {
+    attributes: {
+      name: "trackCounts",
+      type: "text",
+      inputmode: "numeric",
+      placeholder: "例如 12, 11",
+      autocomplete: "off",
+      required: "",
+    },
+  });
+  const error = node("p", { className: "form-error", attributes: { "aria-live": "polite" } });
+  const submit = node("button", {
+    className: "primary-action",
+    text: "建立审阅布局",
+    attributes: { type: "submit" },
+  });
+  const form = node("form", { className: "review-form review-form--configuration" }, [
+    node("div", { className: "review-form__heading" }, [
+      node("strong", { text: "先定义本次发行的物理布局" }),
+      node("p", { text: "布局一旦开始录入候选就不能在当前 revision 内改写；需要变更时创建新 revision。" }),
+    ]),
+    node("div", { className: "review-form__grid" }, [
+      labeledControl("来源 Profile", profile),
+      labeledControl("每张碟片的轨道数", trackCounts, "多碟用逗号或加号分隔"),
+    ]),
+    error,
+    submit,
+  ]);
+  form.addEventListener("submit", (event) => {
+    event.preventDefault();
+    try {
+      error.textContent = "";
+      const counts = parseTrackCounts(trackCounts.value);
+      void runReviewMutation({
+        query: EDIT_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+          edit: { configureReview: { profile: profile.value, trackCounts: counts } },
+        },
+        jobId: job.jobId,
+        successMessage: "元数据审阅布局已建立",
+      });
+    } catch (validationError) {
+      error.textContent = validationError.message;
+    }
+  });
+  return form;
+}
+
+function buildCandidateValue(kind, control, explicitlyAbsent) {
+  if (explicitlyAbsent) return { absent: "USE" };
+  if (kind === "TEXT") {
+    if (control.value.length === 0) throw new Error("元数据原文不能为空。");
+    // Exact source text is the value: do not trim or Unicode-normalize it.
+    return { text: control.value };
+  }
+  if (kind === "DATE") {
+    if (control.value.length === 0) throw new Error("请按 YYYY、YYYY-MM 或 YYYY-MM-DD 填写日期。");
+    return { date: control.value };
+  }
+  if (kind === "TRACK_TYPE") return { trackType: control.value };
+  if (kind === "TEXT_LIST") {
+    const values = control.value.split("\n").filter((value) => value !== "");
+    if (!values.length) throw new Error("请至少填写一项；每行作为一个原样值提交。");
+    return { textList: { values } };
+  }
+  const entries = [];
+  const keys = new Set();
+  for (const line of control.value.split("\n").filter((value) => value !== "")) {
+    const separator = line.indexOf("=");
+    if (separator <= 0) throw new Error("多艺人映射每行使用 key=value，例如 vocal=歌手名。");
+    const key = line.slice(0, separator);
+    if (keys.has(key)) throw new Error(`多艺人映射包含重复 key：${key}`);
+    keys.add(key);
+    entries.push({ key, value: line.slice(separator + 1) });
+  }
+  if (!entries.length) throw new Error("请至少填写一条 key=value 映射。");
+  return { textMap: { entries } };
+}
+
+function candidateEditorNode(job, draft) {
+  const initial = draft.missingFields[0] ?? {
+    scope: "ALBUM",
+    disc: null,
+    track: null,
+    field: "TITLE",
+  };
+  const scope = selectControl(
+    "scope",
+    [
+      ["ALBUM", "Album"],
+      ["DISC", "Disc"],
+      ["TRACK", "Track"],
+    ],
+    initial.scope,
+  );
+  const field = selectControl("field", [], initial.field);
+  const disc = node("input", {
+    attributes: {
+      name: "disc",
+      type: "number",
+      min: "1",
+      value: initial.disc ?? 1,
+      required: "",
+    },
+  });
+  const track = node("input", {
+    attributes: {
+      name: "track",
+      type: "number",
+      min: "1",
+      value: initial.track ?? 1,
+      required: "",
+    },
+  });
+  const discField = labeledControl("Disc", disc);
+  const trackField = labeledControl("Track", track);
+  const valueHost = node("div", { className: "review-form__value" });
+  const explicitlyAbsent = node("input", {
+    attributes: { name: "absent", type: "checkbox" },
+  });
+  const absentField = node("label", { className: "review-form__absent" }, [
+    explicitlyAbsent,
+    node("span", { text: "此字段在原始来源中明确缺省" }),
+  ]);
+  let valueControl;
+  let valueKind;
+
+  function syncPositions() {
+    const needsDisc = scope.value !== "ALBUM";
+    const needsTrack = scope.value === "TRACK";
+    discField.hidden = !needsDisc;
+    disc.disabled = !needsDisc;
+    disc.max = String(draft.trackCounts.length);
+    if (Number(disc.value) > draft.trackCounts.length) disc.value = "1";
+    const discIndex = Math.max(0, Number(disc.value) - 1);
+    const trackMaximum = draft.trackCounts[discIndex] ?? 1;
+    trackField.hidden = !needsTrack;
+    track.disabled = !needsTrack;
+    track.max = String(trackMaximum);
+    if (Number(track.value) > trackMaximum) track.value = "1";
+  }
+
+  function renderValueControl() {
+    valueKind = metadataValueKind(field.value);
+    if (valueKind === "TRACK_TYPE") {
+      valueControl = selectControl("value", TRACK_TYPE_OPTIONS, "NORMAL");
+    } else if (valueKind === "TEXT_LIST" || valueKind === "TEXT_MAP") {
+      valueControl = node("textarea", {
+        attributes: {
+          name: "value",
+          rows: "4",
+          placeholder: valueKind === "TEXT_LIST" ? "每行一个 tag" : "每行 key=value",
+          required: "",
+        },
+      });
+    } else {
+      valueControl = node("input", {
+        attributes: {
+          name: "value",
+          type: "text",
+          placeholder: valueKind === "DATE" ? "YYYY / YYYY-MM / YYYY-MM-DD" : "严格按原文录入",
+          autocomplete: "off",
+          required: "",
+        },
+      });
+    }
+    const kindLabel = {
+      TEXT: "原文值",
+      DATE: "发行日期",
+      TRACK_TYPE: "音乐类型",
+      TEXT_LIST: "标签列表",
+      TEXT_MAP: "多艺人职责映射",
+    }[valueKind];
+    valueHost.replaceChildren(
+      labeledControl(
+        kindLabel,
+        valueControl,
+        valueKind === "TEXT" ? "不会 trim，也不会做 Unicode 归一化" : null,
+      ),
+    );
+    const absentAllowed = ABSENT_METADATA_FIELDS.has(`${scope.value}:${field.value}`);
+    absentField.hidden = !absentAllowed;
+    explicitlyAbsent.disabled = !absentAllowed;
+    if (!absentAllowed) explicitlyAbsent.checked = false;
+    valueControl.disabled = explicitlyAbsent.checked;
+  }
+
+  function syncFields(selected = null) {
+    const options = METADATA_FIELD_OPTIONS[scope.value].map((value) => [value, humanizeEnum(value)]);
+    replaceSelectOptions(field, options, selected);
+    syncPositions();
+    renderValueControl();
+  }
+
+  scope.addEventListener("change", () => syncFields());
+  field.addEventListener("change", renderValueControl);
+  disc.addEventListener("change", syncPositions);
+  explicitlyAbsent.addEventListener("change", () => {
+    valueControl.disabled = explicitlyAbsent.checked;
+  });
+  syncFields(initial.field);
+
+  const defaultSource = draft.profile === "CD" ? "CD_BOOKLET" : "STREAMING_SERVICE";
+  const sourceKind = selectControl("sourceKind", EVIDENCE_SOURCE_OPTIONS, defaultSource);
+  const method = selectControl("method", EVIDENCE_METHOD_OPTIONS[defaultSource]);
+  sourceKind.addEventListener("change", () => {
+    replaceSelectOptions(method, EVIDENCE_METHOD_OPTIONS[sourceKind.value]);
+  });
+  const locator = node("input", {
+    attributes: {
+      name: "locator",
+      type: "text",
+      value: draft.profile === "CD" ? "booklet.pdf#page=" : "",
+      placeholder: "可复核的页码、URL 或文件定位",
+      autocomplete: "off",
+      required: "",
+    },
+  });
+  const detail = node("input", {
+    attributes: {
+      name: "detail",
+      type: "text",
+      placeholder: "可选：位置或转录说明",
+      autocomplete: "off",
+    },
+  });
+  const confidence = node("input", {
+    attributes: {
+      name: "confidence",
+      type: "number",
+      min: "0",
+      max: "10000",
+      value: draft.profile === "CD" ? "10000" : "9000",
+      required: "",
+    },
+  });
+  const error = node("p", { className: "form-error", attributes: { "aria-live": "polite" } });
+  const form = node("form", { className: "review-form review-form--candidate" }, [
+    node("div", { className: "review-form__grid review-form__grid--path" }, [
+      labeledControl("Scope", scope),
+      discField,
+      trackField,
+      labeledControl("字段", field),
+    ]),
+    valueHost,
+    absentField,
+    node("div", { className: "review-form__grid" }, [
+      labeledControl("证据来源", sourceKind),
+      labeledControl("采集方法", method),
+      labeledControl("定位信息", locator),
+      labeledControl("证据详情", detail),
+      labeledControl("置信度（basis points）", confidence, "0–10000"),
+    ]),
+    error,
+    node("button", {
+      className: "primary-action",
+      text: "添加候选证据",
+      attributes: { type: "submit" },
+    }),
+  ]);
+  form.addEventListener("submit", (event) => {
+    event.preventDefault();
+    try {
+      error.textContent = "";
+      if (!locator.value.trim()) throw new Error("证据定位信息不能为空。");
+      const confidenceBasisPoints = Number(confidence.value);
+      if (
+        !Number.isSafeInteger(confidenceBasisPoints) ||
+        confidenceBasisPoints < 0 ||
+        confidenceBasisPoints > 10000
+      ) {
+        throw new Error("置信度必须是 0–10000 之间的整数。");
+      }
+      const fieldInput = { scope: scope.value, field: field.value };
+      if (scope.value !== "ALBUM") fieldInput.disc = Number(disc.value);
+      if (scope.value === "TRACK") fieldInput.track = Number(track.value);
+      const evidence = {
+        sourceKind: sourceKind.value,
+        locator: locator.value,
+        method: method.value,
+      };
+      if (detail.value !== "") evidence.detail = detail.value;
+      void runReviewMutation({
+        query: EDIT_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+          edit: {
+            addCandidate: {
+              field: fieldInput,
+              value: buildCandidateValue(valueKind, valueControl, explicitlyAbsent.checked),
+              evidence,
+              confidenceBasisPoints,
+            },
+          },
+        },
+        jobId: job.jobId,
+        successMessage: "候选证据已添加",
+      });
+    } catch (validationError) {
+      error.textContent = validationError.message;
+    }
+  });
+
+  const editor = node("details", { className: "candidate-editor" }, [
+    node("summary", { text: "录入 Booklet / 其他来源候选" }),
+    form,
+  ]);
+  editor.open = draft.candidates.length === 0;
+  return editor;
+}
+
+function reviewActions(job, draft) {
+  const actions = node("div", { className: "review-actions" });
+  const currentApproved = job.approvedRevision === draft.revision;
+
+  if (job.state === "CREATED") {
+    const begin = node("button", {
+      className: "primary-action",
+      text: "开始元数据审阅",
+      attributes: { type: "button" },
+    });
+    begin.addEventListener("click", () =>
+      void runReviewMutation({
+        query: EXECUTE_INGEST_COMMAND_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          command: { beginReview: "EXECUTE" },
+        },
+        jobId: job.jobId,
+        successMessage: "任务已进入元数据审阅阶段",
+      }),
+    );
+    actions.append(begin);
+  }
+
+  if (reviewIsEditable(job, draft) && draft.requirementsConfigured) {
+    const approve = node("button", {
+      className: "primary-action",
+      text: draft.complete ? "批准此 revision" : "必填项尚未完成",
+      attributes: { type: "button", disabled: draft.complete ? null : "" },
+    });
+    approve.addEventListener("click", () =>
+      void runReviewMutation({
+        query: APPROVE_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+        },
+        jobId: job.jobId,
+        successMessage: `Metadata revision ${draft.revision} 已批准`,
+      }),
+    );
+    actions.append(approve);
+  }
+
+  if (reviewIsEditable(job, draft) && !draft.requirementsConfigured) {
+    actions.append(node("p", { text: "先建立 CD / Streaming profile 与多碟轨道布局。" }));
+  }
+
+  if (
+    currentApproved &&
+    ["REVIEWING", "PLANNED", "READY_TO_COMMIT", "QUARANTINED"].includes(job.state)
+  ) {
+    const revise = node("button", {
+      className: "secondary-action",
+      text: "创建新 revision",
+      attributes: { type: "button" },
+    });
+    revise.addEventListener("click", () =>
+      void runReviewMutation({
+        query: REVISE_METADATA_MUTATION,
+        input: {
+          jobId: job.jobId,
+          expectedRowVersion: job.rowVersion,
+          expectedRevision: draft.revision,
+        },
+        jobId: job.jobId,
+        successMessage: "已创建新的元数据 revision",
+      }),
+    );
+    actions.append(revise);
+  }
+
+  if (!actions.childElementCount) {
+    actions.append(
+      node("p", {
+        text: currentApproved
+          ? "当前 revision 已冻结；任务进入安全检查点后才能修订。"
+          : "当前任务状态不允许编辑元数据。",
+      }),
+    );
+  }
+  return actions;
+}
+
+function missingFieldsNode(draft) {
+  return node("details", { className: "missing-fields" }, [
+    node("summary", { text: `缺失字段 ${draft.missingFields.length}` }),
+    node(
+      "ul",
+      {},
+      draft.missingFields.map((field) => node("li", { text: formatField(field) })),
+    ),
+  ]);
+}
+
+function renderIngestDetail(data) {
+  const job = data.ingestJob;
+  if (!job) {
+    renderMessage(elements.ingestDetailContent, "error", "任务不存在", "它可能已被其他管理会话删除或迁移。");
+    return;
+  }
+  const draft = data.ingestMetadataDraft?.draft;
+  const metadata = [
+    ["状态", stateLabel(job.state)],
+    ["Row version", job.rowVersion],
+    ["Metadata revision", job.metadataRevision],
+    ["Approved revision", textOrDash(job.approvedRevision)],
+    ["Manifest", compactId(job.manifestDigest)],
+    ["Plan", compactId(job.planDigest)],
+    ["Verification", compactId(job.verificationDigest)],
+    ["更新时间", formatDateTime(job.updatedAt)],
+  ];
+
+  const content = node("div", { className: "drawer-content" }, [
+    node("span", { className: "eyebrow", text: "Ingest review" }),
+    node("h2", { text: compactId(job.jobId) }),
+    node(
+      "div",
+      { className: "drawer-metadata" },
+      metadata.map(([label, value]) =>
+        node("div", {}, [node("span", { text: label }), node("strong", { text: value })]),
+      ),
+    ),
+  ]);
+
+  if (!draft) {
+    content.append(
+      node("div", { className: "empty-state" }, [
+        node("strong", { text: "尚未建立元数据审阅稿" }),
+        node("p", { text: "任务进入 Reviewing 并配置布局后，候选证据会显示在这里。" }),
+      ]),
+    );
+  } else {
+    const accepted = draft.acceptedRequired ?? "0";
+    const total = draft.totalRequired ?? "—";
+    content.append(
+      node("div", { className: "collection-heading" }, [
+        node("div", {}, [
+          node("h2", { text: `Metadata revision ${draft.revision}` }),
+          node("p", {
+            text: draft.requirementsConfigured
+              ? `${humanizeEnum(draft.profile)} · ${draft.trackCounts.join(" + ")} tracks · 必填完成 ${accepted} / ${total} · ${draft.complete ? "可以批准" : "仍有缺失"}`
+              : "尚未配置 CD / 流媒体审阅 profile 与轨道布局",
+          }),
+        ]),
+      ]),
+      reviewActions(job, draft),
+      ...(reviewIsEditable(job, draft) && !draft.requirementsConfigured
+        ? [reviewConfigurationNode(job, draft)]
+        : []),
+      ...(reviewIsEditable(job, draft) && draft.requirementsConfigured
+        ? [candidateEditorNode(job, draft)]
+        : []),
+      ...(draft.missingFields.length ? [missingFieldsNode(draft)] : []),
+      node(
+        "div",
+        { className: "candidate-list" },
+        draft.candidates.length
+          ? draft.candidates.map((candidate) => candidateNode(candidate, job, draft))
+          : [
+              node("div", { className: "empty-state" }, [
+                node("strong", { text: "没有候选证据" }),
+                node("p", { text: "先录入 Booklet，再让网络 Agent 补充缺失字段。" }),
+              ]),
+            ],
+      ),
+    );
+  }
+  elements.ingestDetailContent.replaceChildren(content);
+}
+
+async function openIngestDetail(jobId) {
+  elements.ingestDetail.hidden = false;
+  renderMessage(elements.ingestDetailContent, "loading", "正在读取审阅稿", "加载候选值与证据来源。");
+  try {
+    const data = await graphql(INGEST_REVIEW_QUERY, { jobId });
+    renderIngestDetail(data);
+  } catch (error) {
+    if (error instanceof SessionRequiredError) openSessionDialog(error.message);
+    renderMessage(elements.ingestDetailContent, "error", "无法读取审阅稿", error.message);
+  }
+}
+
+function renderArtists(artists) {
+  elements.artistCount.textContent = String(artists.length);
+  if (!artists.length) {
+    renderMessage(elements.artistList, "empty", "没有匹配的艺人", "调整搜索词，或先在 Annim 中建立 Artist。");
+    return;
+  }
+  const buttons = artists.map((artist, index) => {
+    const button = node(
+      "button",
+      {
+        className: `artist-button${artist.artistId === state.selectedArtistId ? " is-active" : ""}`,
+        attributes: { type: "button" },
+      },
+      [
+        node("strong", { text: artist.displayName }),
+        node("span", { text: String(index + 1).padStart(2, "0") }),
+      ],
+    );
+    button.addEventListener("click", () => void selectArtist(artist.artistId));
+    return button;
+  });
+  elements.artistList.replaceChildren(...buttons);
+}
+
+async function loadArtists(search = null) {
+  if (!state.token) {
+    openSessionDialog("查看艺人拉表需要管理令牌。");
+    throw new SessionRequiredError();
+  }
+  renderMessage(elements.artistList, "loading", "正在读取艺人", "读取 Artist 索引。");
+  const data = await graphql(ARTISTS_QUERY, {
+    search: search || null,
+    limit: 200,
+    offset: 0,
+  });
+  state.artists = data.catalogArtists;
+  renderArtists(state.artists);
+}
+
+async function ensureArtistsLoaded(force = false) {
+  if (!force && state.artists.length) return;
+  try {
+    await loadArtists();
+  } catch (error) {
+    if (error instanceof SessionRequiredError) return;
+    renderMessage(elements.artistList, "error", "无法读取艺人", error.message);
+  }
+}
+
+function optionalExactFormValue(form, name) {
+  const value = form.elements.namedItem(name).value;
+  return value === "" ? null : value;
+}
+
+async function runCatalogOperation(container, errorTarget, operation) {
+  if (state.catalogMutationPending) {
+    errorTarget.dataset.errorCode = "CATALOG_MUTATION_BUSY";
+    errorTarget.textContent = "另一项目录写操作仍在进行，请等待其完成。";
+    return null;
+  }
+  state.catalogMutationPending = true;
+  delete errorTarget.dataset.errorCode;
+  errorTarget.textContent = "正在保存…";
+  const controls = Array.from(container.querySelectorAll("button, input, select, textarea"));
+  const priorDisabledStates = controls.map((control) => control.disabled);
+  controls.forEach((control) => {
+    control.disabled = true;
+  });
+  try {
+    const data = await operation();
+    errorTarget.textContent = "";
+    return data;
+  } catch (error) {
+    errorTarget.textContent = error.message;
+    errorTarget.dataset.errorCode = error.code ?? "UNKNOWN_ERROR";
+    if (error instanceof SessionRequiredError) {
+      container.closest("dialog")?.close();
+      openSessionDialog(error.message);
+    }
+    return null;
+  } finally {
+    state.catalogMutationPending = false;
+    controls.forEach((control, index) => {
+      if (control.isConnected) control.disabled = priorDisabledStates[index];
+    });
+  }
+}
+
+async function runCatalogMutation(form, errorTarget, query, input) {
+  return runCatalogOperation(form, errorTarget, () => graphql(query, { input }));
+}
+
+function openArtistDialog() {
+  if (!state.token) {
+    openSessionDialog("新建 Artist 需要管理会话。");
+    return;
+  }
+  elements.artistCreateForm.reset();
+  elements.artistFormError.textContent = "";
+  elements.artistDialog.showModal();
+  window.setTimeout(() => elements.artistCreateForm.elements.namedItem("displayName").focus(), 0);
+}
+
+function openReleaseDialog(artist) {
+  if (!state.token) {
+    openSessionDialog("登记发行需要管理会话。");
+    return;
+  }
+  elements.releaseCreateForm.reset();
+  elements.releaseFormError.textContent = "";
+  elements.releaseDialogArtist.textContent = `发行会归入 ${artist.displayName} 的拉表。`;
+  elements.releaseDialog.showModal();
+  window.setTimeout(() => elements.releaseCreateForm.elements.namedItem("title").focus(), 0);
+}
+
+function openCatalogSourceDialog(artist) {
+  if (!state.token) {
+    openSessionDialog("绑定官方目录需要管理会话。");
+    return;
+  }
+  elements.catalogSourceForm.reset();
+  elements.catalogSourceFormError.textContent = "";
+  elements.catalogSourceArtist.textContent = `Apple Music 信源会归入 ${artist.displayName}。`;
+  elements.catalogSourceDialog.showModal();
+  window.setTimeout(() => elements.catalogSourceForm.elements.namedItem("locator").focus(), 0);
+}
+
+function openReleaseManager(release) {
+  if (!state.token) {
+    openSessionDialog("管理发行需要管理会话。");
+    return;
+  }
+  state.selectedRelease = release;
+  elements.collectionCopyForm.reset();
+  elements.collectionCopyFormError.textContent = "";
+  elements.releaseManageTitle.textContent = release.title;
+  elements.releaseManageState.className = collectionStateClass(release.collectionState);
+  elements.releaseManageState.textContent = humanizeEnum(release.collectionState);
+  const allowedStates = {
+    markWanted: ["MISSING", "UNAVAILABLE"],
+    markMissing: ["WANTED", "UNAVAILABLE"],
+    markUnavailable: ["MISSING", "WANTED"],
+  };
+  for (const button of elements.collectionCopyForm.querySelectorAll("[data-release-command]")) {
+    button.disabled = !allowedStates[button.dataset.releaseCommand].includes(
+      release.collectionState,
+    );
+  }
+  elements.collectionCopyForm.querySelector("[data-register-copy]").disabled = ![
+    "MISSING",
+    "WANTED",
+    "UNAVAILABLE",
+    "ACQUIRED",
+  ].includes(release.collectionState);
+  elements.releaseManageDialog.showModal();
+}
+
+function optionalPositiveIntegerFormValue(form, name, label, maximum = Number.MAX_SAFE_INTEGER) {
+  const raw = form.elements.namedItem(name).value;
+  if (raw === "") return null;
+  if (!/^\d+$/.test(raw)) throw new Error(`${label}必须是正整数。`);
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new Error(`${label}超出支持范围。`);
+  }
+  return value;
+}
+
+function optionalByteLengthFormValue(form) {
+  const raw = form.elements.namedItem("byteLength").value;
+  if (raw === "") return null;
+  if (!/^\d+$/.test(raw) || BigInt(raw) === 0n) {
+    throw new Error("字节数必须是正整数。");
+  }
+  if (BigInt(raw) > 9_223_372_036_854_775_807n) {
+    throw new Error("字节数超出支持范围。");
+  }
+  return raw;
+}
+
+async function finishReleaseMutation(data, message) {
+  if (!data) return;
+  const release = data.executeCatalogReleaseCommand;
+  state.selectedRelease = release;
+  elements.releaseManageDialog.close();
+  showToast(message(release));
+  if (state.selectedArtistId) await selectArtist(state.selectedArtistId);
+}
+
+function collectionStateClass(value) {
+  const safe = String(value || "unknown").toLowerCase().replaceAll("_", "-");
+  return `collection-state-pill collection-state-pill--${safe}`;
+}
+
+function describeCopies(copies) {
+  if (!copies.length) return "—";
+  return copies
+    .map((copy) => `${copy.sourceLabel} · ${humanizeEnum(copy.sourceKind)}`)
+    .join(" / ");
+}
+
+function describeQuality(copies) {
+  if (!copies.length) return "—";
+  return copies
+    .map((copy) => {
+      const resolution = [
+        copy.sampleRateHz ? `${copy.sampleRateHz} Hz` : null,
+        copy.bitDepth ? `${copy.bitDepth} bit` : null,
+      ]
+        .filter(Boolean)
+        .join(" / ");
+      return [
+        humanizeEnum(copy.qualityTier),
+        formatCodec(copy.codec),
+        resolution,
+        copy.qualityVerified ? "已验证" : "待验证",
+      ]
+        .filter(Boolean)
+        .join(" · ");
+    })
+    .join(" / ");
+}
+
+function catalogProvisioningClass(value) {
+  return `catalog-provisioning-pill catalog-provisioning-pill--${String(value || "unknown")
+    .toLowerCase()
+    .replaceAll("_", "-")}`;
+}
+
+function catalogCoverageLabel(value) {
+  return (
+    {
+      FULL_SNAPSHOT: "完整快照",
+      INCREMENTAL: "增量观察",
+      DISCOVERY_ONLY: "目录发现",
+    }[value] ?? humanizeEnum(value)
+  );
+}
+
+function catalogRunDetail(run, source) {
+  const attempts = String(run.attemptCount ?? "0");
+  const observed = String(run.observedCount ?? "0");
+  if (run.status === "QUEUED") {
+    if (!source.enabled) return "任务已暂停；启用信源后继续排队。";
+    if (run.nextAttemptAt) {
+      const retryAt = new Date(run.nextAttemptAt);
+      if (!Number.isNaN(retryAt.getTime()) && retryAt.getTime() > Date.now()) {
+        return `第 ${attempts} 次尝试未完成；${formatDateTime(run.nextAttemptAt)} 自动重试。`;
+      }
+      return `第 ${attempts} 次尝试未完成；重试时间已到，等待 Worker。`;
+    }
+    return attempts === "0" ? "等待 Worker 接管。" : `等待第 ${attempts} 次重试。`;
+  }
+  if (run.status === "RUNNING") {
+    return `第 ${attempts} 次执行 · 已形成 ${observed} 条 observation。`;
+  }
+  if (run.status === "SUCCEEDED") {
+    return `${catalogCoverageLabel(run.coverage)} · ${run.snapshotComplete ? "快照完整" : "快照未完整"} · ${observed} 条 observation。`;
+  }
+  if (run.status === "FAILED") {
+    return "任务已结束；错误详情只保留在受控 Worker 日志中。";
+  }
+  if (run.status === "CANCELLED") return "任务已取消，历史记录仍然保留。";
+  return `${catalogCoverageLabel(run.coverage)} · ${observed} 条 observation。`;
+}
+
+function catalogRunRow(run, source) {
+  const time = run.finishedAt ?? run.startedAt ?? run.nextAttemptAt ?? run.createdAt;
+  return node(
+    "article",
+    {
+      className: `catalog-run-row catalog-run-row--${run.status.toLowerCase()}`,
+      attributes: { "data-catalog-run-id": run.runId },
+    },
+    [
+      node("div", { className: "catalog-run-row__header" }, [
+        node("strong", { text: CATALOG_RUN_STATUS_LABELS[run.status] ?? humanizeEnum(run.status) }),
+        node("time", { text: formatDateTime(time), attributes: time ? { datetime: time } : {} }),
+      ]),
+      node("p", { className: "catalog-run-detail", text: catalogRunDetail(run, source) }),
+      node("span", {
+        className: "catalog-run-id",
+        text: `Run ${compactId(run.runId)}`,
+        attributes: { title: run.runId },
+      }),
+    ],
+  );
+}
+
+function catalogHistoryForSource(source) {
+  const historyState = state.catalogHistoryStateBySource[source.sourceId] ?? {
+    status: "loading",
+    error: "",
+  };
+  const runs = state.catalogRunsBySource[source.sourceId] ?? [];
+  const children = [node("h4", { text: "最近运行" })];
+  if (historyState.status === "loading") {
+    children.push(node("p", { className: "catalog-run-detail", text: "正在读取运行历史…" }));
+  } else if (historyState.status === "error") {
+    children.push(
+      node("p", {
+        className: "catalog-source-error",
+        text: historyState.error || "无法读取运行历史；为避免重复任务，同步按钮已锁定。",
+      }),
+    );
+  } else if (!runs.length) {
+    children.push(node("p", { className: "catalog-run-detail", text: "尚未执行同步。" }));
+  } else {
+    children.push(...runs.slice(0, 5).map((run) => catalogRunRow(run, source)));
+  }
+  return node("div", { className: "catalog-run-history" }, children);
+}
+
+function catalogSourceCard(source, panelError) {
+  const historyState = state.catalogHistoryStateBySource[source.sourceId] ?? {
+    status: "loading",
+  };
+  const runs = state.catalogRunsBySource[source.sourceId] ?? [];
+  const activeRun = runs.find((run) => ACTIVE_CATALOG_RUN_STATES.has(run.status));
+  const running = runs.some((run) => run.status === "RUNNING");
+  const historyUnknown = historyState.status !== "ready";
+  const startDisabled =
+    historyState.status !== "ready" ||
+    source.provisioningState !== "READY_TO_QUEUE" ||
+    Boolean(activeRun);
+
+  const start = node("button", {
+    className: "primary-action",
+    text: activeRun ? "已有活动任务" : "同步目录",
+    attributes: {
+      type: "button",
+      "data-catalog-action": "start",
+      "data-source-id": source.sourceId,
+    },
+  });
+  start.disabled = startDisabled;
+  start.addEventListener("click", () => void startCatalogSync(source, panelError));
+
+  const toggle = node("button", {
+    className: "secondary-action",
+    text: source.enabled ? "暂停信源" : "启用信源",
+    attributes: {
+      type: "button",
+      "data-catalog-action": "toggle",
+      "data-source-id": source.sourceId,
+      "aria-describedby": running || historyUnknown ? `catalog-action-note-${source.sourceId}` : null,
+    },
+  });
+  toggle.disabled = running || historyUnknown;
+  if (running) toggle.title = "运行中的任务不会被启停操作取消；请等待本次任务结束。";
+  toggle.addEventListener("click", () => void toggleCatalogSource(source, panelError));
+
+  const retry = node("button", {
+    className: "secondary-action",
+    text: "重试运行历史",
+    attributes: {
+      type: "button",
+      "data-catalog-action": "retry-history",
+      "data-source-id": source.sourceId,
+    },
+  });
+  retry.addEventListener("click", () => void retryCatalogHistory(source, panelError));
+
+  const actionNote =
+    running || historyUnknown
+      ? node("p", {
+          className: "catalog-action-note",
+          text: running
+            ? "任务正在执行；暂停不是取消，因此本次结束前不能更改信源状态。"
+            : "确认运行历史前，启停和新建任务都会保持锁定。",
+          attributes: { id: `catalog-action-note-${source.sourceId}` },
+        })
+      : null;
+
+  const meta = node("dl", { className: "catalog-source-meta" }, [
+    node("div", {}, [node("dt", { text: "Storefront" }), node("dd", { text: textOrDash(source.storefront) })]),
+    node("div", {}, [node("dt", { text: "Locale" }), node("dd", { text: textOrDash(source.locale) })]),
+    node("div", {}, [
+      node("dt", { text: "Source" }),
+      node("dd", { text: compactId(source.sourceId), attributes: { title: source.sourceId } }),
+    ]),
+    node("div", {}, [
+      node("dt", { text: "更新" }),
+      node("dd", { text: formatDateTime(source.updatedAt) }),
+    ]),
+  ]);
+
+  return node(
+    "article",
+    { className: "catalog-source-card", attributes: { "data-catalog-source-id": source.sourceId } },
+    [
+      node("header", { className: "catalog-source-card__header" }, [
+        node("div", {}, [
+          node("span", { className: "eyebrow", text: "Managed source" }),
+          node("h4", { text: CATALOG_SOURCE_KIND_LABELS[source.kind] ?? humanizeEnum(source.kind) }),
+        ]),
+        node("span", {
+          className: catalogProvisioningClass(source.provisioningState),
+          text: CATALOG_PROVISIONING_LABELS[source.provisioningState] ?? humanizeEnum(source.provisioningState),
+        }),
+      ]),
+      meta,
+      catalogHistoryForSource(source),
+      actionNote,
+      node(
+        "div",
+        { className: "catalog-source-actions" },
+        [historyState.status === "error" ? retry : null, toggle, start],
+      ),
+    ],
+  );
+}
+
+function catalogSourcePanel(artist) {
+  const addSource = node("button", {
+    className: "secondary-action",
+    text: "绑定 Apple Music",
+    attributes: { type: "button", "data-catalog-action": "create-source" },
+  });
+  addSource.addEventListener("click", () => openCatalogSourceDialog(artist));
+
+  const panelError = node("p", {
+    className: "catalog-source-error",
+    attributes: { role: "alert", "data-catalog-panel-error": "" },
+  });
+  const body = node("div");
+  if (state.catalogSourcesStatus === "loading" || state.catalogSourcesStatus === "idle") {
+    body.className = "catalog-run-detail";
+    body.textContent = "正在读取官方目录信源…";
+  } else if (state.catalogSourcesStatus === "error") {
+    body.className = "catalog-source-error";
+    body.textContent = state.catalogSourcesError || "无法读取目录信源。发行拉表仍可继续使用。";
+  } else if (!state.catalogSources.length) {
+    body.className = "catalog-sync-intro";
+    body.append(
+      node("strong", { text: "尚未绑定官方目录" }),
+      node("span", { text: "先绑定 Apple Music Artist ID；其他官方来源会沿用同一条受控同步链路。" }),
+    );
+  } else {
+    body.className = "catalog-sync-grid";
+    body.replaceChildren(
+      ...state.catalogSources.map((source) => catalogSourceCard(source, panelError)),
+    );
+  }
+
+  return node("section", { className: "catalog-sync-panel", attributes: { id: "catalog-sync-panel" } }, [
+    node("div", { className: "catalog-sync-heading" }, [
+      node("div", {}, [
+        node("span", { className: "eyebrow", text: "Official discography" }),
+        node("h3", { text: "目录同步" }),
+      ]),
+      addSource,
+    ]),
+    node("p", {
+      className: "catalog-sync-intro",
+      text: "同步只生成待核对的 observation，不会覆盖 Booklet 结论，也不会把发行自动标记为已收集。",
+    }),
+    body,
+    panelError,
+  ]);
+}
+
+function updateCatalogSourcePanel() {
+  const current = document.querySelector("#catalog-sync-panel");
+  const artist = state.selectedCollection?.artist;
+  if (!current || !artist) return;
+  current.replaceWith(catalogSourcePanel(artist));
+}
+
+function upsertCatalogSource(source) {
+  const index = state.catalogSources.findIndex((item) => item.sourceId === source.sourceId);
+  if (index === -1) state.catalogSources.push(source);
+  else state.catalogSources[index] = source;
+}
+
+function upsertCatalogRun(run) {
+  const runs = [...(state.catalogRunsBySource[run.sourceId] ?? [])];
+  const index = runs.findIndex((item) => item.runId === run.runId);
+  if (index === -1) runs.unshift(run);
+  else runs[index] = run;
+  runs.sort((left, right) => String(right.createdAt).localeCompare(String(left.createdAt)));
+  state.catalogRunsBySource[run.sourceId] = runs.slice(0, 5);
+}
+
+function catalogSelectionIsCurrent(artistId, token, loadGeneration = null) {
+  return (
+    state.view === "artists" &&
+    state.selectedArtistId === artistId &&
+    state.token === token &&
+    (loadGeneration === null || state.artistLoadGeneration === loadGeneration)
+  );
+}
+
+function catalogRunsToPoll() {
+  const sources = new Map(state.catalogSources.map((source) => [source.sourceId, source]));
+  const active = [];
+  for (const [sourceId, runs] of Object.entries(state.catalogRunsBySource)) {
+    const source = sources.get(sourceId);
+    if (!source) continue;
+    for (const run of runs) {
+      if (run.status === "RUNNING" || (run.status === "QUEUED" && source.enabled)) {
+        active.push(run);
+      }
+    }
+  }
+  return active;
+}
+
+function catalogPollDelay(runs) {
+  if (runs.some((run) => run.status === "RUNNING")) return 3_000;
+  let delay = 5_000;
+  const futureRetries = runs
+    .map((run) => (run.nextAttemptAt ? new Date(run.nextAttemptAt).getTime() - Date.now() : 0))
+    .filter((value) => Number.isFinite(value) && value > 0);
+  if (futureRetries.length) delay = Math.min(...futureRetries);
+  return Math.max(5_000, Math.min(30_000, delay));
+}
+
+function scheduleCatalogRefresh() {
+  stopCatalogRefresh();
+  if (!state.token || state.view !== "artists" || document.hidden || !state.selectedArtistId) return;
+  const runs = catalogRunsToPoll();
+  if (!runs.length) return;
+  const artistId = state.selectedArtistId;
+  const token = state.token;
+  const generation = state.catalogPollGeneration;
+  state.catalogRefreshTimer = window.setTimeout(() => {
+    state.catalogRefreshTimer = null;
+    void pollCatalogRuns(runs, artistId, token, generation);
+  }, catalogPollDelay(runs));
+}
+
+async function pollCatalogRuns(runs, artistId, token, generation) {
+  const results = await Promise.allSettled(
+    runs.map(async (run) => {
+      const [runData, sourceData] = await Promise.all([
+        graphql(CATALOG_SYNC_RUN_QUERY, { runId: run.runId }),
+        graphql(CATALOG_SYNC_SOURCE_QUERY, { sourceId: run.sourceId }),
+      ]);
+      if (!runData.catalogSyncRun) {
+        throw new GraphqlRequestError("同步任务已不存在。", "CATALOG_SYNC_RUN_NOT_FOUND");
+      }
+      if (!sourceData.catalogSyncSource) {
+        throw new GraphqlRequestError("目录信源已不存在。", "CATALOG_SYNC_SOURCE_NOT_FOUND");
+      }
+      return { run: runData.catalogSyncRun, source: sourceData.catalogSyncSource };
+    }),
+  );
+  if (
+    generation !== state.catalogPollGeneration ||
+    !catalogSelectionIsCurrent(artistId, token)
+  ) {
+    return;
+  }
+
+  results.forEach((result, index) => {
+    const sourceId = runs[index].sourceId;
+    if (result.status === "fulfilled") {
+      upsertCatalogRun(result.value.run);
+      upsertCatalogSource(result.value.source);
+      state.catalogHistoryStateBySource[sourceId] = { status: "ready", error: "" };
+      return;
+    }
+    const error = result.reason;
+    state.catalogHistoryStateBySource[sourceId] = {
+      status: "error",
+      error: `运行状态刷新失败：${error.message}`,
+    };
+  });
+  updateCatalogSourcePanel();
+  scheduleCatalogRefresh();
+}
+
+async function startCatalogSync(source, panelError) {
+  const panel = panelError.closest("#catalog-sync-panel");
+  if (!panel || state.selectedArtistId !== source.artistId) return;
+  stopCatalogRefresh();
+  const token = state.token;
+  const loadGeneration = state.artistLoadGeneration;
+  const contextIsCurrent = () =>
+    catalogSelectionIsCurrent(source.artistId, token, loadGeneration);
+  const result = await runCatalogOperation(panel, panelError, async () => {
+    const runData = await graphql(START_CATALOG_SYNC_RUN_MUTATION, {
+      input: { sourceId: source.sourceId },
+    });
+    if (!contextIsCurrent()) return { obsolete: true };
+    const sourceData = await graphql(CATALOG_SYNC_SOURCE_QUERY, { sourceId: source.sourceId });
+    if (!contextIsCurrent()) return { obsolete: true };
+    if (!sourceData.catalogSyncSource) {
+      throw new GraphqlRequestError("同步已排队，但信源无法重新读取。", "CATALOG_SYNC_SOURCE_NOT_FOUND");
+    }
+    return { run: runData.startCatalogSyncRun, source: sourceData.catalogSyncSource };
+  });
+  if (!result) {
+    if (!contextIsCurrent()) return;
+    const message = panelError.textContent;
+    if (panelError.dataset.errorCode === "CATALOG_MUTATION_BUSY") {
+      scheduleCatalogRefresh();
+      return;
+    }
+    showToast(message, "error");
+    await selectArtist(source.artistId, { background: true });
+    return;
+  }
+  if (result.obsolete || !contextIsCurrent()) return;
+  upsertCatalogSource(result.source);
+  upsertCatalogRun(result.run);
+  state.catalogHistoryStateBySource[source.sourceId] = { status: "ready", error: "" };
+  updateCatalogSourcePanel();
+  scheduleCatalogRefresh();
+  showToast("目录同步任务已进入队列");
+}
+
+async function toggleCatalogSource(source, panelError) {
+  const panel = panelError.closest("#catalog-sync-panel");
+  if (!panel || state.selectedArtistId !== source.artistId) return;
+  stopCatalogRefresh();
+  const token = state.token;
+  const loadGeneration = state.artistLoadGeneration;
+  const desiredEnabled = !source.enabled;
+  const contextIsCurrent = () =>
+    catalogSelectionIsCurrent(source.artistId, token, loadGeneration);
+  const result = await runCatalogOperation(panel, panelError, async () => {
+    const [latestData, historyData] = await Promise.all([
+      graphql(CATALOG_SYNC_SOURCE_QUERY, { sourceId: source.sourceId }),
+      graphql(CATALOG_SYNC_RUNS_QUERY, { sourceId: source.sourceId, limit: 5, offset: 0 }),
+    ]);
+    if (!contextIsCurrent()) return { obsolete: true };
+    const latest = latestData.catalogSyncSource;
+    if (!latest) {
+      throw new GraphqlRequestError("信源已不存在。", "CATALOG_SYNC_SOURCE_NOT_FOUND");
+    }
+    const runs = historyData.catalogSyncRuns;
+    if (runs.some((run) => run.status === "RUNNING")) {
+      return { blockedByRunning: true, source: latest, runs };
+    }
+    if (latest.enabled !== source.enabled) {
+      return { staleIntent: true, source: latest, runs };
+    }
+    const mutationData = await graphql(SET_CATALOG_SYNC_SOURCE_ENABLED_MUTATION, {
+      input: {
+        sourceId: latest.sourceId,
+        expectedRowVersion: latest.rowVersion,
+        enabled: desiredEnabled,
+      },
+    });
+    if (!contextIsCurrent()) return { obsolete: true };
+    return { source: mutationData.setCatalogSyncSourceEnabled, runs };
+  });
+  if (!result) {
+    if (!contextIsCurrent()) return;
+    const message = panelError.textContent;
+    const code = panelError.dataset.errorCode;
+    if (code === "CATALOG_MUTATION_BUSY") {
+      scheduleCatalogRefresh();
+      return;
+    }
+    showToast(
+      code === "CATALOG_SYNC_SOURCE_CONFLICT"
+        ? `${message} 已重新读取最新状态。`
+        : `${message} 正在核对服务端状态。`,
+      "error",
+    );
+    await selectArtist(source.artistId, { background: true });
+    return;
+  }
+  if (result.obsolete || !contextIsCurrent()) return;
+  upsertCatalogSource(result.source);
+  state.catalogRunsBySource[source.sourceId] = result.runs;
+  state.catalogHistoryStateBySource[source.sourceId] = { status: "ready", error: "" };
+  updateCatalogSourcePanel();
+  scheduleCatalogRefresh();
+  if (result.staleIntent) {
+    showToast("信源状态已被其他会话更改；本次未执行相反操作，请按最新状态重新确认。", "error");
+  } else if (result.blockedByRunning) {
+    showToast("任务已开始执行；暂停不是取消，请等待本次运行结束。", "error");
+  } else {
+    showToast(result.source.enabled ? "目录信源已启用" : "目录信源已暂停");
+  }
+}
+
+async function retryCatalogHistory(source, panelError) {
+  const panel = panelError.closest("#catalog-sync-panel");
+  if (!panel || state.selectedArtistId !== source.artistId) return;
+  stopCatalogRefresh();
+  const token = state.token;
+  const loadGeneration = state.artistLoadGeneration;
+  const contextIsCurrent = () =>
+    catalogSelectionIsCurrent(source.artistId, token, loadGeneration);
+  const result = await runCatalogOperation(panel, panelError, async () => {
+    const [historyData, sourceData] = await Promise.all([
+      graphql(CATALOG_SYNC_RUNS_QUERY, { sourceId: source.sourceId, limit: 5, offset: 0 }),
+      graphql(CATALOG_SYNC_SOURCE_QUERY, { sourceId: source.sourceId }),
+    ]);
+    if (!contextIsCurrent()) return { obsolete: true };
+    if (!sourceData.catalogSyncSource) {
+      throw new GraphqlRequestError("信源已不存在。", "CATALOG_SYNC_SOURCE_NOT_FOUND");
+    }
+    return { runs: historyData.catalogSyncRuns, source: sourceData.catalogSyncSource };
+  });
+  if (!result) {
+    if (contextIsCurrent()) scheduleCatalogRefresh();
+    return;
+  }
+  if (result.obsolete || !contextIsCurrent()) return;
+  upsertCatalogSource(result.source);
+  state.catalogRunsBySource[source.sourceId] = result.runs;
+  state.catalogHistoryStateBySource[source.sourceId] = { status: "ready", error: "" };
+  updateCatalogSourcePanel();
+  scheduleCatalogRefresh();
+}
+
+function renderCollection(collection) {
+  if (!collection) {
+    renderMessage(elements.collectionSheet, "empty", "尚未建立拉表", "该 Artist 当前没有 collection 记录。");
+    return;
+  }
+  const { artist, summary, releases } = collection;
+  const createRelease = node("button", {
+    className: "secondary-action",
+    text: "登记发行",
+    attributes: { type: "button" },
+  });
+  createRelease.addEventListener("click", () => openReleaseDialog(artist));
+  const heading = node("header", { className: "collection-heading" }, [
+    node("div", {}, [
+      node("h2", { text: artist.displayName }),
+      node("p", { text: `${collection.releaseTotalCount} 个发行记录` }),
+    ]),
+    node("div", { className: "collection-heading__actions" }, [
+      node("div", { className: "collection-summary" }, [
+        node("span", { text: `已收集 ${summary.collected}` }),
+        node("span", { text: `缺失 ${summary.missing}` }),
+        node("span", { text: `想要 ${summary.wanted}` }),
+        node("span", { text: `已发布 ${summary.published}` }),
+      ]),
+      createRelease,
+    ]),
+  ]);
+  const sourcePanel = catalogSourcePanel(artist);
+
+  if (!releases.length) {
+    elements.collectionSheet.replaceChildren(
+      heading,
+      sourcePanel,
+      node("div", { className: "empty-state" }, [
+        node("strong", { text: "发行列表为空" }),
+        node("p", { text: "可以手工登记发行，或绑定官方目录来源后同步。" }),
+      ]),
+    );
+    return;
+  }
+
+  const tbody = node(
+    "tbody",
+    {},
+    releases.map((release) => {
+      const manage = node("button", {
+        className: "table-action",
+        text: "管理",
+        attributes: { type: "button", "aria-label": `管理发行 ${release.title}` },
+      });
+      manage.addEventListener("click", () => openReleaseManager(release));
+      return node("tr", {}, [
+        node("td", {}, [
+          node("span", { className: "release-title", text: release.title }),
+          node("span", {
+            className: "release-subtitle",
+            text: [release.edition, release.catalog].filter(Boolean).join(" · ") || "—",
+          }),
+        ]),
+        node("td", { text: textOrDash(release.releaseDate) }),
+        node("td", {}, [
+          node("span", {
+            className: collectionStateClass(release.collectionState),
+            text: humanizeEnum(release.collectionState),
+          }),
+        ]),
+        node("td", { text: describeCopies(release.copies) }),
+        node("td", {}, [
+          node("span", { className: "quality-pill", text: describeQuality(release.copies) }),
+        ]),
+        node("td", {}, [manage]),
+      ]);
+    }),
+  );
+  const table = node("table", { className: "release-table" }, [
+    node("thead", {}, [
+      node("tr", {}, [
+        node("th", { text: "发行" }),
+        node("th", { text: "日期" }),
+        node("th", { text: "状态" }),
+        node("th", { text: "取得来源" }),
+        node("th", { text: "音质" }),
+        node("th", { text: "操作" }),
+      ]),
+    ]),
+    tbody,
+  ]);
+  elements.collectionSheet.replaceChildren(heading, sourcePanel, table);
+}
+
+async function selectArtist(artistId, { background = false } = {}) {
+  stopCatalogRefresh();
+  const loadGeneration = ++state.artistLoadGeneration;
+  const token = state.token;
+  const switchingArtist = state.selectedArtistId !== artistId;
+  state.selectedArtistId = artistId;
+  state.selectedRelease = null;
+  state.catalogSourcesStatus = "loading";
+  state.catalogSourcesError = "";
+  if (switchingArtist) {
+    state.selectedCollection = null;
+    state.catalogSources = [];
+    state.catalogRunsBySource = {};
+    state.catalogHistoryStateBySource = {};
+  }
+  renderArtists(state.artists);
+  if (!background || !state.selectedCollection) {
+    renderMessage(elements.collectionSheet, "loading", "正在读取 Artist 工作台", "并行汇总发行、副本与官方目录信源。");
+  }
+
+  const [collectionResult, sourcesResult] = await Promise.allSettled([
+    graphql(COLLECTION_QUERY, { artistId, limit: 500, offset: 0 }),
+    graphql(CATALOG_SYNC_SOURCES_QUERY, { artistId }),
+  ]);
+  for (const result of [collectionResult, sourcesResult]) {
+    if (result.status === "rejected" && result.reason instanceof SessionRequiredError) {
+      openSessionDialog(result.reason.message);
+    }
+  }
+  if (!catalogSelectionIsCurrent(artistId, token, loadGeneration)) return;
+
+  if (collectionResult.status === "rejected") {
+    renderMessage(
+      elements.collectionSheet,
+      "error",
+      "无法读取发行列表",
+      collectionResult.reason.message,
+    );
+    return;
+  }
+
+  state.selectedCollection = collectionResult.value.catalogArtistCollection;
+  if (sourcesResult.status === "rejected") {
+    state.catalogSources = [];
+    state.catalogSourcesStatus = "error";
+    state.catalogSourcesError = `官方目录读取失败：${sourcesResult.reason.message}`;
+    state.catalogRunsBySource = {};
+    state.catalogHistoryStateBySource = {};
+    renderCollection(state.selectedCollection);
+    return;
+  }
+
+  state.catalogSources = sourcesResult.value.catalogSyncSources;
+  state.catalogSourcesStatus = "ready";
+  state.catalogRunsBySource = {};
+  state.catalogHistoryStateBySource = Object.fromEntries(
+    state.catalogSources.map((source) => [source.sourceId, { status: "loading", error: "" }]),
+  );
+  renderCollection(state.selectedCollection);
+
+  const historyResults = await Promise.allSettled(
+    state.catalogSources.map((source) =>
+      graphql(CATALOG_SYNC_RUNS_QUERY, { sourceId: source.sourceId, limit: 5, offset: 0 }),
+    ),
+  );
+  for (const result of historyResults) {
+    if (result.status === "rejected" && result.reason instanceof SessionRequiredError) {
+      openSessionDialog(result.reason.message);
+    }
+  }
+  if (!catalogSelectionIsCurrent(artistId, token, loadGeneration)) return;
+
+  historyResults.forEach((result, index) => {
+    const sourceId = state.catalogSources[index].sourceId;
+    if (result.status === "fulfilled") {
+      state.catalogRunsBySource[sourceId] = result.value.catalogSyncRuns;
+      state.catalogHistoryStateBySource[sourceId] = { status: "ready", error: "" };
+    } else {
+      state.catalogRunsBySource[sourceId] = [];
+      state.catalogHistoryStateBySource[sourceId] = {
+        status: "error",
+        error: `运行历史读取失败：${result.reason.message}`,
+      };
+    }
+  });
+  updateCatalogSourcePanel();
+  scheduleCatalogRefresh();
+}
+
+async function connectSession(token) {
+  await graphql(INTAKE_QUERY, { limit: 1, offset: 0 }, token);
+  sessionStorage.setItem(SESSION_KEY, token);
+  state.token = token;
+  state.jobs = [];
+  state.artists = [];
+  updateSessionUi();
+  elements.sessionDialog.close();
+  showToast("已连接 Annim 管理会话");
+  if (state.view === "intake") await ensureIntakeLoaded(true);
+  if (state.view === "artists") await ensureArtistsLoaded(true);
+}
+
+elements.sessionButton.addEventListener("click", () => openSessionDialog());
+
+elements.sessionForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const token = elements.adminToken.value.trim();
+  if (!token) {
+    elements.sessionError.textContent = "请输入管理令牌。";
+    return;
+  }
+  elements.sessionError.textContent = "正在验证令牌…";
+  try {
+    await connectSession(token);
+  } catch (error) {
+    elements.sessionError.textContent =
+      error instanceof SessionRequiredError ? "令牌无效。" : error.message;
+  } finally {
+    elements.adminToken.value = "";
+  }
+});
+
+elements.forgetSession.addEventListener("click", () => {
+  clearSession();
+  elements.sessionDialog.close();
+});
+
+elements.createArtistButton.addEventListener("click", openArtistDialog);
+
+elements.artistCreateForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const displayName = elements.artistCreateForm.elements.namedItem("displayName").value;
+  if (!displayName.trim()) {
+    elements.artistFormError.textContent = "显示名称不能为空。";
+    return;
+  }
+  const data = await runCatalogMutation(
+    elements.artistCreateForm,
+    elements.artistFormError,
+    CREATE_CATALOG_ARTIST_MUTATION,
+    {
+      displayName,
+      sortName: optionalExactFormValue(elements.artistCreateForm, "sortName"),
+      notes: optionalExactFormValue(elements.artistCreateForm, "notes"),
+    },
+  );
+  if (!data) return;
+  const artist = data.createCatalogArtist;
+  elements.artistDialog.close();
+  elements.artistCreateForm.reset();
+  elements.artistSearch.value = "";
+  showToast(`Artist「${artist.displayName}」已创建`);
+  await loadArtists();
+  await selectArtist(artist.artistId);
+});
+
+elements.releaseCreateForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const artistId = state.selectedArtistId;
+  if (!artistId) {
+    elements.releaseFormError.textContent = "请先选择 Artist。";
+    return;
+  }
+  const title = elements.releaseCreateForm.elements.namedItem("title").value;
+  if (!title.trim()) {
+    elements.releaseFormError.textContent = "发行标题不能为空。";
+    return;
+  }
+  const releaseDate = optionalExactFormValue(elements.releaseCreateForm, "releaseDate");
+  if (releaseDate && !/^\d{4}(?:-\d{2}){0,2}$/.test(releaseDate)) {
+    elements.releaseFormError.textContent = "发行日期应为 YYYY、YYYY-MM 或 YYYY-MM-DD。";
+    return;
+  }
+  const data = await runCatalogMutation(
+    elements.releaseCreateForm,
+    elements.releaseFormError,
+    CREATE_CATALOG_RELEASE_MUTATION,
+    {
+      artistId,
+      title,
+      edition: optionalExactFormValue(elements.releaseCreateForm, "edition"),
+      catalog: optionalExactFormValue(elements.releaseCreateForm, "catalog"),
+      releaseDate,
+      kind: elements.releaseCreateForm.elements.namedItem("kind").value,
+      notes: optionalExactFormValue(elements.releaseCreateForm, "notes"),
+    },
+  );
+  if (!data) return;
+  const release = data.createCatalogRelease;
+  elements.releaseDialog.close();
+  elements.releaseCreateForm.reset();
+  showToast(`发行「${release.title}」已登记`);
+  await selectArtist(artistId);
+});
+
+elements.catalogSourceForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const artistId = state.selectedArtistId;
+  if (!artistId) {
+    elements.catalogSourceFormError.textContent = "请先选择 Artist。";
+    return;
+  }
+  const locator = elements.catalogSourceForm.elements.namedItem("locator").value;
+  const storefront = elements.catalogSourceForm.elements.namedItem("storefront").value;
+  const locale = elements.catalogSourceForm.elements.namedItem("locale").value;
+  if (!/^(?!0+$)\d{1,32}$/.test(locator)) {
+    elements.catalogSourceFormError.textContent = "Apple Music Artist ID 必须是 1–32 位非全零数字。";
+    return;
+  }
+  if (!/^[a-z]{2}$/.test(storefront)) {
+    elements.catalogSourceFormError.textContent = "Storefront 必须是两个小写 ASCII 字母。";
+    return;
+  }
+  if (locale !== "") {
+    if (locale.length > 35 || !/^[\x21-\x7e]+$/.test(locale) || locale.includes("_")) {
+      elements.catalogSourceFormError.textContent = "Locale 必须是最多 35 位的 ASCII BCP 47 标记，不能使用下划线。";
+      return;
+    }
+    try {
+      Intl.getCanonicalLocales(locale);
+    } catch {
+      elements.catalogSourceFormError.textContent = "Locale 不是有效的 BCP 47 标记。";
+      return;
+    }
+  }
+  const data = await runCatalogMutation(
+    elements.catalogSourceForm,
+    elements.catalogSourceFormError,
+    CREATE_CATALOG_SYNC_SOURCE_MUTATION,
+    {
+      artistId,
+      kind: "APPLE_MUSIC",
+      locator,
+      storefront,
+      locale: locale === "" ? null : locale,
+    },
+  );
+  if (!data) return;
+  elements.catalogSourceDialog.close();
+  elements.catalogSourceForm.reset();
+  showToast("Apple Music 目录信源已建立");
+  await selectArtist(artistId, { background: true });
+});
+
+for (const button of elements.collectionCopyForm.querySelectorAll("[data-release-command]")) {
+  button.addEventListener("click", async () => {
+    const release = state.selectedRelease;
+    if (!release) {
+      elements.collectionCopyFormError.textContent = "请重新打开要管理的发行。";
+      return;
+    }
+    const data = await runCatalogMutation(
+      elements.collectionCopyForm,
+      elements.collectionCopyFormError,
+      EXECUTE_CATALOG_RELEASE_COMMAND_MUTATION,
+      {
+        releaseId: release.releaseId,
+        expectedRowVersion: release.rowVersion,
+        command: { [button.dataset.releaseCommand]: "EXECUTE" },
+      },
+    );
+    await finishReleaseMutation(
+      data,
+      (updated) => `发行状态已更新为 ${humanizeEnum(updated.collectionState)}`,
+    );
+  });
+}
+
+elements.collectionCopyForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const release = state.selectedRelease;
+  if (!release) {
+    elements.collectionCopyFormError.textContent = "请重新打开要管理的发行。";
+    return;
+  }
+
+  const sourceLabel = elements.collectionCopyForm.elements.namedItem("sourceLabel").value;
+  if (!sourceLabel.trim()) {
+    elements.collectionCopyFormError.textContent = "来源名称不能为空。";
+    return;
+  }
+
+  let sampleRateHz;
+  let bitDepth;
+  let channels;
+  let trackCount;
+  let byteLength;
+  try {
+    sampleRateHz = optionalPositiveIntegerFormValue(
+      elements.collectionCopyForm,
+      "sampleRateHz",
+      "采样率",
+      2_147_483_647,
+    );
+    bitDepth = optionalPositiveIntegerFormValue(
+      elements.collectionCopyForm,
+      "bitDepth",
+      "位深",
+      255,
+    );
+    channels = optionalPositiveIntegerFormValue(
+      elements.collectionCopyForm,
+      "channels",
+      "声道数",
+      255,
+    );
+    trackCount = optionalPositiveIntegerFormValue(
+      elements.collectionCopyForm,
+      "trackCount",
+      "轨道数",
+      2_147_483_647,
+    );
+    byteLength = optionalByteLengthFormValue(elements.collectionCopyForm);
+  } catch (error) {
+    elements.collectionCopyFormError.textContent = error.message;
+    return;
+  }
+
+  const manifestDigest = optionalExactFormValue(
+    elements.collectionCopyForm,
+    "manifestDigest",
+  );
+  if (manifestDigest && !/^[0-9a-fA-F]{64}$/.test(manifestDigest)) {
+    elements.collectionCopyFormError.textContent = "Manifest SHA-256 必须是 64 位十六进制。";
+    return;
+  }
+
+  const ingestJobId = optionalExactFormValue(elements.collectionCopyForm, "ingestJobId");
+  if (
+    ingestJobId &&
+    !/^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$/.test(
+      ingestJobId,
+    )
+  ) {
+    elements.collectionCopyFormError.textContent = "Ingest Job UUID 格式不正确。";
+    return;
+  }
+
+  const data = await runCatalogMutation(
+    elements.collectionCopyForm,
+    elements.collectionCopyFormError,
+    EXECUTE_CATALOG_RELEASE_COMMAND_MUTATION,
+    {
+      releaseId: release.releaseId,
+      expectedRowVersion: release.rowVersion,
+      command: {
+        recordCopy: {
+          sourceKind: elements.collectionCopyForm.elements.namedItem("sourceKind").value,
+          sourceLabel,
+          privateLocator: optionalExactFormValue(
+            elements.collectionCopyForm,
+            "privateLocator",
+          ),
+          codec: elements.collectionCopyForm.elements.namedItem("codec").value,
+          sampleRateHz,
+          bitDepth,
+          channels,
+          trackCount,
+          byteLength,
+          manifestDigest,
+          qualityVerified:
+            elements.collectionCopyForm.elements.namedItem("qualityVerified").checked,
+          ingestJobId,
+          notes: optionalExactFormValue(elements.collectionCopyForm, "notes"),
+        },
+      },
+    },
+  );
+  await finishReleaseMutation(data, () => `音源副本「${sourceLabel}」已登记`);
+});
+
+for (const button of document.querySelectorAll("[data-close-catalog-dialog]")) {
+  button.addEventListener("click", () => button.closest("dialog").close());
+}
+
+elements.artistSearchForm.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  stopCatalogRefresh();
+  state.artistLoadGeneration += 1;
+  state.selectedArtistId = null;
+  state.selectedRelease = null;
+  state.selectedCollection = null;
+  state.catalogSources = [];
+  state.catalogSourcesStatus = "idle";
+  state.catalogSourcesError = "";
+  state.catalogRunsBySource = {};
+  state.catalogHistoryStateBySource = {};
+  renderMessage(elements.collectionSheet, "empty", "选择一位艺人", "查看发行列表、来源与音质。");
+  try {
+    await loadArtists(elements.artistSearch.value.trim() || null);
+  } catch (error) {
+    if (error instanceof SessionRequiredError) return;
+    renderMessage(elements.artistList, "error", "搜索失败", error.message);
+  }
+});
+
+for (const button of document.querySelectorAll("[data-refresh]")) {
+  button.addEventListener("click", () => {
+    if (button.dataset.refresh === "intake") void ensureIntakeLoaded(true);
+    if (button.dataset.refresh === "artists") {
+      void (async () => {
+        await ensureArtistsLoaded(true);
+        if (state.selectedArtistId) {
+          await selectArtist(state.selectedArtistId, { background: true });
+        }
+      })();
+    }
+  });
+}
+
+document.querySelector("[data-close-drawer]").addEventListener("click", () => {
+  elements.ingestDetail.hidden = true;
+});
+
+window.addEventListener("hashchange", routeFromHash);
+document.addEventListener("visibilitychange", () => {
+  if (document.hidden) {
+    stopCatalogRefresh();
+  } else if (state.view === "artists" && state.selectedArtistId) {
+    void selectArtist(state.selectedArtistId, { background: true });
+  }
+});
+
+updateSessionUi();
+routeFromHash();
+void checkServer();
diff --git a/annim-web/index.html b/annim-web/index.html
new file mode 100644
index 00000000..afd66a25
--- /dev/null
+++ b/annim-web/index.html
@@ -0,0 +1,917 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta
+      name="description"
+      content="Annim 音频入库工作台：从原盘证据、元数据审阅到安全发布。"
+    />
+    <title>Annim · 音频入库工作台</title>
+    <link rel="stylesheet" href="/app/styles.css" />
+    <script type="module" src="/app/app.js"></script>
+  </head>
+  <body>
+    <a class="skip-link" href="#main-content">跳到主要内容</a>
+
+    <div class="app-shell">
+      <header class="topbar">
+        <a class="brand" href="#workflow" aria-label="返回工作流总览">
+          <span class="brand-mark" aria-hidden="true">
+            <span></span>
+          </span>
+          <span>
+            <strong>Annim</strong>
+            <small>Audio intake desk</small>
+          </span>
+        </a>
+
+        <div class="server-state" aria-live="polite">
+          <span class="state-lamp" id="server-lamp"></span>
+          <span id="server-label">正在确认服务状态</span>
+        </div>
+
+        <button class="session-button" id="session-button" type="button">
+          <span class="session-button__label">管理会话</span>
+          <span class="session-button__state" id="session-state">未连接</span>
+        </button>
+      </header>
+
+      <aside class="sidebar" aria-label="工作台导航">
+        <div class="sidebar-intro">
+          <span class="eyebrow">Collection OS</span>
+          <p>每一步都留下证据，每一次写入都可以解释。</p>
+        </div>
+
+        <nav class="primary-nav">
+          <a class="nav-item is-active" href="#workflow" data-view-link="workflow">
+            <span class="nav-index">00</span>
+            <span>工作流总览</span>
+          </a>
+          <a class="nav-item" href="#intake" data-view-link="intake">
+            <span class="nav-index">01</span>
+            <span>入库队列</span>
+            <span class="nav-count" id="intake-count">—</span>
+          </a>
+          <a class="nav-item" href="#artists" data-view-link="artists">
+            <span class="nav-index">02</span>
+            <span>艺人拉表</span>
+            <span class="nav-count" id="artist-count">—</span>
+          </a>
+        </nav>
+
+        <div class="sidebar-rule">
+          <span>Authority</span>
+          <strong>Booklet first</strong>
+          <p>网络结果只进入候选区，不会静默覆盖 CD 原始记载。</p>
+        </div>
+      </aside>
+
+      <main id="main-content" class="main-content" tabindex="-1">
+        <section class="view" id="workflow-view" data-view="workflow">
+          <div class="hero">
+            <div class="hero-copy">
+              <span class="eyebrow">Target workflow · v1</span>
+              <h1>从原盘证据，<br />到可验证的音乐库。</h1>
+              <p class="hero-lede">
+                Web 端负责看清、比较和确认；Annim 后端负责编排状态、保存证据和执行安全边界；worker
+                只处理已经冻结的计划。
+              </p>
+              <div class="hero-actions">
+                <a class="primary-action" href="#intake">查看入库队列</a>
+                <a class="text-action" href="#architecture">理解系统边界</a>
+              </div>
+            </div>
+
+            <div class="disc-map" aria-label="七阶段入库流程">
+              <div class="disc-map__grooves" aria-hidden="true"></div>
+              <div class="disc-map__label">
+                <strong>7</strong>
+                <span>个阶段</span>
+              </div>
+              <ol class="disc-map__stages">
+                <li class="disc-stage disc-stage--1"><span>收件</span></li>
+                <li class="disc-stage disc-stage--2"><span>拆轨</span></li>
+                <li class="disc-stage disc-stage--3"><span>证据</span></li>
+                <li class="disc-stage disc-stage--4"><span>审阅</span></li>
+                <li class="disc-stage disc-stage--5"><span>补全</span></li>
+                <li class="disc-stage disc-stage--6"><span>执行</span></li>
+                <li class="disc-stage disc-stage--7"><span>发布</span></li>
+              </ol>
+            </div>
+          </div>
+
+          <section class="outcome-strip" aria-label="目标效果">
+            <article>
+              <span class="outcome-value">0</span>
+              <div>
+                <strong>原始文件被改写</strong>
+                <p>源文件只读，处理发生在私有 staging。</p>
+              </div>
+            </article>
+            <article>
+              <span class="outcome-value">100%</span>
+              <div>
+                <strong>字段可追溯</strong>
+                <p>值、来源、方法、置信度与决定一起保存。</p>
+              </div>
+            </article>
+            <article>
+              <span class="outcome-value">1</span>
+              <div>
+                <strong>明确发布点</strong>
+                <p>验证完成后才允许原子提交到正式库。</p>
+              </div>
+            </article>
+          </section>
+
+          <section class="section-heading" id="stages">
+            <div>
+              <span class="eyebrow">Operator journey</span>
+              <h2>每个阶段要做什么</h2>
+            </div>
+            <p>
+              阶段顺序是真实的状态约束。后一步不能绕过前一步的证据与校验，也不能在后台“猜着完成”。
+            </p>
+          </section>
+
+          <div class="stage-ledger">
+            <article class="stage-card">
+              <header>
+                <span class="stage-number">01</span>
+                <div>
+                  <span class="stage-kicker">Receive &amp; seal</span>
+                  <h3>收件与原件封存</h3>
+                </div>
+                <span class="status-tag status-tag--done">核心已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>选择 CD 抓轨目录或流媒体文件，登记取得来源，并确认本次入库对象。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>建立不可变 manifest，记录路径、大小与 SHA-256；源目录随后只读，所有输出进入 staging。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>每个输入都有摘要，manifest 被冻结，后续计划只能引用摘要而不能替换源文件。</p>
+                </div>
+              </div>
+              <footer>
+                <code>anni-ingest/src/manifest.rs</code>
+                <code>anni-workspace</code>
+                <code>annim/src/ingest</code>
+              </footer>
+            </article>
+
+            <article class="stage-card">
+              <header>
+                <span class="stage-number">02</span>
+                <div>
+                  <span class="stage-kicker">Parse &amp; split</span>
+                  <h3>CUE/WAV 解析与安全拆轨</h3>
+                </div>
+                <span class="status-tag status-tag--done">核心已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>确认 CUE 对应的 WAV、轨道边界和 HTOA 等异常提示；不需要手工搬运输出文件。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>先解析、再生成冻结执行计划；worker 写入独立临时文件，校验完成后才登记产物。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>轨道数量、时长与摘要可复核；失败只留下隔离记录，不会删除或覆盖整轨 WAV。</p>
+                </div>
+              </div>
+              <footer>
+                <code>anni-split</code>
+                <code>anni-ingest/src/plan.rs</code>
+                <code>anni-ingest-worker</code>
+              </footer>
+            </article>
+
+            <article class="stage-card stage-card--authority">
+              <header>
+                <span class="stage-number">03</span>
+                <div>
+                  <span class="stage-kicker">Evidence, not overwrite</span>
+                  <h3>元数据证据化</h3>
+                </div>
+                <span class="status-tag status-tag--done">核心已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>优先录入 Booklet 与包装上的原文；保留全角、半角、大小写、空格和括号形态。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>每个候选值绑定来源、定位信息、采集方法与置信度。AI 和网络只添加候选，不改 canonical 值。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>标题、艺人、日期、曲种等必需字段都有可追溯候选，且 Booklet 冲突被明确呈现。</p>
+                </div>
+              </div>
+              <div class="exact-text-sample" aria-label="原文字符保留示例">
+                <span>exact text</span>
+                <code>作品・A〜B～C（初回）</code>
+                <p>项目既有的中点与波浪线约定视为已确认实践，不作为冲突项；其余字符不做静默归一化。</p>
+              </div>
+              <footer>
+                <code>anni-ingest/src/metadata.rs</code>
+                <code>annim/src/graphql/ingest_metadata.rs</code>
+              </footer>
+            </article>
+
+            <article class="stage-card">
+              <header>
+                <span class="stage-number">04</span>
+                <div>
+                  <span class="stage-kicker">Human decision</span>
+                  <h3>逐字段审阅与版本冻结</h3>
+                </div>
+                <span class="status-tag status-tag--partial">人工工作台已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>在一个视图里比较候选、查看证据并接受或拒绝；重点确认曲种、艺人职责与多碟结构。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>计算缺失必填项，保存每次 revision；用 row version 拒绝过期页面的覆盖写入。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>审阅 completeness 为 100%，被批准 revision 冻结；任何后续改动都产生新 revision。</p>
+                </div>
+              </div>
+              <footer>
+                <code>annim GraphQL metadata review</code>
+                <code>annim-web / metadata workbench</code>
+              </footer>
+            </article>
+
+            <article class="stage-card">
+              <header>
+                <span class="stage-number">05</span>
+                <div>
+                  <span class="stage-kicker">Catalog &amp; artwork</span>
+                  <h3>目录同步与封面择优</h3>
+                </div>
+                <span class="status-tag status-tag--partial">后台核心已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>为艺人绑定 Apple、官网或 VGMDB 信源；对候选封面比较像素、来源与版本后确认。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>后台分页拉取目录并保留原始响应；下载封面时禁止私网跳转，验证格式后按摘要存储。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>艺人拉表显示已收集、缺失和音质；选定封面指向已验证的本地不可变资产。</p>
+                </div>
+              </div>
+              <div class="stage-note">
+                <span>Cover strategy</span>
+                <p>
+                  Apple artwork 展开尺寸模板；艺人/厂牌官网保留原始链接；Amazon 只在已知图片 CDN
+                  上移除文件名中的压缩块（例如 <code>._AC_SL1500_</code>），不会删除可能承载签名或凭据的任意查询参数。
+                </p>
+              </div>
+              <footer>
+                <code>anni-catalog-worker</code>
+                <code>anni-cover-worker</code>
+                <code>annim/src/catalog</code>
+                <code>annim/src/cover</code>
+              </footer>
+            </article>
+
+            <article class="stage-card stage-card--safe">
+              <header>
+                <span class="stage-number">06</span>
+                <div>
+                  <span class="stage-kicker">Execute the frozen plan</span>
+                  <h3>执行、校验与隔离</h3>
+                </div>
+                <span class="status-tag status-tag--done">核心已实现</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>启动已经批准的 plan；如果输入摘要或 revision 已变化，回到审阅而不是强行继续。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>worker 持 lease 执行，逐项核对 plan digest、输出摘要和媒体属性；异常进入 quarantine。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>verification digest 绑定本次产物，所有步骤幂等；重复执行不会生成不一致的第二份结果。</p>
+                </div>
+              </div>
+              <footer>
+                <code>anni-ingest-worker</code>
+                <code>annim ingest state machine</code>
+              </footer>
+            </article>
+
+            <article class="stage-card">
+              <header>
+                <span class="stage-number">07</span>
+                <div>
+                  <span class="stage-kicker">Atomic publish</span>
+                  <h3>原子发布与进度回写</h3>
+                </div>
+                <span class="status-tag status-tag--partial">闭环待完善</span>
+              </header>
+              <div class="stage-columns">
+                <div>
+                  <h4>你要做</h4>
+                  <p>在验证摘要一致后确认发布；之后只在正式库中查看，不再手工移动 staging 文件。</p>
+                </div>
+                <div>
+                  <h4>系统做</h4>
+                  <p>原子提交到 Anni 仓库，关联 artist/release/copy/ingest job，并回写音质与取得来源。</p>
+                </div>
+                <div class="target-cell">
+                  <h4>完成标志</h4>
+                  <p>正式库可读、拉表状态变为 Published；审计记录能从成品反查到输入、计划和证据。</p>
+                </div>
+              </div>
+              <div class="stage-note">
+                <span>Copy provenance</span>
+                <p>
+                  每份实际音频单独记录 source kind 与自由文本 source label，例如“天使动漫”“某 PT/BT
+                  站”“群友分享”；同一发行可同时保留多个音质与来源，不用互相覆盖。
+                </p>
+              </div>
+              <footer>
+                <code>anni-repo integration</code>
+                <code>catalog collection copy</code>
+                <code>disaster recovery runbook</code>
+              </footer>
+            </article>
+          </div>
+
+          <section class="architecture" id="architecture">
+            <div class="section-heading section-heading--compact">
+              <div>
+                <span class="eyebrow">Server–client boundary</span>
+                <h2>目标架构</h2>
+              </div>
+              <p>浏览器只发控制命令；耗时、敏感和文件相关工作全部离开请求线程。</p>
+            </div>
+
+            <div class="architecture-map" role="img" aria-label="Annim server-client 架构图">
+              <div class="architecture-node architecture-node--client">
+                <span>Client</span>
+                <strong>Annim Web</strong>
+                <p>队列 · 审阅 · 拉表 · 封面</p>
+              </div>
+              <div class="architecture-link">
+                <span>HTTPS / GraphQL</span>
+              </div>
+              <div class="architecture-node architecture-node--server">
+                <span>Control plane</span>
+                <strong>Annim Server</strong>
+                <p>Auth · CAS · 状态机 · 审计</p>
+              </div>
+              <div class="architecture-link architecture-link--branch">
+                <span>leases + frozen plans</span>
+              </div>
+              <div class="architecture-workers">
+                <div>
+                  <span>Worker</span>
+                  <strong>Ingest</strong>
+                </div>
+                <div>
+                  <span>Worker</span>
+                  <strong>Catalog</strong>
+                </div>
+                <div>
+                  <span>Worker</span>
+                  <strong>Cover</strong>
+                </div>
+              </div>
+              <div class="architecture-link">
+                <span>verified writes only</span>
+              </div>
+              <div class="architecture-storage">
+                <div>
+                  <span>Private</span>
+                  <strong>Staging</strong>
+                </div>
+                <div>
+                  <span>Durable</span>
+                  <strong>Database</strong>
+                </div>
+                <div>
+                  <span>Published</span>
+                  <strong>Anni Repository</strong>
+                </div>
+              </div>
+            </div>
+          </section>
+
+          <section class="authority-section">
+            <div class="section-heading section-heading--compact">
+              <div>
+                <span class="eyebrow">Metadata authority</span>
+                <h2>冲突时听谁的</h2>
+              </div>
+              <p>优先级不等于自动接受。所有来源先成为候选，再由规则推荐、由人确认。</p>
+            </div>
+            <ol class="authority-ladder">
+              <li>
+                <span class="authority-rank">A</span>
+                <div>
+                  <strong>CD Booklet / 盘面 / 包装</strong>
+                  <p>收藏实体的原始记载，最高权威；逐字符转录并保留版次。</p>
+                </div>
+              </li>
+              <li>
+                <span class="authority-rank">B</span>
+                <div>
+                  <strong>唱片公司与艺人官网</strong>
+                  <p>用于补充发行信息、职责与版本；与实体冲突时必须提示。</p>
+                </div>
+              </li>
+              <li>
+                <span class="authority-rank">C</span>
+                <div>
+                  <strong>官方商店 / Apple Music</strong>
+                  <p>适合补齐目录和封面；流媒体版可能不同于 CD 版。</p>
+                </div>
+              </li>
+              <li>
+                <span class="authority-rank">D</span>
+                <div>
+                  <strong>VGMDB 与社区来源</strong>
+                  <p>VGMDB 适合发现专辑，社区来源适合定位线索；两者都不能静默定稿。</p>
+                </div>
+              </li>
+              <li>
+                <span class="authority-rank">E</span>
+                <div>
+                  <strong>文件名与 AI 推断</strong>
+                  <p>只用于产生待审候选，必须标注 inference，不能补写不存在的事实。</p>
+                </div>
+              </li>
+            </ol>
+          </section>
+
+          <section class="safety-section">
+            <div class="section-heading section-heading--compact">
+              <div>
+                <span class="eyebrow">Safety &amp; recovery</span>
+                <h2>失败也不能伤到原件</h2>
+              </div>
+              <p>安全不是一个确认弹窗，而是从输入、执行、提交到备份都无法绕过的不变量。</p>
+            </div>
+            <div class="safety-grid">
+              <article>
+                <span class="safety-index">S1</span>
+                <h3>原件只读</h3>
+                <p>服务不提供删除源文件的命令。manifest 记录摘要；摘要变化时停止任务，而不是继续使用“看起来相同”的路径。</p>
+                <strong>故障结果：任务失效，原件不变</strong>
+              </article>
+              <article>
+                <span class="safety-index">S2</span>
+                <h3>私有 staging</h3>
+                <p>临时路径由 worker 创建，拒绝越界与覆盖；拆轨和封面都先写 partial，再校验摘要与媒体结构。</p>
+                <strong>故障结果：partial 被隔离，可重试</strong>
+              </article>
+              <article>
+                <span class="safety-index">S3</span>
+                <h3>冻结计划 + CAS</h3>
+                <p>每个写操作携带 row version、metadata revision 与 plan digest；过期页面和重复 worker 不能相互覆盖。</p>
+                <strong>故障结果：冲突显式返回，等待刷新</strong>
+              </article>
+              <article>
+                <span class="safety-index">S4</span>
+                <h3>验证后发布</h3>
+                <p>产物通过数量、摘要和媒体属性验证后才进入 Ready to commit；发布点必须可重放且幂等。</p>
+                <strong>故障结果：正式库仍保持旧状态</strong>
+              </article>
+              <article>
+                <span class="safety-index">S5</span>
+                <h3>3-2-1 灾备</h3>
+                <p>目标部署需同时备份数据库、内容寻址资产和正式仓库；至少一份离线/异地不可变副本，并定期做恢复演练。</p>
+                <strong>建设项：backup/restore runbook + 演练记录</strong>
+              </article>
+              <article>
+                <span class="safety-index">S6</span>
+                <h3>审计闭环</h3>
+                <p>成品反查到 copy、ingest job、verification、plan、manifest 与 evidence；排障不依赖易失日志。</p>
+                <strong>建设项：发布回写与审计查询页</strong>
+              </article>
+            </div>
+          </section>
+
+          <section class="build-matrix-section">
+            <div class="section-heading section-heading--compact">
+              <div>
+                <span class="eyebrow">Implementation map</span>
+                <h2>现有模块与后续建设</h2>
+              </div>
+              <p>“已有”表示当前仓库中有真实执行路径和测试；“下一步”表示仍需要产品界面、适配器或运维闭环。</p>
+            </div>
+            <div class="build-matrix-wrap">
+              <table class="build-matrix">
+                <thead>
+                  <tr>
+                    <th>能力</th>
+                    <th>当前调用点</th>
+                    <th>状态</th>
+                    <th>下一步</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <tr>
+                    <td>入库状态与并发控制</td>
+                    <td><code>annim/src/ingest</code> · <code>annim/src/graphql/ingest.rs</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>Web 写操作与冲突恢复提示</td>
+                  </tr>
+                  <tr>
+                    <td>不可变 manifest / plan</td>
+                    <td><code>anni-ingest/src/manifest.rs</code> · <code>plan.rs</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>从浏览器创建 staging job 的受控上传/登记入口</td>
+                  </tr>
+                  <tr>
+                    <td>CUE/WAV 拆轨</td>
+                    <td><code>anni-split</code> · <code>anni-ingest-worker</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>在 Job 详情中展示边界、时长和验证报告</td>
+                  </tr>
+                  <tr>
+                    <td>字段证据与审阅 revision</td>
+                    <td><code>anni-ingest/src/metadata.rs</code> · <code>ingest_metadata.rs</code> · <code>annim-web/app.js</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>Booklet 扫描资产、OCR/AI 候选 Agent、批量字段导入与对照</td>
+                  </tr>
+                  <tr>
+                    <td>Artist 拉表与音质来源</td>
+                    <td><code>anni-catalog</code> · <code>annim/src/catalog</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>Web 新建/编辑 Release 与 Copy，以及批量差异确认</td>
+                  </tr>
+                  <tr>
+                    <td>Apple Music 同步</td>
+                    <td><code>anni-catalog-worker/src/apple_music.rs</code> · <code>src/bin/catalog-worker.rs</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>部署 supervisor、developer token 轮换、运行指标与告警</td>
+                  </tr>
+                  <tr>
+                    <td>VGMDB 同步</td>
+                    <td><code>anni-vgmdb</code>（legacy CLI）</td>
+                    <td><span class="matrix-state matrix-state--pending">受限</span></td>
+                    <td>先用 DiscoveryOnly/人工导入；获得稳定且允许的访问入口后再做 FullSnapshot</td>
+                  </tr>
+                  <tr>
+                    <td>封面获取与择优</td>
+                    <td><code>anni-cover-worker</code> · <code>annim/src/cover</code></td>
+                    <td><span class="matrix-state matrix-state--done">已有</span></td>
+                    <td>Web 候选对比、来源标注和选择操作</td>
+                  </tr>
+                  <tr>
+                    <td>灾备与可观测性</td>
+                    <td>部署层</td>
+                    <td><span class="matrix-state matrix-state--pending">待建设</span></td>
+                    <td>PITR/SQLite backup、资产清单校验、恢复演练、指标与告警</td>
+                  </tr>
+                </tbody>
+              </table>
+            </div>
+          </section>
+
+          <section class="test-contract">
+            <div>
+              <span class="eyebrow">Explainable Rust</span>
+              <h2>测试覆盖行为，不堆数量</h2>
+            </div>
+            <div class="test-grid">
+              <article>
+                <span>Unit</span>
+                <strong>规则与纯函数</strong>
+                <p>Unicode 原样保存、状态转换、URL 重写、分页与重试分类。</p>
+              </article>
+              <article>
+                <span>Integration</span>
+                <strong>真实仓储边界</strong>
+                <p>SQLite/PostgreSQL 持久化、CAS、lease、不可变 revision 与幂等。</p>
+              </article>
+              <article>
+                <span>Journey</span>
+                <strong>关键闭环</strong>
+                <p>从 staging 到发布的少量高价值流程；外部网络使用 fixture，不做脆弱 live test。</p>
+              </article>
+            </div>
+          </section>
+        </section>
+
+        <section class="view" id="intake-view" data-view="intake" hidden>
+          <header class="view-header">
+            <div>
+              <span class="eyebrow">Live control plane</span>
+              <h1>入库队列</h1>
+              <p>先定位阻塞阶段，再进入元数据证据与审批。页面不会直接执行文件操作。</p>
+            </div>
+            <button class="secondary-action" type="button" data-refresh="intake">刷新队列</button>
+          </header>
+
+          <div class="queue-summary" id="queue-summary" aria-live="polite"></div>
+          <div class="data-surface" id="intake-list">
+            <div class="empty-state">
+              <strong>连接 Annim 后读取队列</strong>
+              <p>管理令牌只保存在当前浏览器标签页的 sessionStorage 中。</p>
+            </div>
+          </div>
+
+          <aside class="detail-drawer" id="ingest-detail" hidden aria-live="polite">
+            <button class="drawer-close" type="button" data-close-drawer>关闭</button>
+            <div id="ingest-detail-content"></div>
+          </aside>
+        </section>
+
+        <section class="view" id="artists-view" data-view="artists" hidden>
+          <header class="view-header">
+            <div>
+              <span class="eyebrow">Artist collection matrix</span>
+              <h1>艺人拉表</h1>
+              <p>把官方发行列表与实际持有副本放在同一张表里，同时记录来源和音质。</p>
+            </div>
+            <div class="view-header__actions">
+              <button class="primary-action" id="create-artist-button" type="button">新建 Artist</button>
+              <button class="secondary-action" type="button" data-refresh="artists">刷新艺人</button>
+            </div>
+          </header>
+
+          <form class="search-bar" id="artist-search-form" role="search">
+            <label for="artist-search">查找艺人</label>
+            <input id="artist-search" name="search" type="search" autocomplete="off" />
+            <button type="submit">搜索</button>
+          </form>
+
+          <div class="artist-layout">
+            <div class="artist-index" id="artist-list">
+              <div class="empty-state">
+                <strong>尚未读取艺人</strong>
+                <p>建立管理会话后，这里会显示 Annim 中的 Artist。</p>
+              </div>
+            </div>
+            <div class="collection-sheet" id="collection-sheet">
+              <div class="empty-state">
+                <strong>选择一位艺人</strong>
+                <p>查看完整发行列表、缺失状态、音频来源与质量。</p>
+              </div>
+            </div>
+          </div>
+        </section>
+      </main>
+    </div>
+
+    <dialog class="session-dialog" id="session-dialog">
+      <form method="dialog" id="session-form">
+        <div class="dialog-heading">
+          <span class="eyebrow">Private admin session</span>
+          <h2>连接 Annim</h2>
+          <p>令牌不会写入 URL，也不会持久保存到 localStorage。</p>
+        </div>
+        <label for="admin-token">Bearer 管理令牌</label>
+        <input
+          id="admin-token"
+          name="token"
+          type="password"
+          autocomplete="current-password"
+          spellcheck="false"
+          required
+        />
+        <p class="form-error" id="session-error" role="alert"></p>
+        <div class="dialog-actions">
+          <button class="danger-action" id="forget-session" type="button">清除当前会话</button>
+          <button class="primary-action" value="connect" type="submit">连接</button>
+        </div>
+      </form>
+    </dialog>
+
+    <dialog class="session-dialog catalog-dialog" id="artist-dialog">
+      <form id="artist-create-form">
+        <div class="dialog-heading">
+          <span class="eyebrow">Artist ledger</span>
+          <h2>新建 Artist</h2>
+          <p>名称按来源原文保存；系统不会 trim 或做 Unicode 归一化。</p>
+        </div>
+        <label for="artist-display-name">显示名称</label>
+        <input id="artist-display-name" name="displayName" type="text" autocomplete="off" required />
+        <label for="artist-sort-name">排序名称（可选）</label>
+        <input id="artist-sort-name" name="sortName" type="text" autocomplete="off" />
+        <label for="artist-notes">备注（可选）</label>
+        <textarea id="artist-notes" name="notes" rows="3"></textarea>
+        <p class="form-error" id="artist-form-error" role="alert"></p>
+        <div class="dialog-actions">
+          <button class="secondary-action" type="button" data-close-catalog-dialog>取消</button>
+          <button class="primary-action" type="submit">创建 Artist</button>
+        </div>
+      </form>
+    </dialog>
+
+    <dialog class="session-dialog catalog-dialog" id="release-dialog">
+      <form id="release-create-form">
+        <div class="dialog-heading">
+          <span class="eyebrow">Release ledger</span>
+          <h2>登记发行</h2>
+          <p id="release-dialog-artist">发行会归入当前 Artist 的拉表。</p>
+        </div>
+        <label for="release-title">发行标题</label>
+        <input id="release-title" name="title" type="text" autocomplete="off" required />
+        <div class="dialog-field-grid">
+          <label>
+            <span>版本（可选）</span>
+            <input id="release-edition" name="edition" type="text" autocomplete="off" />
+          </label>
+          <label>
+            <span>品番（可选）</span>
+            <input id="release-catalog" name="catalog" type="text" autocomplete="off" />
+          </label>
+          <label>
+            <span>发行日期（可选）</span>
+            <input
+              id="release-date"
+              name="releaseDate"
+              type="text"
+              placeholder="YYYY / YYYY-MM / YYYY-MM-DD"
+              autocomplete="off"
+            />
+          </label>
+          <label>
+            <span>发行类型</span>
+            <select id="release-kind" name="kind">
+              <option value="ALBUM">Album</option>
+              <option value="SINGLE">Single</option>
+              <option value="EP">EP</option>
+              <option value="SOUNDTRACK">Soundtrack</option>
+              <option value="COMPILATION">Compilation</option>
+              <option value="OTHER">Other</option>
+            </select>
+          </label>
+        </div>
+        <label for="release-notes">备注（可选）</label>
+        <textarea id="release-notes" name="notes" rows="3"></textarea>
+        <p class="form-error" id="release-form-error" role="alert"></p>
+        <div class="dialog-actions">
+          <button class="secondary-action" type="button" data-close-catalog-dialog>取消</button>
+          <button class="primary-action" type="submit">登记发行</button>
+        </div>
+      </form>
+    </dialog>
+
+    <dialog class="session-dialog catalog-dialog" id="release-manage-dialog">
+      <form id="collection-copy-form">
+        <div class="dialog-heading">
+          <span class="eyebrow">Collection copy</span>
+          <h2 id="release-manage-title">管理发行</h2>
+          <p>目录状态与实际音频副本分开记录；私有定位信息不会出现在查询结果中。</p>
+        </div>
+
+        <div class="release-status-toolbar" aria-label="发行收集状态">
+          <span id="release-manage-state">Missing</span>
+          <button type="button" data-release-command="markWanted">标记想要</button>
+          <button type="button" data-release-command="markMissing">标记缺失</button>
+          <button type="button" data-release-command="markUnavailable">标记不可得</button>
+        </div>
+
+        <div class="dialog-subheading">
+          <strong>登记实际音频副本</strong>
+          <span>同一发行可以保留多个来源与音质，不会互相覆盖。</span>
+        </div>
+        <div class="dialog-field-grid">
+          <label>
+            <span>取得来源</span>
+            <select name="sourceKind">
+              <option value="OWNED_CD">自购 / 持有 CD</option>
+              <option value="ANGEL_ANIME">天使动漫</option>
+              <option value="PRIVATE_TRACKER">PT 站</option>
+              <option value="BIT_TORRENT">BT</option>
+              <option value="FRIEND_SHARE">群友分享</option>
+              <option value="STREAMING">流媒体</option>
+              <option value="OTHER">其他</option>
+            </select>
+          </label>
+          <label>
+            <span>来源名称</span>
+            <input name="sourceLabel" type="text" placeholder="例如：天使动漫（群友补档）" autocomplete="off" required />
+          </label>
+          <label>
+            <span>Codec</span>
+            <select name="codec">
+              <option value="FLAC">FLAC</option>
+              <option value="WAV">WAV</option>
+              <option value="ALAC">ALAC</option>
+              <option value="AAC">AAC</option>
+              <option value="MP3">MP3</option>
+              <option value="OPUS">Opus</option>
+              <option value="OTHER">Other</option>
+            </select>
+          </label>
+          <label>
+            <span>私有定位（可选）</span>
+            <input name="privateLocator" type="text" autocomplete="off" />
+          </label>
+          <label>
+            <span>采样率 Hz（可选）</span>
+            <input name="sampleRateHz" type="number" min="1" max="2147483647" value="44100" />
+          </label>
+          <label>
+            <span>位深（可选）</span>
+            <input name="bitDepth" type="number" min="1" max="255" value="16" />
+          </label>
+          <label>
+            <span>声道数（可选）</span>
+            <input name="channels" type="number" min="1" max="255" value="2" />
+          </label>
+          <label>
+            <span>轨道数（可选）</span>
+            <input name="trackCount" type="number" min="1" max="2147483647" />
+          </label>
+          <label>
+            <span>字节数（可选）</span>
+            <input name="byteLength" type="text" inputmode="numeric" autocomplete="off" />
+          </label>
+          <label>
+            <span>Ingest Job UUID（可选）</span>
+            <input name="ingestJobId" type="text" autocomplete="off" spellcheck="false" />
+          </label>
+        </div>
+        <label for="copy-manifest-digest">Manifest SHA-256（可选）</label>
+        <input id="copy-manifest-digest" name="manifestDigest" type="text" autocomplete="off" spellcheck="false" />
+        <label for="copy-notes">副本备注（可选）</label>
+        <textarea id="copy-notes" name="notes" rows="3"></textarea>
+        <label class="dialog-checkbox">
+          <input name="qualityVerified" type="checkbox" />
+          <span>音频属性已经人工或工具验证</span>
+        </label>
+        <p class="form-error" id="collection-copy-form-error" role="alert"></p>
+        <div class="dialog-actions">
+          <button class="secondary-action" type="button" data-close-catalog-dialog>关闭</button>
+          <button class="primary-action" type="submit" data-register-copy>登记副本</button>
+        </div>
+      </form>
+    </dialog>
+
+    <dialog class="session-dialog catalog-dialog" id="catalog-source-dialog">
+      <form id="catalog-source-form">
+        <div class="dialog-heading">
+          <span class="eyebrow">Official catalog source</span>
+          <h2>绑定 Apple Music</h2>
+          <p id="catalog-source-artist">信源会归入当前 Artist。</p>
+        </div>
+        <div class="catalog-source-contract">
+          <strong>凭据由 Annim server 托管</strong>
+          <span>此处不接收 developer token 或 secret reference；未完成服务端 provisioning 时创建会被拒绝。</span>
+        </div>
+        <label for="catalog-source-locator">Apple Music Artist ID</label>
+        <input
+          id="catalog-source-locator"
+          name="locator"
+          type="text"
+          inputmode="numeric"
+          pattern="(?!0+$)[0-9]{1,32}"
+          maxlength="32"
+          autocomplete="off"
+          spellcheck="false"
+          required
+        />
+        <div class="dialog-field-grid">
+          <label>
+            <span>Storefront</span>
+            <input name="storefront" type="text" value="jp" pattern="[a-z]{2}" maxlength="2" autocomplete="off" required />
+          </label>
+          <label>
+            <span>Locale（可选）</span>
+            <input name="locale" type="text" value="ja-JP" maxlength="35" autocomplete="off" spellcheck="false" />
+          </label>
+        </div>
+        <p class="form-error" id="catalog-source-form-error" role="alert"></p>
+        <div class="dialog-actions">
+          <button class="secondary-action" type="button" data-close-catalog-dialog>取消</button>
+          <button class="primary-action" type="submit">建立信源</button>
+        </div>
+      </form>
+    </dialog>
+
+    <div class="toast-region" id="toast-region" aria-live="polite" aria-atomic="true"></div>
+  </body>
+</html>
diff --git a/annim-web/styles.css b/annim-web/styles.css
new file mode 100644
index 00000000..3e75c561
--- /dev/null
+++ b/annim-web/styles.css
@@ -0,0 +1,2766 @@
+:root {
+  color-scheme: light;
+  --lacquer: #0b1821;
+  --lacquer-soft: #172832;
+  --polycarbonate: #f1f5f5;
+  --aluminium: #c9d4d7;
+  --aluminium-dark: #86979e;
+  --paper: #fbfcfc;
+  --obi: #e94f7c;
+  --laser: #27a6b2;
+  --verified: #2f8868;
+  --caution: #b98c2c;
+  --danger: #b33d45;
+  --ink-muted: #53656d;
+  --line: rgba(11, 24, 33, 0.16);
+  --line-strong: rgba(11, 24, 33, 0.32);
+  --shadow: 0 20px 60px rgba(11, 24, 33, 0.12);
+  --display: "Hiragino Mincho ProN", "Yu Mincho", "Noto Serif CJK JP", serif;
+  --body: "Hiragino Sans", "Yu Gothic UI", "Noto Sans CJK JP", sans-serif;
+  --utility: "SFMono-Regular", "Roboto Mono", "Noto Sans Mono CJK JP", monospace;
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+html {
+  scroll-behavior: smooth;
+}
+
+body {
+  min-width: 320px;
+  margin: 0;
+  background:
+    linear-gradient(90deg, rgba(11, 24, 33, 0.025) 1px, transparent 1px) 0 0 / 48px 48px,
+    linear-gradient(rgba(11, 24, 33, 0.025) 1px, transparent 1px) 0 0 / 48px 48px,
+    var(--polycarbonate);
+  color: var(--lacquer);
+  font-family: var(--body);
+  font-size: 15px;
+  line-height: 1.65;
+  text-rendering: optimizeLegibility;
+}
+
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
+
+button,
+a {
+  -webkit-tap-highlight-color: transparent;
+}
+
+a {
+  color: inherit;
+}
+
+button {
+  color: inherit;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+:focus-visible {
+  outline: 3px solid var(--obi);
+  outline-offset: 3px;
+}
+
+.skip-link {
+  position: fixed;
+  z-index: 100;
+  top: 12px;
+  left: 12px;
+  padding: 8px 12px;
+  transform: translateY(-160%);
+  background: var(--lacquer);
+  color: white;
+  text-decoration: none;
+}
+
+.skip-link:focus {
+  transform: translateY(0);
+}
+
+.app-shell {
+  display: grid;
+  min-height: 100vh;
+  grid-template:
+    "topbar topbar" 68px
+    "sidebar main" minmax(0, 1fr) /
+    242px minmax(0, 1fr);
+}
+
+.topbar {
+  position: sticky;
+  z-index: 40;
+  top: 0;
+  grid-area: topbar;
+  display: grid;
+  grid-template-columns: 242px minmax(0, 1fr) auto;
+  align-items: stretch;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.14);
+  background: var(--lacquer);
+  color: white;
+}
+
+.brand {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 0 22px;
+  border-right: 1px solid rgba(255, 255, 255, 0.14);
+  text-decoration: none;
+}
+
+.brand-mark {
+  position: relative;
+  display: grid;
+  width: 34px;
+  height: 34px;
+  flex: 0 0 auto;
+  place-items: center;
+  border: 1px solid rgba(255, 255, 255, 0.5);
+  border-radius: 50%;
+  background:
+    radial-gradient(circle, transparent 0 20%, rgba(255, 255, 255, 0.3) 21% 23%, transparent 24% 42%, rgba(255, 255, 255, 0.13) 43% 45%, transparent 46%),
+    conic-gradient(from 220deg, var(--obi), #f5adca, var(--laser), #9bd8dd, var(--obi));
+}
+
+.brand-mark span {
+  width: 8px;
+  height: 8px;
+  border: 2px solid var(--lacquer);
+  border-radius: 50%;
+  background: white;
+}
+
+.brand strong,
+.brand small {
+  display: block;
+}
+
+.brand strong {
+  font-family: var(--display);
+  font-size: 19px;
+  font-weight: 700;
+  letter-spacing: 0.03em;
+}
+
+.brand small {
+  margin-top: -4px;
+  color: rgba(255, 255, 255, 0.58);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
+
+.server-state {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  min-width: 0;
+  padding: 0 24px;
+  color: rgba(255, 255, 255, 0.68);
+  font-family: var(--utility);
+  font-size: 11px;
+}
+
+.state-lamp {
+  width: 7px;
+  height: 7px;
+  flex: 0 0 auto;
+  border-radius: 50%;
+  background: var(--caution);
+  box-shadow: 0 0 0 4px rgba(185, 140, 44, 0.14);
+}
+
+.state-lamp.is-ready {
+  background: #49c99a;
+  box-shadow: 0 0 0 4px rgba(73, 201, 154, 0.14);
+}
+
+.state-lamp.is-down {
+  background: #ff6a72;
+  box-shadow: 0 0 0 4px rgba(255, 106, 114, 0.14);
+}
+
+.session-button {
+  display: grid;
+  min-width: 158px;
+  padding: 10px 24px;
+  border: 0;
+  border-left: 1px solid rgba(255, 255, 255, 0.14);
+  background: transparent;
+  color: white;
+  cursor: pointer;
+  text-align: left;
+}
+
+.session-button:hover {
+  background: rgba(255, 255, 255, 0.06);
+}
+
+.session-button__label {
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.session-button__state {
+  color: rgba(255, 255, 255, 0.58);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.sidebar {
+  position: sticky;
+  z-index: 20;
+  top: 68px;
+  grid-area: sidebar;
+  height: calc(100vh - 68px);
+  overflow-y: auto;
+  border-right: 1px solid var(--line);
+  background: rgba(251, 252, 252, 0.9);
+  backdrop-filter: blur(16px);
+}
+
+.sidebar-intro {
+  padding: 28px 22px 22px;
+  border-bottom: 1px solid var(--line);
+}
+
+.eyebrow {
+  display: block;
+  color: var(--laser);
+  font-family: var(--utility);
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+
+.sidebar-intro p {
+  margin: 8px 0 0;
+  color: var(--ink-muted);
+  font-size: 12px;
+  line-height: 1.65;
+}
+
+.primary-nav {
+  display: grid;
+  padding: 14px 0;
+}
+
+.nav-item {
+  position: relative;
+  display: grid;
+  grid-template-columns: 28px minmax(0, 1fr) auto;
+  align-items: center;
+  min-height: 48px;
+  gap: 8px;
+  padding: 8px 18px 8px 22px;
+  color: var(--ink-muted);
+  font-size: 13px;
+  text-decoration: none;
+}
+
+.nav-item::before {
+  position: absolute;
+  top: 8px;
+  bottom: 8px;
+  left: 0;
+  width: 3px;
+  background: transparent;
+  content: "";
+}
+
+.nav-item:hover {
+  background: rgba(39, 166, 178, 0.06);
+  color: var(--lacquer);
+}
+
+.nav-item.is-active {
+  color: var(--lacquer);
+  font-weight: 700;
+}
+
+.nav-item.is-active::before {
+  background: var(--obi);
+}
+
+.nav-index,
+.nav-count {
+  font-family: var(--utility);
+  font-size: 9px;
+}
+
+.nav-index {
+  color: var(--aluminium-dark);
+}
+
+.nav-count {
+  min-width: 22px;
+  padding: 1px 6px;
+  border: 1px solid var(--line);
+  border-radius: 999px;
+  text-align: center;
+}
+
+.sidebar-rule {
+  margin: 18px 22px 24px;
+  padding: 16px 0 0;
+  border-top: 1px solid var(--line-strong);
+}
+
+.sidebar-rule span,
+.sidebar-rule strong {
+  display: block;
+}
+
+.sidebar-rule span {
+  color: var(--obi);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
+
+.sidebar-rule strong {
+  margin-top: 4px;
+  font-family: var(--display);
+  font-size: 17px;
+}
+
+.sidebar-rule p {
+  margin: 5px 0 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.main-content {
+  grid-area: main;
+  min-width: 0;
+}
+
+.view {
+  min-height: calc(100vh - 68px);
+}
+
+.hero {
+  position: relative;
+  display: grid;
+  min-height: 555px;
+  grid-template-columns: minmax(0, 0.88fr) minmax(390px, 1.12fr);
+  align-items: center;
+  gap: 54px;
+  overflow: hidden;
+  padding: 70px clamp(36px, 6vw, 92px) 62px;
+  background:
+    linear-gradient(120deg, rgba(255, 255, 255, 0.96), rgba(232, 240, 241, 0.86)),
+    var(--paper);
+}
+
+.hero::after {
+  position: absolute;
+  right: -160px;
+  bottom: -340px;
+  width: 720px;
+  height: 720px;
+  border: 1px solid var(--line);
+  border-radius: 50%;
+  box-shadow:
+    0 0 0 46px rgba(11, 24, 33, 0.018),
+    0 0 0 47px rgba(11, 24, 33, 0.06),
+    0 0 0 98px rgba(11, 24, 33, 0.014),
+    0 0 0 99px rgba(11, 24, 33, 0.05);
+  content: "";
+  pointer-events: none;
+}
+
+.hero-copy {
+  position: relative;
+  z-index: 2;
+  max-width: 620px;
+}
+
+.hero h1,
+.view-header h1 {
+  margin: 16px 0 0;
+  font-family: var(--display);
+  font-weight: 700;
+  letter-spacing: -0.045em;
+  line-height: 1.18;
+}
+
+.hero h1 {
+  font-size: clamp(44px, 5vw, 76px);
+}
+
+.hero-lede {
+  max-width: 580px;
+  margin: 28px 0 0;
+  color: var(--ink-muted);
+  font-size: 16px;
+  line-height: 1.85;
+}
+
+.hero-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 22px;
+  margin-top: 34px;
+}
+
+.primary-action,
+.secondary-action,
+.danger-action,
+.text-action {
+  display: inline-flex;
+  min-height: 42px;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  cursor: pointer;
+  font-weight: 700;
+  text-decoration: none;
+}
+
+.primary-action {
+  padding: 10px 20px;
+  background: var(--lacquer);
+  color: white;
+  box-shadow: 6px 6px 0 var(--obi);
+}
+
+.primary-action:hover {
+  transform: translate(-1px, -1px);
+  box-shadow: 8px 8px 0 var(--obi);
+}
+
+.text-action {
+  position: relative;
+  min-height: auto;
+  padding: 4px 0;
+}
+
+.text-action::after {
+  position: absolute;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  height: 1px;
+  background: var(--lacquer);
+  content: "";
+}
+
+.disc-map {
+  position: relative;
+  z-index: 2;
+  width: min(43vw, 510px);
+  aspect-ratio: 1;
+  justify-self: center;
+}
+
+.disc-map__grooves {
+  position: absolute;
+  inset: 10%;
+  border: 1px solid rgba(11, 24, 33, 0.2);
+  border-radius: 50%;
+  background:
+    radial-gradient(circle, var(--paper) 0 7%, var(--lacquer) 7.3% 9%, transparent 9.4% 18%, rgba(11, 24, 33, 0.2) 18.3% 18.6%, transparent 19% 30%, rgba(11, 24, 33, 0.11) 30.3% 30.6%, transparent 31% 44%, rgba(11, 24, 33, 0.12) 44.3% 44.6%, transparent 45%),
+    conic-gradient(from -18deg, var(--obi) 0 12%, #f0b0c5 12% 26%, var(--laser) 26% 42%, #88c9ce 42% 58%, #d2b85c 58% 72%, #92b8af 72% 86%, var(--aluminium) 86% 100%);
+  box-shadow:
+    inset 0 0 60px rgba(255, 255, 255, 0.75),
+    0 26px 50px rgba(11, 24, 33, 0.18);
+}
+
+.disc-map__grooves::before,
+.disc-map__grooves::after {
+  position: absolute;
+  border-radius: 50%;
+  content: "";
+}
+
+.disc-map__grooves::before {
+  inset: 13%;
+  border: 1px solid rgba(11, 24, 33, 0.15);
+  box-shadow:
+    0 0 0 9px rgba(255, 255, 255, 0.08),
+    0 0 0 10px rgba(11, 24, 33, 0.08),
+    0 0 0 30px rgba(255, 255, 255, 0.05),
+    0 0 0 31px rgba(11, 24, 33, 0.07);
+}
+
+.disc-map__grooves::after {
+  inset: 43%;
+  border: 7px solid var(--paper);
+  background: var(--lacquer);
+}
+
+.disc-map__label {
+  position: absolute;
+  z-index: 2;
+  inset: 39%;
+  display: grid;
+  place-content: center;
+  color: white;
+  pointer-events: none;
+  text-align: center;
+}
+
+.disc-map__label strong {
+  font-family: var(--display);
+  font-size: 28px;
+  line-height: 1;
+}
+
+.disc-map__label span {
+  margin-top: 4px;
+  font-size: 9px;
+}
+
+.disc-map__stages {
+  position: absolute;
+  inset: 0;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.disc-stage {
+  position: absolute;
+  display: grid;
+  width: 54px;
+  height: 28px;
+  place-items: center;
+  border: 1px solid var(--line-strong);
+  background: rgba(251, 252, 252, 0.92);
+  box-shadow: 0 8px 18px rgba(11, 24, 33, 0.08);
+  color: var(--lacquer);
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.disc-stage--1 {
+  top: 2%;
+  left: 45%;
+}
+
+.disc-stage--2 {
+  top: 19%;
+  right: 2%;
+}
+
+.disc-stage--3 {
+  top: 55%;
+  right: -2%;
+}
+
+.disc-stage--4 {
+  right: 19%;
+  bottom: 3%;
+}
+
+.disc-stage--5 {
+  bottom: 3%;
+  left: 17%;
+}
+
+.disc-stage--6 {
+  top: 55%;
+  left: -2%;
+}
+
+.disc-stage--7 {
+  top: 19%;
+  left: 2%;
+}
+
+.outcome-strip {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  border-top: 1px solid var(--line-strong);
+  border-bottom: 1px solid var(--line-strong);
+  background: var(--lacquer);
+  color: white;
+}
+
+.outcome-strip article {
+  display: grid;
+  min-height: 132px;
+  grid-template-columns: auto minmax(0, 1fr);
+  align-items: center;
+  gap: 17px;
+  padding: 24px clamp(24px, 3vw, 48px);
+}
+
+.outcome-strip article + article {
+  border-left: 1px solid rgba(255, 255, 255, 0.14);
+}
+
+.outcome-value {
+  color: var(--obi);
+  font-family: var(--display);
+  font-size: 42px;
+  font-weight: 700;
+  line-height: 1;
+}
+
+.outcome-strip strong {
+  display: block;
+  font-size: 13px;
+}
+
+.outcome-strip p {
+  margin: 4px 0 0;
+  color: rgba(255, 255, 255, 0.56);
+  font-size: 11px;
+  line-height: 1.55;
+}
+
+.section-heading {
+  display: grid;
+  grid-template-columns: minmax(0, 0.8fr) minmax(320px, 0.6fr);
+  align-items: end;
+  gap: 42px;
+  padding: 80px clamp(30px, 6vw, 92px) 38px;
+}
+
+.section-heading--compact {
+  padding: 0 0 34px;
+}
+
+.section-heading h2,
+.test-contract h2 {
+  margin: 8px 0 0;
+  font-family: var(--display);
+  font-size: clamp(30px, 3.3vw, 50px);
+  letter-spacing: -0.035em;
+  line-height: 1.25;
+}
+
+.section-heading > p {
+  max-width: 580px;
+  margin: 0;
+  color: var(--ink-muted);
+  font-size: 13px;
+}
+
+.stage-ledger {
+  padding: 0 clamp(30px, 6vw, 92px) 90px;
+}
+
+.stage-card {
+  position: relative;
+  border-top: 1px solid var(--line-strong);
+  background: rgba(251, 252, 252, 0.72);
+}
+
+.stage-card:last-child {
+  border-bottom: 1px solid var(--line-strong);
+}
+
+.stage-card::before {
+  position: absolute;
+  top: -1px;
+  left: 0;
+  width: 74px;
+  height: 3px;
+  background: var(--laser);
+  content: "";
+}
+
+.stage-card--authority::before {
+  background: var(--obi);
+}
+
+.stage-card--safe::before {
+  background: var(--verified);
+}
+
+.stage-card > header {
+  display: grid;
+  grid-template-columns: 54px minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 18px;
+  padding: 27px 24px 20px;
+}
+
+.stage-number {
+  color: var(--aluminium-dark);
+  font-family: var(--utility);
+  font-size: 11px;
+}
+
+.stage-kicker {
+  display: block;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.stage-card h3 {
+  margin: 3px 0 0;
+  font-family: var(--display);
+  font-size: 23px;
+  line-height: 1.3;
+}
+
+.status-tag {
+  padding: 4px 8px;
+  border: 1px solid currentColor;
+  font-family: var(--utility);
+  font-size: 9px;
+  white-space: nowrap;
+}
+
+.status-tag--done {
+  color: var(--verified);
+}
+
+.status-tag--partial {
+  color: var(--caution);
+}
+
+.stage-columns {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  border-top: 1px solid var(--line);
+}
+
+.stage-columns > div {
+  min-height: 155px;
+  padding: 24px;
+}
+
+.stage-columns > div + div {
+  border-left: 1px solid var(--line);
+}
+
+.stage-columns h4,
+.target-cell h4 {
+  margin: 0;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
+
+.stage-columns p {
+  margin: 10px 0 0;
+  font-size: 13px;
+  line-height: 1.75;
+}
+
+.target-cell {
+  background: rgba(39, 166, 178, 0.07);
+}
+
+.target-cell h4 {
+  color: var(--laser);
+}
+
+.stage-card > footer {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 7px;
+  padding: 13px 24px 19px 96px;
+  border-top: 1px solid var(--line);
+}
+
+code {
+  font-family: var(--utility);
+}
+
+.stage-card > footer code {
+  padding: 2px 7px;
+  background: rgba(11, 24, 33, 0.055);
+  color: var(--ink-muted);
+  font-size: 9px;
+}
+
+.exact-text-sample {
+  display: grid;
+  grid-template-columns: auto minmax(220px, auto) minmax(0, 1fr);
+  align-items: center;
+  gap: 16px;
+  padding: 18px 24px 18px 96px;
+  border-top: 1px solid var(--line);
+  background: rgba(233, 79, 124, 0.055);
+}
+
+.exact-text-sample > span {
+  color: var(--obi);
+  font-family: var(--utility);
+  font-size: 9px;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
+
+.exact-text-sample code {
+  font-size: 15px;
+  font-weight: 700;
+}
+
+.exact-text-sample p {
+  margin: 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.stage-note {
+  display: grid;
+  grid-template-columns: 118px minmax(0, 1fr);
+  align-items: start;
+  gap: 18px;
+  padding: 16px 24px 16px 96px;
+  border-top: 1px solid var(--line);
+  background: rgba(11, 24, 33, 0.025);
+}
+
+.stage-note > span {
+  color: var(--laser);
+  font-family: var(--utility);
+  font-size: 9px;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.stage-note p {
+  margin: 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.stage-note code {
+  padding: 1px 4px;
+  background: rgba(11, 24, 33, 0.07);
+}
+
+.architecture,
+.authority-section,
+.safety-section,
+.build-matrix-section,
+.test-contract {
+  padding: 82px clamp(30px, 6vw, 92px);
+}
+
+.architecture {
+  overflow: hidden;
+  background: var(--lacquer);
+  color: white;
+}
+
+.architecture .eyebrow {
+  color: #69cbd3;
+}
+
+.architecture .section-heading > p {
+  color: rgba(255, 255, 255, 0.58);
+}
+
+.architecture-map {
+  display: grid;
+  grid-template-columns: minmax(150px, 0.8fr) minmax(90px, 0.36fr) minmax(170px, 1fr) minmax(90px, 0.36fr) minmax(220px, 1.2fr);
+  align-items: stretch;
+  gap: 0;
+}
+
+.architecture-node,
+.architecture-workers,
+.architecture-storage {
+  border: 1px solid rgba(255, 255, 255, 0.22);
+}
+
+.architecture-node {
+  display: flex;
+  min-height: 150px;
+  flex-direction: column;
+  justify-content: center;
+  padding: 22px;
+}
+
+.architecture-node--client {
+  border-top: 3px solid var(--obi);
+}
+
+.architecture-node--server {
+  border-top: 3px solid var(--laser);
+}
+
+.architecture-map span {
+  color: rgba(255, 255, 255, 0.5);
+  font-family: var(--utility);
+  font-size: 9px;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+}
+
+.architecture-map strong {
+  display: block;
+  margin-top: 4px;
+  font-family: var(--display);
+  font-size: 19px;
+}
+
+.architecture-map p {
+  margin: 7px 0 0;
+  color: rgba(255, 255, 255, 0.55);
+  font-size: 10px;
+}
+
+.architecture-link {
+  position: relative;
+  display: grid;
+  place-items: center;
+  text-align: center;
+}
+
+.architecture-link::before {
+  position: absolute;
+  right: 10px;
+  left: 10px;
+  height: 1px;
+  background: rgba(255, 255, 255, 0.32);
+  content: "";
+}
+
+.architecture-link::after {
+  position: absolute;
+  right: 9px;
+  width: 7px;
+  height: 7px;
+  transform: rotate(45deg);
+  border-top: 1px solid rgba(255, 255, 255, 0.55);
+  border-right: 1px solid rgba(255, 255, 255, 0.55);
+  content: "";
+}
+
+.architecture-link span {
+  position: relative;
+  z-index: 1;
+  max-width: 90px;
+  padding: 3px 5px;
+  background: var(--lacquer);
+}
+
+.architecture-workers,
+.architecture-storage {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+.architecture-workers > div,
+.architecture-storage > div {
+  display: flex;
+  min-height: 150px;
+  flex-direction: column;
+  justify-content: center;
+  padding: 16px;
+}
+
+.architecture-workers > div + div,
+.architecture-storage > div + div {
+  border-left: 1px solid rgba(255, 255, 255, 0.16);
+}
+
+.architecture-workers strong,
+.architecture-storage strong {
+  font-family: var(--body);
+  font-size: 13px;
+}
+
+.architecture-storage {
+  grid-column: 1 / -1;
+  margin-top: 52px;
+}
+
+.architecture-storage > div {
+  min-height: 96px;
+}
+
+.authority-section {
+  background: #e8eeee;
+}
+
+.authority-ladder {
+  margin: 0;
+  padding: 0;
+  border-top: 1px solid var(--line-strong);
+  list-style: none;
+}
+
+.authority-ladder li {
+  display: grid;
+  grid-template-columns: 84px minmax(0, 1fr);
+  align-items: center;
+  min-height: 96px;
+  border-bottom: 1px solid var(--line);
+}
+
+.authority-rank {
+  color: var(--obi);
+  font-family: var(--display);
+  font-size: 34px;
+  text-align: center;
+}
+
+.authority-ladder li + li .authority-rank {
+  color: var(--aluminium-dark);
+}
+
+.authority-ladder strong {
+  font-family: var(--display);
+  font-size: 18px;
+}
+
+.authority-ladder p {
+  margin: 3px 0 0;
+  color: var(--ink-muted);
+  font-size: 12px;
+}
+
+.safety-section {
+  background: var(--paper);
+}
+
+.safety-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  border-top: 1px solid var(--line-strong);
+  border-left: 1px solid var(--line);
+}
+
+.safety-grid article {
+  min-height: 235px;
+  padding: 24px;
+  border-right: 1px solid var(--line);
+  border-bottom: 1px solid var(--line);
+}
+
+.safety-index {
+  color: var(--obi);
+  font-family: var(--utility);
+  font-size: 9px;
+  font-weight: 700;
+  letter-spacing: 0.1em;
+}
+
+.safety-grid h3 {
+  margin: 13px 0 0;
+  font-family: var(--display);
+  font-size: 20px;
+}
+
+.safety-grid p {
+  margin: 8px 0 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.safety-grid strong {
+  display: block;
+  margin-top: 16px;
+  color: var(--verified);
+  font-size: 10px;
+}
+
+.build-matrix-section {
+  background: #e8eeee;
+}
+
+.build-matrix-wrap {
+  overflow-x: auto;
+  border: 1px solid var(--line-strong);
+  background: rgba(251, 252, 252, 0.7);
+}
+
+.build-matrix {
+  width: 100%;
+  min-width: 920px;
+  border-collapse: collapse;
+  font-size: 11px;
+}
+
+.build-matrix th,
+.build-matrix td {
+  padding: 14px 16px;
+  border-right: 1px solid var(--line);
+  border-bottom: 1px solid var(--line);
+  text-align: left;
+  vertical-align: top;
+}
+
+.build-matrix th:last-child,
+.build-matrix td:last-child {
+  border-right: 0;
+}
+
+.build-matrix tbody tr:last-child td {
+  border-bottom: 0;
+}
+
+.build-matrix th {
+  background: var(--lacquer);
+  color: rgba(255, 255, 255, 0.62);
+  font-family: var(--utility);
+  font-size: 8px;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+}
+
+.build-matrix td:first-child {
+  font-weight: 700;
+}
+
+.build-matrix td:nth-child(2) {
+  color: var(--ink-muted);
+}
+
+.build-matrix code {
+  font-size: 9px;
+}
+
+.matrix-state {
+  display: inline-block;
+  padding: 2px 6px;
+  border: 1px solid currentColor;
+  font-family: var(--utility);
+  font-size: 8px;
+  white-space: nowrap;
+}
+
+.matrix-state--done {
+  color: var(--verified);
+}
+
+.matrix-state--pending {
+  color: var(--caution);
+}
+
+.test-contract {
+  display: grid;
+  grid-template-columns: minmax(220px, 0.62fr) minmax(0, 1.38fr);
+  gap: 64px;
+  background: var(--paper);
+}
+
+.test-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  border-top: 1px solid var(--line-strong);
+  border-bottom: 1px solid var(--line-strong);
+}
+
+.test-grid article {
+  padding: 22px;
+}
+
+.test-grid article + article {
+  border-left: 1px solid var(--line);
+}
+
+.test-grid span {
+  color: var(--laser);
+  font-family: var(--utility);
+  font-size: 9px;
+  text-transform: uppercase;
+}
+
+.test-grid strong {
+  display: block;
+  margin-top: 6px;
+  font-size: 13px;
+}
+
+.test-grid p {
+  margin: 8px 0 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.view-header {
+  display: flex;
+  min-height: 230px;
+  align-items: end;
+  justify-content: space-between;
+  gap: 32px;
+  padding: 48px clamp(30px, 6vw, 92px) 36px;
+  border-bottom: 1px solid var(--line-strong);
+  background: var(--paper);
+}
+
+.view-header h1 {
+  font-size: clamp(38px, 5vw, 64px);
+}
+
+.view-header p {
+  max-width: 620px;
+  margin: 12px 0 0;
+  color: var(--ink-muted);
+}
+
+.view-header__actions {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  gap: 12px;
+}
+
+.secondary-action,
+.danger-action {
+  padding: 9px 15px;
+  border: 1px solid var(--line-strong);
+  background: transparent;
+}
+
+.secondary-action:hover {
+  border-color: var(--laser);
+  background: rgba(39, 166, 178, 0.08);
+}
+
+.danger-action {
+  color: var(--danger);
+}
+
+.danger-action:hover {
+  border-color: var(--danger);
+  background: rgba(179, 61, 69, 0.06);
+}
+
+.queue-summary {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+  border-bottom: 1px solid var(--line-strong);
+  background: var(--lacquer);
+  color: white;
+}
+
+.queue-summary:empty {
+  display: none;
+}
+
+.summary-cell {
+  min-height: 92px;
+  padding: 18px 24px;
+}
+
+.summary-cell + .summary-cell {
+  border-left: 1px solid rgba(255, 255, 255, 0.14);
+}
+
+.summary-cell span,
+.summary-cell strong {
+  display: block;
+}
+
+.summary-cell span {
+  color: rgba(255, 255, 255, 0.52);
+  font-family: var(--utility);
+  font-size: 9px;
+  text-transform: uppercase;
+}
+
+.summary-cell strong {
+  margin-top: 4px;
+  color: var(--obi);
+  font-family: var(--display);
+  font-size: 25px;
+}
+
+.data-surface,
+.artist-layout {
+  margin: 34px clamp(30px, 6vw, 92px) 80px;
+  border: 1px solid var(--line-strong);
+  background: rgba(251, 252, 252, 0.8);
+}
+
+.queue-row {
+  display: grid;
+  grid-template-columns: minmax(210px, 1fr) 150px 140px 110px;
+  align-items: center;
+  min-height: 76px;
+  gap: 18px;
+  padding: 13px 20px;
+  border: 0;
+  border-bottom: 1px solid var(--line);
+  background: transparent;
+  cursor: pointer;
+  text-align: left;
+}
+
+.queue-row:last-child {
+  border-bottom: 0;
+}
+
+.queue-row:hover {
+  background: rgba(39, 166, 178, 0.055);
+}
+
+.queue-row__id {
+  overflow: hidden;
+  font-family: var(--utility);
+  font-size: 11px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.queue-row__state {
+  font-weight: 700;
+}
+
+.queue-row__time,
+.queue-row__revision {
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 10px;
+}
+
+.empty-state,
+.loading-state,
+.error-state {
+  display: grid;
+  min-height: 210px;
+  place-content: center;
+  padding: 36px;
+  text-align: center;
+}
+
+.empty-state strong,
+.loading-state strong,
+.error-state strong {
+  font-family: var(--display);
+  font-size: 18px;
+}
+
+.empty-state p,
+.loading-state p,
+.error-state p {
+  max-width: 460px;
+  margin: 6px auto 0;
+  color: var(--ink-muted);
+  font-size: 12px;
+}
+
+.error-state strong {
+  color: var(--danger);
+}
+
+.detail-drawer {
+  position: fixed;
+  z-index: 60;
+  top: 68px;
+  right: 0;
+  bottom: 0;
+  width: min(720px, calc(100vw - 242px));
+  overflow-y: auto;
+  border-left: 1px solid var(--line-strong);
+  background: var(--paper);
+  box-shadow: -22px 0 60px rgba(11, 24, 33, 0.18);
+}
+
+.drawer-close {
+  position: sticky;
+  z-index: 1;
+  top: 0;
+  width: 100%;
+  padding: 13px 22px;
+  border: 0;
+  border-bottom: 1px solid var(--line);
+  background: rgba(251, 252, 252, 0.96);
+  cursor: pointer;
+  font-size: 12px;
+  text-align: right;
+}
+
+.drawer-content {
+  padding: 32px clamp(24px, 5vw, 54px) 60px;
+}
+
+.drawer-content h2 {
+  margin: 8px 0 0;
+  font-family: var(--display);
+  font-size: 32px;
+}
+
+.drawer-metadata {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  margin: 28px 0;
+  border-top: 1px solid var(--line-strong);
+  border-bottom: 1px solid var(--line-strong);
+}
+
+.drawer-metadata div {
+  padding: 14px 0;
+}
+
+.drawer-metadata div:nth-child(even) {
+  padding-left: 18px;
+  border-left: 1px solid var(--line);
+}
+
+.drawer-metadata span,
+.drawer-metadata strong {
+  display: block;
+}
+
+.drawer-metadata span {
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 9px;
+  text-transform: uppercase;
+}
+
+.drawer-metadata strong {
+  margin-top: 3px;
+  font-size: 12px;
+}
+
+.candidate-list {
+  display: grid;
+  gap: 9px;
+  margin-top: 18px;
+}
+
+.candidate-row {
+  padding: 14px 16px;
+  border: 1px solid var(--line);
+  background: white;
+}
+
+.candidate-row__head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 14px;
+}
+
+.candidate-row__field {
+  font-family: var(--utility);
+  font-size: 10px;
+}
+
+.candidate-row__decision {
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 9px;
+}
+
+.candidate-row__value {
+  margin-top: 8px;
+  overflow-wrap: anywhere;
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.candidate-row__source {
+  margin-top: 4px;
+  color: var(--ink-muted);
+  font-size: 10px;
+  overflow-wrap: anywhere;
+}
+
+.review-actions {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 16px 0 18px;
+  border-bottom: 1px solid var(--line);
+}
+
+.review-actions p {
+  margin: 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+  line-height: 1.6;
+}
+
+.missing-fields {
+  padding: 12px 0;
+  border-bottom: 1px solid var(--line);
+  color: var(--ink-muted);
+  font-size: 10px;
+}
+
+.missing-fields summary {
+  cursor: pointer;
+  font-family: var(--utility);
+  font-weight: 700;
+}
+
+.missing-fields ul {
+  display: grid;
+  gap: 5px;
+  margin: 10px 0 0;
+  padding-left: 18px;
+}
+
+.candidate-editor {
+  border-bottom: 1px solid var(--line);
+}
+
+.candidate-editor > summary {
+  padding: 14px 0;
+  cursor: pointer;
+  font-family: var(--utility);
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.review-form {
+  display: grid;
+  gap: 14px;
+  padding: 18px;
+  border: 1px solid var(--line);
+  background: rgba(255, 255, 255, 0.72);
+}
+
+.review-form--configuration {
+  margin-top: 14px;
+}
+
+.candidate-editor .review-form {
+  margin-bottom: 18px;
+}
+
+.review-form__heading strong {
+  font-family: var(--display);
+  font-size: 17px;
+}
+
+.review-form__heading p {
+  margin: 4px 0 0;
+  color: var(--ink-muted);
+  font-size: 10px;
+}
+
+.review-form__grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 11px;
+}
+
+.review-form__grid--path {
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+}
+
+.review-form__field {
+  display: grid;
+  min-width: 0;
+  gap: 5px;
+}
+
+.review-form__field > span {
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 9px;
+  font-weight: 700;
+}
+
+.review-form__field > small {
+  color: var(--ink-muted);
+  font-size: 9px;
+}
+
+.review-form input,
+.review-form select,
+.review-form textarea {
+  width: 100%;
+  min-width: 0;
+  padding: 8px 9px;
+  border: 1px solid var(--line-strong);
+  border-radius: 0;
+  background: white;
+  color: var(--lacquer);
+}
+
+.review-form input,
+.review-form select {
+  min-height: 39px;
+}
+
+.review-form textarea {
+  resize: vertical;
+}
+
+.review-form__value {
+  min-width: 0;
+}
+
+.review-form__absent {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  color: var(--ink-muted);
+  font-size: 10px;
+}
+
+.review-form__absent input {
+  width: auto;
+  min-height: auto;
+}
+
+.review-form > .primary-action {
+  justify-self: start;
+}
+
+.review-form :disabled {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+
+.candidate-row__actions {
+  display: flex;
+  gap: 8px;
+  margin-top: 12px;
+  padding-top: 10px;
+  border-top: 1px solid var(--line);
+}
+
+.candidate-action {
+  min-height: 32px;
+  padding: 6px 12px;
+  border: 1px solid var(--line-strong);
+  background: transparent;
+  cursor: pointer;
+  font-size: 10px;
+  font-weight: 700;
+}
+
+.candidate-action--accept {
+  color: var(--verified);
+}
+
+.candidate-action--accept:hover {
+  border-color: var(--verified);
+  background: rgba(31, 123, 93, 0.07);
+}
+
+.candidate-action--reject {
+  color: var(--danger);
+}
+
+.candidate-action--reject:hover {
+  border-color: var(--danger);
+  background: rgba(179, 61, 69, 0.06);
+}
+
+.review-actions button:disabled,
+.candidate-action:disabled {
+  opacity: 0.48;
+  cursor: not-allowed;
+  transform: none;
+  box-shadow: none;
+}
+
+.drawer-content[aria-busy="true"] button {
+  cursor: wait;
+}
+
+.search-bar {
+  display: grid;
+  grid-template-columns: auto minmax(180px, 420px) auto;
+  align-items: end;
+  justify-content: start;
+  gap: 10px;
+  padding: 24px clamp(30px, 6vw, 92px) 0;
+}
+
+.search-bar label {
+  align-self: center;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 10px;
+}
+
+.search-bar input,
+.session-dialog input,
+.session-dialog select,
+.session-dialog textarea {
+  width: 100%;
+  min-width: 0;
+  min-height: 42px;
+  padding: 8px 12px;
+  border: 1px solid var(--line-strong);
+  border-radius: 0;
+  background: white;
+  color: var(--lacquer);
+}
+
+.session-dialog textarea {
+  resize: vertical;
+}
+
+.search-bar button {
+  min-height: 42px;
+  padding: 8px 16px;
+  border: 0;
+  background: var(--lacquer);
+  color: white;
+  cursor: pointer;
+  font-weight: 700;
+}
+
+.artist-layout {
+  display: grid;
+  min-height: 480px;
+  grid-template-columns: 260px minmax(0, 1fr);
+}
+
+.artist-index {
+  border-right: 1px solid var(--line-strong);
+}
+
+.artist-button {
+  display: grid;
+  width: 100%;
+  grid-template-columns: minmax(0, 1fr) auto;
+  align-items: center;
+  gap: 10px;
+  padding: 13px 16px;
+  border: 0;
+  border-bottom: 1px solid var(--line);
+  background: transparent;
+  cursor: pointer;
+  text-align: left;
+}
+
+.artist-button:hover,
+.artist-button.is-active {
+  background: rgba(39, 166, 178, 0.08);
+}
+
+.artist-button strong {
+  overflow: hidden;
+  font-size: 12px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.artist-button span {
+  color: var(--aluminium-dark);
+  font-family: var(--utility);
+  font-size: 9px;
+}
+
+.collection-sheet {
+  min-width: 0;
+  overflow-x: auto;
+}
+
+.collection-heading {
+  display: flex;
+  align-items: end;
+  justify-content: space-between;
+  gap: 24px;
+  padding: 24px;
+  border-bottom: 1px solid var(--line-strong);
+}
+
+.collection-heading h2 {
+  margin: 0;
+  font-family: var(--display);
+  font-size: 26px;
+}
+
+.collection-heading p {
+  margin: 3px 0 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.collection-summary {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+}
+
+.collection-summary span {
+  padding: 3px 7px;
+  border: 1px solid var(--line);
+  font-family: var(--utility);
+  font-size: 9px;
+}
+
+.collection-heading__actions {
+  display: grid;
+  justify-items: end;
+  gap: 12px;
+}
+
+.catalog-sync-panel {
+  display: grid;
+  min-width: 0;
+  gap: 16px;
+  padding: 20px 24px 24px;
+  overflow: hidden;
+  border-bottom: 1px solid var(--line-strong);
+  background:
+    linear-gradient(90deg, rgba(39, 166, 178, 0.055), transparent 44%),
+    rgba(11, 24, 33, 0.018);
+}
+
+.catalog-sync-heading {
+  display: flex;
+  min-width: 0;
+  align-items: start;
+  justify-content: space-between;
+  gap: 24px;
+}
+
+.catalog-sync-heading > * {
+  min-width: 0;
+}
+
+.catalog-sync-heading h3 {
+  margin: 0;
+  font-family: var(--display);
+  font-size: 20px;
+}
+
+.catalog-sync-heading p {
+  max-width: 620px;
+  margin: 4px 0 0;
+  color: var(--ink-muted);
+  font-size: 10px;
+}
+
+.catalog-sync-intro,
+.catalog-source-contract {
+  margin: 0;
+  padding: 10px 12px;
+  border-left: 3px solid var(--laser);
+  background: rgba(39, 166, 178, 0.065);
+  color: var(--ink-muted);
+  font-size: 10px;
+  line-height: 1.65;
+}
+
+.catalog-source-contract {
+  border-left-color: var(--obi);
+  background: rgba(233, 79, 124, 0.055);
+}
+
+.catalog-sync-grid {
+  display: grid;
+  min-width: 0;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 280px), 1fr));
+  gap: 12px;
+}
+
+.catalog-sync-grid > .empty-state,
+.catalog-sync-grid > .loading-state,
+.catalog-sync-grid > .error-state {
+  min-height: 138px;
+  grid-column: 1 / -1;
+  padding: 24px;
+  border: 1px solid var(--line);
+  background: rgba(255, 255, 255, 0.54);
+}
+
+.catalog-source-card {
+  position: relative;
+  display: grid;
+  min-width: 0;
+  align-content: start;
+  gap: 13px;
+  padding: 16px;
+  border: 1px solid var(--line-strong);
+  background: rgba(255, 255, 255, 0.9);
+}
+
+.catalog-source-card::before {
+  position: absolute;
+  top: -1px;
+  right: -1px;
+  left: -1px;
+  height: 2px;
+  background: linear-gradient(90deg, var(--laser), rgba(39, 166, 178, 0.08) 72%);
+  content: "";
+}
+
+.catalog-source-card__header,
+.catalog-run-row__header {
+  display: flex;
+  min-width: 0;
+  align-items: start;
+  justify-content: space-between;
+  gap: 10px;
+}
+
+.catalog-source-card__header > *,
+.catalog-run-row__header > * {
+  min-width: 0;
+}
+
+.catalog-source-card__header h4 {
+  margin: 0;
+  font-size: 13px;
+}
+
+.catalog-source-card__header p {
+  margin: 2px 0 0;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  overflow-wrap: anywhere;
+}
+
+.catalog-source-meta {
+  display: grid;
+  min-width: 0;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 8px 12px;
+  padding: 10px 0;
+  border-top: 1px solid var(--line);
+  border-bottom: 1px solid var(--line);
+}
+
+.catalog-source-meta > * {
+  min-width: 0;
+  margin: 0;
+}
+
+.catalog-source-meta dt,
+.catalog-source-meta span {
+  display: block;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+
+.catalog-source-meta dd,
+.catalog-source-meta strong,
+.catalog-source-meta code,
+.catalog-source-meta time {
+  display: block;
+  min-width: 0;
+  margin: 2px 0 0;
+  color: var(--lacquer);
+  font-family: var(--utility);
+  font-size: 9px;
+  font-weight: 600;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+  white-space: normal;
+}
+
+.catalog-provisioning-pill {
+  display: inline-flex;
+  max-width: 100%;
+  flex: 0 1 auto;
+  align-items: center;
+  padding: 2px 7px;
+  border: 1px solid var(--line);
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  font-weight: 700;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+}
+
+.catalog-provisioning-pill--ready-to-queue {
+  border-color: rgba(47, 136, 104, 0.48);
+  background: rgba(47, 136, 104, 0.06);
+  color: var(--verified);
+}
+
+.catalog-provisioning-pill--disabled {
+  border-color: rgba(134, 151, 158, 0.52);
+  background: rgba(134, 151, 158, 0.08);
+  color: var(--ink-muted);
+}
+
+.catalog-provisioning-pill--credential-not-configured {
+  border-color: rgba(185, 140, 44, 0.5);
+  background: rgba(185, 140, 44, 0.065);
+  color: #8b671b;
+}
+
+.catalog-provisioning-pill--credential-binding-invalid {
+  border-color: rgba(179, 61, 69, 0.5);
+  background: rgba(179, 61, 69, 0.055);
+  color: var(--danger);
+}
+
+.catalog-provisioning-pill--adapter-unavailable {
+  border-color: rgba(83, 101, 109, 0.5);
+  background: rgba(83, 101, 109, 0.065);
+  color: var(--ink-muted);
+}
+
+.catalog-run-history {
+  display: grid;
+  min-width: 0;
+  gap: 7px;
+}
+
+.catalog-run-history > h4,
+.catalog-run-history > h5,
+.catalog-run-history > header {
+  margin: 0;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.catalog-run-row {
+  min-width: 0;
+  padding: 8px 9px;
+  border-left: 2px solid var(--aluminium-dark);
+  background: rgba(11, 24, 33, 0.035);
+}
+
+.catalog-run-row__header {
+  align-items: baseline;
+  color: var(--lacquer);
+  font-family: var(--utility);
+  font-size: 8px;
+  font-weight: 700;
+}
+
+.catalog-run-row__header code,
+.catalog-run-row__header time {
+  min-width: 0;
+  color: inherit;
+  font: inherit;
+  overflow-wrap: anywhere;
+  white-space: normal;
+}
+
+.catalog-run-row__header time {
+  color: var(--ink-muted);
+  font-weight: 400;
+  text-align: right;
+}
+
+.catalog-run-detail {
+  margin: 4px 0 0;
+  color: var(--ink-muted);
+  font-size: 9px;
+  line-height: 1.55;
+  overflow-wrap: anywhere;
+}
+
+.catalog-run-id {
+  display: block;
+  min-width: 0;
+  margin-top: 3px;
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  overflow-wrap: anywhere;
+}
+
+.catalog-action-note {
+  margin: 0;
+  padding: 7px 9px;
+  border-left: 2px solid var(--aluminium-dark);
+  background: rgba(11, 24, 33, 0.035);
+  color: var(--ink-muted);
+  font-size: 9px;
+  line-height: 1.55;
+}
+
+.catalog-source-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: auto;
+  padding-top: 2px;
+}
+
+.catalog-source-actions button {
+  min-width: 0;
+  flex: 1 1 120px;
+}
+
+.catalog-source-actions button:disabled {
+  opacity: 0.42;
+  cursor: not-allowed;
+}
+
+.catalog-source-error {
+  min-width: 0;
+  margin: 0;
+  padding: 8px 10px;
+  border-left: 2px solid var(--danger);
+  background: rgba(179, 61, 69, 0.055);
+  color: var(--danger);
+  font-size: 9px;
+  line-height: 1.55;
+  overflow-wrap: anywhere;
+}
+
+.catalog-source-error:empty {
+  display: none;
+}
+
+.catalog-sync-panel code,
+.catalog-sync-panel time {
+  max-width: 100%;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+}
+
+.release-table {
+  width: 100%;
+  min-width: 820px;
+  border-collapse: collapse;
+  font-size: 11px;
+}
+
+.release-table th,
+.release-table td {
+  padding: 12px 14px;
+  border-bottom: 1px solid var(--line);
+  text-align: left;
+  vertical-align: top;
+}
+
+.release-table th {
+  background: rgba(11, 24, 33, 0.035);
+  color: var(--ink-muted);
+  font-family: var(--utility);
+  font-size: 8px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.release-title {
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.release-subtitle {
+  display: block;
+  margin-top: 2px;
+  color: var(--ink-muted);
+  font-size: 9px;
+}
+
+.quality-pill,
+.collection-state-pill {
+  display: inline-block;
+  padding: 2px 6px;
+  border: 1px solid var(--line);
+  font-family: var(--utility);
+  font-size: 8px;
+}
+
+.collection-state-pill--published,
+.collection-state-pill--acquired {
+  border-color: rgba(47, 136, 104, 0.5);
+  color: var(--verified);
+}
+
+.collection-state-pill--missing,
+.collection-state-pill--wanted {
+  border-color: rgba(185, 140, 44, 0.5);
+  color: var(--caution);
+}
+
+.session-dialog {
+  width: min(520px, calc(100vw - 34px));
+  padding: 0;
+  border: 1px solid var(--line-strong);
+  border-radius: 0;
+  background: var(--paper);
+  box-shadow: var(--shadow);
+}
+
+.catalog-dialog {
+  width: min(620px, calc(100vw - 34px));
+  max-height: calc(100vh - 34px);
+  overflow-y: auto;
+}
+
+.session-dialog::backdrop {
+  background: rgba(11, 24, 33, 0.74);
+  backdrop-filter: blur(4px);
+}
+
+.session-dialog form {
+  display: grid;
+  gap: 13px;
+  padding: 30px;
+}
+
+.dialog-heading {
+  margin-bottom: 10px;
+}
+
+.dialog-heading h2 {
+  margin: 7px 0 0;
+  font-family: var(--display);
+  font-size: 30px;
+}
+
+.dialog-heading p {
+  margin: 6px 0 0;
+  color: var(--ink-muted);
+  font-size: 11px;
+}
+
+.session-dialog label {
+  font-size: 11px;
+  font-weight: 700;
+}
+
+.dialog-field-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 13px;
+}
+
+.dialog-field-grid label {
+  display: grid;
+  min-width: 0;
+  gap: 6px;
+}
+
+.dialog-subheading {
+  display: grid;
+  gap: 2px;
+  padding-top: 15px;
+  border-top: 1px solid var(--line);
+}
+
+.dialog-subheading strong {
+  font-family: var(--display);
+  font-size: 17px;
+}
+
+.dialog-subheading span {
+  color: var(--ink-muted);
+  font-size: 10px;
+}
+
+.release-status-toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: 11px;
+  border: 1px solid var(--line);
+  background: rgba(11, 24, 33, 0.025);
+}
+
+.release-status-toolbar > span {
+  margin-right: auto;
+}
+
+.release-status-toolbar button,
+.table-action {
+  min-height: 30px;
+  padding: 5px 9px;
+  border: 1px solid var(--line-strong);
+  background: transparent;
+  cursor: pointer;
+  font-size: 9px;
+  font-weight: 700;
+}
+
+.release-status-toolbar button:hover,
+.table-action:hover {
+  border-color: var(--laser);
+  background: rgba(39, 166, 178, 0.08);
+}
+
+.release-status-toolbar button:disabled {
+  opacity: 0.4;
+  cursor: not-allowed;
+}
+
+.dialog-checkbox {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+}
+
+.dialog-checkbox input {
+  width: auto;
+  min-height: auto;
+}
+
+.form-error {
+  min-height: 1.6em;
+  margin: 0;
+  color: var(--danger);
+  font-size: 11px;
+}
+
+.dialog-actions {
+  display: flex;
+  justify-content: space-between;
+  gap: 18px;
+  margin-top: 4px;
+}
+
+.toast-region {
+  position: fixed;
+  z-index: 90;
+  right: 18px;
+  bottom: 18px;
+  display: grid;
+  width: min(380px, calc(100vw - 36px));
+  gap: 8px;
+}
+
+.toast {
+  padding: 12px 14px;
+  border-left: 3px solid var(--laser);
+  background: var(--lacquer);
+  box-shadow: var(--shadow);
+  color: white;
+  font-size: 11px;
+}
+
+.toast--error {
+  border-left-color: #ff6a72;
+}
+
+@media (max-width: 1120px) {
+  .hero {
+    grid-template-columns: minmax(0, 1fr) minmax(320px, 0.8fr);
+    gap: 24px;
+  }
+
+  .disc-map {
+    width: min(39vw, 450px);
+  }
+
+  .architecture-map {
+    grid-template-columns: 1fr 72px 1fr;
+    row-gap: 30px;
+  }
+
+  .architecture-workers {
+    grid-column: 1 / -1;
+  }
+
+  .architecture-link--branch {
+    display: none;
+  }
+
+  .architecture-storage {
+    margin-top: 0;
+  }
+
+  .test-contract {
+    grid-template-columns: 1fr;
+    gap: 32px;
+  }
+
+  .safety-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+}
+
+@media (max-width: 980px) {
+  .app-shell {
+    grid-template:
+      "topbar" 62px
+      "main" minmax(0, 1fr) /
+      minmax(0, 1fr);
+  }
+
+  .topbar {
+    grid-template-columns: minmax(0, 1fr) auto;
+  }
+
+  .brand {
+    border-right: 0;
+  }
+
+  .server-state {
+    display: none;
+  }
+
+  .session-button {
+    min-width: 132px;
+    padding: 8px 15px;
+  }
+
+  .sidebar {
+    position: fixed;
+    z-index: 35;
+    top: auto;
+    right: 0;
+    bottom: 0;
+    left: 0;
+    display: block;
+    height: 58px;
+    overflow: visible;
+    border-top: 1px solid var(--line-strong);
+    border-right: 0;
+    background: rgba(251, 252, 252, 0.96);
+  }
+
+  .sidebar-intro,
+  .sidebar-rule {
+    display: none;
+  }
+
+  .primary-nav {
+    display: grid;
+    height: 100%;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    padding: 0;
+  }
+
+  .nav-item {
+    grid-template-columns: auto;
+    min-height: 58px;
+    justify-items: center;
+    gap: 0;
+    padding: 7px 5px;
+    font-size: 10px;
+  }
+
+  .nav-item::before {
+    top: 0;
+    right: 12px;
+    bottom: auto;
+    left: 12px;
+    width: auto;
+    height: 3px;
+  }
+
+  .nav-index,
+  .nav-count {
+    display: none;
+  }
+
+  .view {
+    min-height: calc(100vh - 120px);
+    padding-bottom: 58px;
+  }
+
+  .hero {
+    min-height: auto;
+    grid-template-columns: 1fr;
+    padding-top: 58px;
+  }
+
+  .disc-map {
+    width: min(82vw, 470px);
+    margin-top: 15px;
+  }
+
+  .outcome-strip,
+  .stage-columns {
+    grid-template-columns: 1fr;
+  }
+
+  .outcome-strip article + article,
+  .stage-columns > div + div {
+    border-top: 1px solid rgba(255, 255, 255, 0.14);
+    border-left: 0;
+  }
+
+  .stage-columns > div + div {
+    border-top-color: var(--line);
+  }
+
+  .section-heading {
+    grid-template-columns: 1fr;
+    gap: 15px;
+  }
+
+  .exact-text-sample {
+    grid-template-columns: 1fr;
+    padding-left: 24px;
+  }
+
+  .architecture-map {
+    grid-template-columns: 1fr;
+    gap: 16px;
+  }
+
+  .architecture-link {
+    min-height: 44px;
+    transform: rotate(90deg);
+  }
+
+  .architecture-node,
+  .architecture-workers,
+  .architecture-storage {
+    grid-column: 1;
+  }
+
+  .architecture-storage {
+    margin-top: 0;
+  }
+
+  .test-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .test-grid article + article {
+    border-top: 1px solid var(--line);
+    border-left: 0;
+  }
+
+  .detail-drawer {
+    top: 62px;
+    width: 100vw;
+    padding-bottom: 58px;
+  }
+
+  .artist-layout {
+    grid-template-columns: 1fr;
+  }
+
+  .artist-index {
+    max-height: 260px;
+    overflow-y: auto;
+    border-right: 0;
+    border-bottom: 1px solid var(--line-strong);
+  }
+}
+
+@media (max-width: 560px) {
+  .brand {
+    padding: 0 13px;
+  }
+
+  .brand small,
+  .session-button__label {
+    display: none;
+  }
+
+  .session-button {
+    min-width: 88px;
+  }
+
+  .hero,
+  .section-heading,
+  .architecture,
+  .authority-section,
+  .safety-section,
+  .build-matrix-section,
+  .test-contract,
+  .view-header {
+    padding-right: 20px;
+    padding-left: 20px;
+  }
+
+  .hero h1 {
+    font-size: 40px;
+  }
+
+  .disc-map {
+    width: 96%;
+  }
+
+  .disc-stage {
+    width: 46px;
+    font-size: 9px;
+  }
+
+  .outcome-strip article {
+    min-height: 108px;
+    padding: 18px 22px;
+  }
+
+  .stage-ledger {
+    padding-right: 0;
+    padding-left: 0;
+  }
+
+  .stage-card > header {
+    grid-template-columns: 34px minmax(0, 1fr);
+    padding-right: 18px;
+    padding-left: 18px;
+  }
+
+  .status-tag {
+    grid-column: 2;
+    justify-self: start;
+  }
+
+  .stage-columns > div,
+  .stage-card > footer {
+    padding-right: 18px;
+    padding-left: 18px;
+  }
+
+  .stage-card > footer {
+    padding-left: 18px;
+  }
+
+  .stage-note {
+    grid-template-columns: 1fr;
+    gap: 7px;
+    padding-right: 18px;
+    padding-left: 18px;
+  }
+
+  .architecture-workers,
+  .architecture-storage {
+    grid-template-columns: 1fr;
+  }
+
+  .architecture-workers > div,
+  .architecture-storage > div {
+    min-height: 86px;
+  }
+
+  .architecture-workers > div + div,
+  .architecture-storage > div + div {
+    border-top: 1px solid rgba(255, 255, 255, 0.16);
+    border-left: 0;
+  }
+
+  .authority-ladder li {
+    grid-template-columns: 52px minmax(0, 1fr);
+    padding: 14px 0;
+  }
+
+  .authority-rank {
+    font-size: 25px;
+  }
+
+  .safety-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .safety-grid article {
+    min-height: auto;
+  }
+
+  .queue-row {
+    grid-template-columns: minmax(0, 1fr) auto;
+  }
+
+  .queue-row__time,
+  .queue-row__revision {
+    display: none;
+  }
+
+  .data-surface,
+  .artist-layout {
+    margin-right: 12px;
+    margin-left: 12px;
+  }
+
+  .search-bar {
+    grid-template-columns: 1fr auto;
+    padding-right: 12px;
+    padding-left: 12px;
+  }
+
+  .search-bar label {
+    grid-column: 1 / -1;
+  }
+
+  .dialog-actions {
+    align-items: stretch;
+    flex-direction: column-reverse;
+  }
+
+  .view-header {
+    align-items: start;
+    flex-direction: column;
+  }
+
+  .view-header__actions {
+    justify-content: flex-start;
+  }
+
+  .collection-heading {
+    align-items: start;
+    flex-direction: column;
+  }
+
+  .collection-heading__actions {
+    justify-items: start;
+  }
+
+  .catalog-sync-panel {
+    gap: 14px;
+    padding: 18px 14px 20px;
+  }
+
+  .catalog-sync-heading {
+    display: grid;
+    gap: 12px;
+  }
+
+  .catalog-sync-heading button,
+  .catalog-source-actions button {
+    width: 100%;
+  }
+
+  .catalog-sync-grid,
+  .catalog-source-meta {
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .catalog-source-card {
+    padding: 14px;
+  }
+
+  .catalog-source-card__header,
+  .catalog-run-row__header {
+    align-items: start;
+    flex-direction: column;
+  }
+
+  .catalog-run-row__header time {
+    text-align: left;
+  }
+
+  .catalog-source-actions {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+  }
+
+  .dialog-field-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .review-form__grid,
+  .review-form__grid--path {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  html {
+    scroll-behavior: auto;
+  }
+
+  *,
+  *::before,
+  *::after {
+    scroll-behavior: auto !important;
+    transition-duration: 0.01ms !important;
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+  }
+}
diff --git a/annim/Cargo.toml b/annim/Cargo.toml
index d894730f..97667106 100644
--- a/annim/Cargo.toml
+++ b/annim/Cargo.toml
@@ -8,7 +8,19 @@ authors.workspace = true
 repository.workspace = true
 
 [dependencies]
-tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "sync"] }
+anni-catalog.workspace = true
+anni-cover-worker.workspace = true
+anni-ingest.workspace = true
+anni-metadata.workspace = true
+tokio = { version = "1", features = [
+    "macros",
+    "net",
+    "rt-multi-thread",
+    "signal",
+    "sync",
+    "time",
+] }
+tokio-stream = { version = "0.1.18", features = ["sync"] }
 axum.workspace = true
 tower-http = { version = "0.7.0", features = ["cors"] }
 async-graphql = { version = "7.2.1", features = [
@@ -34,8 +46,12 @@ anyhow.workspace = true
 tracing = { version = "0.1.44" }
 tracing-subscriber = { version = "0.3.23" }
 serde_json.workspace = true
+sha2 = "0.10.9"
+constant_time_eq = "0.4.2"
 chrono = "0.4.45"
 serde.workspace = true
+thiserror.workspace = true
+url = "2.5.8"
 
 # Search
 tantivy = "0.25.0"
@@ -45,6 +61,9 @@ lindera-tantivy = { version = "4.0.0", features = ["embed-ipadic"] }
 rmp-serde = "1.3.1"
 base64 = "0.22.1"
 
+[dev-dependencies]
+tower = { version = "0.5", features = ["util"] }
+
 [features]
 default = ["postgres"]
 sqlite = ["sea-orm/sqlx-sqlite", "sea-orm-migration/sqlx-sqlite"]
diff --git a/annim/src/auth.rs b/annim/src/auth.rs
index a8684222..2dc99049 100644
--- a/annim/src/auth.rs
+++ b/annim/src/auth.rs
@@ -1,52 +1,171 @@
-use std::sync::LazyLock;
+use std::{fmt, sync::Arc};
 
-/// https://github.com/async-graphql/examples/blob/0c4e5e29e97a41c8877c126cbcefb82721ae81af/models/token/src/lib.rs
 use async_graphql::{Data, Result};
+use constant_time_eq::constant_time_eq_32;
 use serde::Deserialize;
+use sha2::{Digest as _, Sha256};
+use thiserror::Error;
 
-static TOKEN: LazyLock<String> =
-    LazyLock::new(|| std::env::var("ANNIM_AUTH_TOKEN").unwrap_or_else(|_| "114514".to_string()));
+const MINIMUM_TOKEN_LENGTH: usize = 32;
 
-pub struct AuthToken(String);
+#[derive(Clone)]
+pub struct AuthConfig {
+    expected_digest: Arc<[u8; 32]>,
+}
+
+impl AuthConfig {
+    pub fn new(token: impl AsRef<str>) -> std::result::Result<Self, AuthConfigError> {
+        let token = token.as_ref();
+        validate_configured_token(token)?;
+        Ok(Self {
+            expected_digest: Arc::new(Sha256::digest(token.as_bytes()).into()),
+        })
+    }
+
+    pub fn from_env() -> std::result::Result<Self, AuthConfigError> {
+        Self::from_lookup(|name| std::env::var(name).ok())
+    }
 
-impl AuthToken {
-    pub fn new(token: String) -> Self {
-        Self(token)
+    pub fn from_lookup(
+        lookup: impl FnOnce(&str) -> Option<String>,
+    ) -> std::result::Result<Self, AuthConfigError> {
+        let token = lookup("ANNIM_AUTH_TOKEN").ok_or(AuthConfigError::MissingToken)?;
+        Self::new(token)
     }
 
-    pub fn is_valid(&self) -> bool {
-        self.0 == TOKEN.as_str()
+    pub fn authenticate_bearer(
+        &self,
+        authorization: &str,
+    ) -> std::result::Result<AuthenticatedAdmin, AuthenticationError> {
+        let (scheme, token) = authorization
+            .split_once(' ')
+            .ok_or(AuthenticationError::Unauthorized)?;
+        if !scheme.eq_ignore_ascii_case("Bearer")
+            || token.is_empty()
+            || token.chars().any(char::is_whitespace)
+        {
+            return Err(AuthenticationError::Unauthorized);
+        }
+        let actual: [u8; 32] = Sha256::digest(token.as_bytes()).into();
+        if constant_time_eq_32(self.expected_digest.as_ref(), &actual) {
+            Ok(AuthenticatedAdmin(()))
+        } else {
+            Err(AuthenticationError::Unauthorized)
+        }
     }
 }
 
-pub async fn on_connection_init(value: serde_json::Value) -> Result<Data> {
+impl fmt::Debug for AuthConfig {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("AuthConfig")
+            .field("expected_digest", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AuthenticatedAdmin(());
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[error("Unauthorized")]
+pub enum AuthenticationError {
+    Unauthorized,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum AuthConfigError {
+    #[error("ANNIM_AUTH_TOKEN is required")]
+    MissingToken,
+    #[error("ANNIM_AUTH_TOKEN must contain at least {MINIMUM_TOKEN_LENGTH} characters")]
+    TokenTooShort,
+    #[error("ANNIM_AUTH_TOKEN cannot contain whitespace")]
+    TokenContainsWhitespace,
+}
+
+fn validate_configured_token(token: &str) -> std::result::Result<(), AuthConfigError> {
+    if token.chars().count() < MINIMUM_TOKEN_LENGTH {
+        return Err(AuthConfigError::TokenTooShort);
+    }
+    if token.chars().any(char::is_whitespace) {
+        return Err(AuthConfigError::TokenContainsWhitespace);
+    }
+    Ok(())
+}
+
+pub async fn on_connection_init(auth: AuthConfig, value: serde_json::Value) -> Result<Data> {
     #[derive(Deserialize)]
     struct Payload {
-        token: String,
+        authorization: String,
     }
 
-    // Coerce the connection params into our `Payload` struct so we can
-    // validate the token exists in the headers.
-    if let Ok(payload) = serde_json::from_value::<Payload>(value) {
-        let mut data = Data::default();
-        data.insert(AuthToken(payload.token));
-        Ok(data)
-    } else {
-        Err("Token is required".into())
-    }
+    let payload = serde_json::from_value::<Payload>(value).map_err(|_| "Unauthorized")?;
+    let authenticated = auth
+        .authenticate_bearer(&payload.authorization)
+        .map_err(|_| "Unauthorized")?;
+    let mut data = Data::default();
+    data.insert(authenticated);
+    Ok(data)
 }
 
 pub(crate) struct AdminGuard;
 
 impl async_graphql::Guard for AdminGuard {
     async fn check(&self, ctx: &async_graphql::Context<'_>) -> async_graphql::Result<()> {
-        let token = ctx
-            .data::<AuthToken>()
-            .map_err(|_| async_graphql::Error::new("Token is required"))?;
-        if !token.is_valid() {
-            return Err(async_graphql::Error::new("Invalid token"));
-        }
+        ctx.data::<AuthenticatedAdmin>()
+            .map(|_| ())
+            .map_err(|_| async_graphql::Error::new("Unauthorized"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+
+    #[test]
+    fn auth_config_requires_an_explicit_strong_token() {
+        assert!(matches!(
+            AuthConfig::from_lookup(|_| None),
+            Err(AuthConfigError::MissingToken)
+        ));
+        assert!(matches!(
+            AuthConfig::new("too-short"),
+            Err(AuthConfigError::TokenTooShort)
+        ));
+        assert!(matches!(
+            AuthConfig::new("0123456789abcdef 0123456789abcdef"),
+            Err(AuthConfigError::TokenContainsWhitespace)
+        ));
+        AuthConfig::new(TOKEN).unwrap();
+    }
+
+    #[test]
+    fn bearer_authentication_is_strict_and_debug_is_redacted() {
+        let auth = AuthConfig::new(TOKEN).unwrap();
+        assert!(auth.authenticate_bearer(&format!("Bearer {TOKEN}")).is_ok());
+        assert!(auth.authenticate_bearer(&format!("bearer {TOKEN}")).is_ok());
+        assert!(auth.authenticate_bearer(TOKEN).is_err());
+        assert!(auth.authenticate_bearer("Bearer wrong-token").is_err());
+        let debug = format!("{auth:?}");
+        assert!(debug.contains("[REDACTED]"));
+        assert!(!debug.contains(TOKEN));
+    }
 
-        Ok(())
+    #[tokio::test]
+    async fn websocket_init_uses_the_same_bearer_contract() {
+        let auth = AuthConfig::new(TOKEN).unwrap();
+        let accepted = on_connection_init(
+            auth.clone(),
+            serde_json::json!({ "authorization": format!("Bearer {TOKEN}") }),
+        )
+        .await;
+        assert!(accepted.is_ok());
+        assert!(
+            on_connection_init(auth, serde_json::json!({ "token": TOKEN }))
+                .await
+                .is_err()
+        );
     }
 }
diff --git a/annim/src/bin/cover-worker.rs b/annim/src/bin/cover-worker.rs
new file mode 100644
index 00000000..1633f6a6
--- /dev/null
+++ b/annim/src/bin/cover-worker.rs
@@ -0,0 +1,176 @@
+use std::{path::PathBuf, time::Duration};
+
+use anni_cover_worker::{AssetStore, CoverDownloader};
+use annim::{
+    cover::{CoverRepository, CoverService},
+    cover_worker::{CoverWorker, CoverWorkerOutcome, CoverWorkerPolicy, SafeCoverFetcher},
+};
+use sea_orm::Database;
+use thiserror::Error;
+
+const DEFAULT_POLL_INTERVAL_SECONDS: u64 = 5;
+const MAX_POLL_INTERVAL_SECONDS: u64 = 3_600;
+
+struct WorkerConfig {
+    asset_root: PathBuf,
+    poll_interval: Duration,
+}
+
+impl WorkerConfig {
+    fn from_env() -> Result<Self, WorkerConfigError> {
+        Self::from_lookup(|name| std::env::var(name).ok())
+    }
+
+    fn from_lookup(
+        mut lookup: impl FnMut(&str) -> Option<String>,
+    ) -> Result<Self, WorkerConfigError> {
+        let asset_root = lookup("ANNIM_COVER_ASSET_ROOT")
+            .filter(|value| !value.is_empty())
+            .map(PathBuf::from)
+            .ok_or(WorkerConfigError::MissingAssetRoot)?;
+        let poll_seconds = match lookup("ANNIM_COVER_POLL_INTERVAL_SECONDS") {
+            None => DEFAULT_POLL_INTERVAL_SECONDS,
+            Some(value) => value
+                .parse::<u64>()
+                .ok()
+                .filter(|seconds| (1..=MAX_POLL_INTERVAL_SECONDS).contains(seconds))
+                .ok_or(WorkerConfigError::InvalidPollInterval)?,
+        };
+        Ok(Self {
+            asset_root,
+            poll_interval: Duration::from_secs(poll_seconds),
+        })
+    }
+}
+
+#[derive(Debug, Error)]
+enum WorkerConfigError {
+    #[error("ANNIM_COVER_ASSET_ROOT is required")]
+    MissingAssetRoot,
+    #[error("ANNIM_COVER_POLL_INTERVAL_SECONDS must be an integer between 1 and 3600")]
+    InvalidPollInterval,
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::INFO)
+        .with_test_writer()
+        .init();
+
+    let database_url = std::env::var("ANNIM_DATABASE_URL")?;
+    let config = WorkerConfig::from_env()?;
+    let database = Database::connect(database_url).await?;
+    let covers = CoverService::new(CoverRepository::new(database));
+    // `open` requires a pre-existing trusted directory and verifies its
+    // canonical location before any candidate is claimed.
+    let asset_store = AssetStore::open(&config.asset_root)?;
+    let fetcher = SafeCoverFetcher::new(CoverDownloader::default(), asset_store);
+    let worker = CoverWorker::new(covers, fetcher, CoverWorkerPolicy::default())?;
+
+    tracing::info!("Annim cover worker started");
+    loop {
+        let cycle = tokio::select! {
+            signal = tokio::signal::ctrl_c() => {
+                signal?;
+                break;
+            }
+            result = worker.run_once() => result,
+        };
+
+        let should_wait = match cycle {
+            Ok(CoverWorkerOutcome::Idle) => true,
+            Ok(CoverWorkerOutcome::Verified {
+                candidate_id,
+                attempt_count,
+            }) => {
+                tracing::info!(%candidate_id, attempt_count, "cover candidate verified");
+                false
+            }
+            Ok(CoverWorkerOutcome::RetryScheduled {
+                candidate_id,
+                attempt_count,
+                not_before,
+                problem,
+            }) => {
+                tracing::warn!(
+                    %candidate_id,
+                    attempt_count,
+                    code = problem.code(),
+                    http_status = problem.http_status(),
+                    %not_before,
+                    "cover candidate retry scheduled"
+                );
+                false
+            }
+            Ok(CoverWorkerOutcome::Rejected {
+                candidate_id,
+                attempt_count,
+                reason,
+                problem,
+            }) => {
+                tracing::warn!(
+                    %candidate_id,
+                    attempt_count,
+                    ?reason,
+                    code = problem.code(),
+                    http_status = problem.http_status(),
+                    "cover candidate rejected"
+                );
+                false
+            }
+            Err(error) => {
+                // CoverWorkerRunError has a deliberately generic Display for
+                // queue failures. Do not switch this to Debug: underlying DB
+                // diagnostics are not part of the worker log contract.
+                tracing::error!(error = %error, "cover worker cycle failed");
+                true
+            }
+        };
+
+        if should_wait {
+            tokio::select! {
+                signal = tokio::signal::ctrl_c() => {
+                    signal?;
+                    break;
+                }
+                _ = tokio::time::sleep(config.poll_interval) => {}
+            }
+        }
+    }
+    tracing::info!("Annim cover worker stopped");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn worker_configuration_is_explicit_and_bounded() {
+        assert!(matches!(
+            WorkerConfig::from_lookup(|_| None),
+            Err(WorkerConfigError::MissingAssetRoot)
+        ));
+
+        let configured = WorkerConfig::from_lookup(|name| match name {
+            "ANNIM_COVER_ASSET_ROOT" => Some("/trusted/covers".to_owned()),
+            "ANNIM_COVER_POLL_INTERVAL_SECONDS" => Some("30".to_owned()),
+            _ => None,
+        })
+        .unwrap();
+        assert_eq!(configured.asset_root, PathBuf::from("/trusted/covers"));
+        assert_eq!(configured.poll_interval, Duration::from_secs(30));
+
+        for invalid in ["0", "3601", "not-a-number"] {
+            assert!(matches!(
+                WorkerConfig::from_lookup(|name| match name {
+                    "ANNIM_COVER_ASSET_ROOT" => Some("/trusted/covers".to_owned()),
+                    "ANNIM_COVER_POLL_INTERVAL_SECONDS" => Some(invalid.to_owned()),
+                    _ => None,
+                }),
+                Err(WorkerConfigError::InvalidPollInterval)
+            ));
+        }
+    }
+}
diff --git a/annim/src/catalog/mod.rs b/annim/src/catalog/mod.rs
new file mode 100644
index 00000000..f4eb8846
--- /dev/null
+++ b/annim/src/catalog/mod.rs
@@ -0,0 +1,1264 @@
+//! Artist-centric collection catalog persistence and application service.
+//!
+//! The public snapshots intentionally omit private acquisition locators. All
+//! lifecycle writes use the release row version as the aggregate lock, even
+//! when the durable fact being added is a `collection_copy` row.
+
+mod sync;
+
+pub use sync::*;
+
+use std::{collections::HashMap, num::NonZeroU32, str::FromStr};
+
+use anni_catalog::{
+    AcquisitionSourceKind, AudioCodec, AudioProperties, CollectionState, QualityTier, ReleaseKind,
+};
+use anni_ingest::Digest;
+use sea_orm::{
+    prelude::{DateTimeUtc, Uuid},
+    sea_query::{Expr, OnConflict},
+    ActiveValue::{NotSet, Set},
+    ColumnTrait, ConnectionTrait, DatabaseConnection, DbErr, EntityTrait, QueryFilter, QueryOrder,
+    QuerySelect, TransactionTrait, TryInsertResult,
+};
+use thiserror::Error;
+
+use crate::entities::{
+    catalog_artist, catalog_release, collection_copy,
+    helper::{now, timestamp},
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct CatalogRowVersion(u64);
+
+impl CatalogRowVersion {
+    pub const INITIAL: Self = Self(1);
+
+    pub const fn new(value: u64) -> Option<Self> {
+        if value == 0 {
+            None
+        } else {
+            Some(Self(value))
+        }
+    }
+
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+
+    fn as_i64(self, entity: &'static str, id: Uuid) -> Result<i64, CatalogError> {
+        i64::try_from(self.0).map_err(|_| CatalogError::NumericOutOfRange {
+            entity,
+            id,
+            field: "row_version",
+        })
+    }
+
+    fn next(self, entity: &'static str, id: Uuid) -> Result<Self, CatalogError> {
+        self.0
+            .checked_add(1)
+            .filter(|value| i64::try_from(*value).is_ok())
+            .map(Self)
+            .ok_or(CatalogError::NumericOutOfRange {
+                entity,
+                id,
+                field: "row_version",
+            })
+    }
+}
+
+impl std::fmt::Display for CatalogRowVersion {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CatalogArtistSnapshot {
+    pub artist_id: Uuid,
+    pub display_name: String,
+    pub sort_name: Option<String>,
+    pub notes: Option<String>,
+    pub row_version: CatalogRowVersion,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CollectionCopySnapshot {
+    pub copy_id: Uuid,
+    pub source_kind: AcquisitionSourceKind,
+    pub source_label: String,
+    pub codec: AudioCodec,
+    pub sample_rate_hz: Option<NonZeroU32>,
+    pub bit_depth: Option<u8>,
+    pub channels: Option<u8>,
+    pub track_count: Option<u32>,
+    pub byte_length: Option<u64>,
+    pub manifest_digest: Option<Digest>,
+    pub quality_verified: bool,
+    pub ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub acquired_at: DateTimeUtc,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+impl CollectionCopySnapshot {
+    pub fn audio_properties(&self) -> AudioProperties {
+        AudioProperties::new(
+            self.codec,
+            self.sample_rate_hz,
+            self.bit_depth,
+            self.channels,
+        )
+        .expect("persisted collection copy was validated while loading")
+    }
+
+    pub fn quality_tier(&self) -> QualityTier {
+        self.audio_properties().quality_tier()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CatalogReleaseSnapshot {
+    pub release_id: Uuid,
+    pub artist_id: Uuid,
+    pub title: String,
+    pub edition: Option<String>,
+    pub catalog: Option<String>,
+    pub release_date: Option<String>,
+    pub kind: ReleaseKind,
+    pub wanted: bool,
+    pub unavailable: bool,
+    pub matched_album_id: Option<Uuid>,
+    pub active_ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub row_version: CatalogRowVersion,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    pub copies: Vec<CollectionCopySnapshot>,
+}
+
+impl CatalogReleaseSnapshot {
+    pub fn collection_state(&self) -> CollectionState {
+        if self.matched_album_id.is_some() {
+            CollectionState::Published
+        } else if self.active_ingest_job_id.is_some() {
+            CollectionState::Ingesting
+        } else if !self.copies.is_empty() {
+            CollectionState::Acquired
+        } else if self.unavailable {
+            CollectionState::Unavailable
+        } else if self.wanted {
+            CollectionState::Wanted
+        } else {
+            CollectionState::Missing
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct CatalogCollectionSummary {
+    pub total: u64,
+    pub missing: u64,
+    pub wanted: u64,
+    pub acquired: u64,
+    pub ingesting: u64,
+    pub published: u64,
+    pub unavailable: u64,
+    pub collected: u64,
+}
+
+impl CatalogCollectionSummary {
+    fn from_releases(releases: &[CatalogReleaseSnapshot]) -> Self {
+        let mut summary = Self {
+            total: releases.len() as u64,
+            ..Self::default()
+        };
+        for state in releases
+            .iter()
+            .map(CatalogReleaseSnapshot::collection_state)
+        {
+            match state {
+                CollectionState::Missing => summary.missing += 1,
+                CollectionState::Wanted => summary.wanted += 1,
+                CollectionState::Acquired => summary.acquired += 1,
+                CollectionState::Ingesting => summary.ingesting += 1,
+                CollectionState::Published => summary.published += 1,
+                CollectionState::Unavailable => summary.unavailable += 1,
+            }
+            if state.is_collected() {
+                summary.collected += 1;
+            }
+        }
+        summary
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CatalogArtistCollection {
+    pub artist: CatalogArtistSnapshot,
+    pub summary: CatalogCollectionSummary,
+    pub releases: Vec<CatalogReleaseSnapshot>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NewCatalogArtist {
+    pub artist_id: Option<Uuid>,
+    pub display_name: String,
+    pub sort_name: Option<String>,
+    pub notes: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UpdateCatalogArtist {
+    pub display_name: String,
+    pub sort_name: Option<String>,
+    pub notes: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NewCatalogRelease {
+    pub release_id: Option<Uuid>,
+    pub artist_id: Uuid,
+    pub title: String,
+    pub edition: Option<String>,
+    pub catalog: Option<String>,
+    pub release_date: Option<String>,
+    pub kind: ReleaseKind,
+    pub notes: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UpdateCatalogRelease {
+    pub title: String,
+    pub edition: Option<String>,
+    pub catalog: Option<String>,
+    pub release_date: Option<String>,
+    pub kind: ReleaseKind,
+    pub notes: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NewCollectionCopy {
+    pub copy_id: Option<Uuid>,
+    pub source_kind: AcquisitionSourceKind,
+    pub source_label: String,
+    pub private_locator: Option<String>,
+    pub codec: AudioCodec,
+    pub sample_rate_hz: Option<NonZeroU32>,
+    pub bit_depth: Option<u8>,
+    pub channels: Option<u8>,
+    pub track_count: Option<u32>,
+    pub byte_length: Option<u64>,
+    pub manifest_digest: Option<Digest>,
+    pub quality_verified: bool,
+    pub ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CatalogReleaseCommand {
+    MarkMissing,
+    MarkWanted,
+    MarkUnavailable,
+    RecordCopy(NewCollectionCopy),
+    BeginIngest { job_id: Uuid },
+    Publish { album_id: Uuid },
+    ReturnToAcquired,
+}
+
+#[derive(Debug, Error)]
+pub enum CatalogError {
+    #[error("catalog artist {artist_id} already exists")]
+    ArtistAlreadyExists { artist_id: Uuid },
+    #[error("catalog artist {artist_id} does not exist")]
+    ArtistNotFound { artist_id: Uuid },
+    #[error(
+        "catalog artist {artist_id} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    ArtistConflict {
+        artist_id: Uuid,
+        expected: CatalogRowVersion,
+        actual: CatalogRowVersion,
+    },
+    #[error("catalog release {release_id} already exists")]
+    ReleaseAlreadyExists { release_id: Uuid },
+    #[error("catalog release {release_id} does not exist")]
+    ReleaseNotFound { release_id: Uuid },
+    #[error(
+        "catalog release {release_id} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    ReleaseConflict {
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        actual: CatalogRowVersion,
+    },
+    #[error("collection copy {copy_id} already exists")]
+    CopyAlreadyExists { copy_id: Uuid },
+    #[error("catalog release {release_id} cannot transition from {from} to {to}")]
+    InvalidTransition {
+        release_id: Uuid,
+        from: CollectionState,
+        to: CollectionState,
+    },
+    #[error("catalog release {release_id} has no acquired copy")]
+    NoAcquiredCopy { release_id: Uuid },
+    #[error("invalid catalog {field}: {message}")]
+    InvalidInput {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("persisted {entity} {id} contains invalid {field}: {value}")]
+    InvalidPersistedValue {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+        value: String,
+    },
+    #[error("{entity} {id} has an out-of-range {field}")]
+    NumericOutOfRange {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+    },
+    #[error(transparent)]
+    Database(#[from] DbErr),
+}
+
+#[derive(Clone)]
+pub struct CatalogRepository {
+    database: DatabaseConnection,
+}
+
+impl CatalogRepository {
+    pub fn new(database: DatabaseConnection) -> Self {
+        Self { database }
+    }
+
+    pub async fn create_artist(
+        &self,
+        input: NewCatalogArtist,
+    ) -> Result<CatalogArtistSnapshot, CatalogError> {
+        let artist_id = input.artist_id.unwrap_or_else(Uuid::new_v4);
+        let result = catalog_artist::Entity::insert(catalog_artist::ActiveModel {
+            id: NotSet,
+            artist_id: Set(artist_id),
+            display_name: Set(input.display_name),
+            sort_name: Set(input.sort_name),
+            notes: Set(input.notes),
+            row_version: Set(1),
+            created_at: NotSet,
+            updated_at: NotSet,
+        })
+        .on_conflict(
+            OnConflict::column(catalog_artist::Column::ArtistId)
+                .do_nothing()
+                .to_owned(),
+        )
+        .do_nothing()
+        .exec_without_returning(&self.database)
+        .await?;
+
+        match result {
+            TryInsertResult::Inserted(1) => self
+                .get_artist(artist_id)
+                .await?
+                .ok_or(CatalogError::ArtistNotFound { artist_id }),
+            TryInsertResult::Conflicted | TryInsertResult::Inserted(0) => {
+                Err(CatalogError::ArtistAlreadyExists { artist_id })
+            }
+            TryInsertResult::Inserted(_) | TryInsertResult::Empty => Err(CatalogError::Database(
+                DbErr::Custom("catalog artist insert affected an unexpected row count".to_owned()),
+            )),
+        }
+    }
+
+    pub async fn get_artist(
+        &self,
+        artist_id: Uuid,
+    ) -> Result<Option<CatalogArtistSnapshot>, CatalogError> {
+        catalog_artist::Entity::find()
+            .filter(catalog_artist::Column::ArtistId.eq(artist_id))
+            .one(&self.database)
+            .await?
+            .map(artist_model_to_snapshot)
+            .transpose()
+    }
+
+    pub async fn list_artists(
+        &self,
+        search: Option<&str>,
+        limit: u64,
+        offset: u64,
+    ) -> Result<Vec<CatalogArtistSnapshot>, CatalogError> {
+        let mut query = catalog_artist::Entity::find();
+        if let Some(search) = search.filter(|value| !value.is_empty()) {
+            query = query.filter(catalog_artist::Column::DisplayName.contains(search));
+        }
+        query
+            .order_by_asc(catalog_artist::Column::SortName)
+            .order_by_asc(catalog_artist::Column::DisplayName)
+            .limit(limit)
+            .offset(offset)
+            .all(&self.database)
+            .await?
+            .into_iter()
+            .map(artist_model_to_snapshot)
+            .collect()
+    }
+
+    pub async fn create_release(
+        &self,
+        input: NewCatalogRelease,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        let artist = get_artist_model(&self.database, input.artist_id)
+            .await?
+            .ok_or(CatalogError::ArtistNotFound {
+                artist_id: input.artist_id,
+            })?;
+        let release_id = input.release_id.unwrap_or_else(Uuid::new_v4);
+        let result = catalog_release::Entity::insert(catalog_release::ActiveModel {
+            id: NotSet,
+            release_id: Set(release_id),
+            artist_db_id: Set(artist.id),
+            title: Set(input.title),
+            edition: Set(input.edition),
+            catalog: Set(input.catalog),
+            release_date: Set(input.release_date),
+            kind: Set(input.kind.as_str().to_owned()),
+            wanted: Set(false),
+            unavailable: Set(false),
+            matched_album_id: Set(None),
+            active_ingest_job_id: Set(None),
+            notes: Set(input.notes),
+            row_version: Set(1),
+            created_at: NotSet,
+            updated_at: NotSet,
+        })
+        .on_conflict(
+            OnConflict::column(catalog_release::Column::ReleaseId)
+                .do_nothing()
+                .to_owned(),
+        )
+        .do_nothing()
+        .exec_without_returning(&self.database)
+        .await?;
+        match result {
+            TryInsertResult::Inserted(1) => self
+                .get_release(release_id)
+                .await?
+                .ok_or(CatalogError::ReleaseNotFound { release_id }),
+            TryInsertResult::Conflicted | TryInsertResult::Inserted(0) => {
+                Err(CatalogError::ReleaseAlreadyExists { release_id })
+            }
+            TryInsertResult::Inserted(_) | TryInsertResult::Empty => Err(CatalogError::Database(
+                DbErr::Custom("catalog release insert affected an unexpected row count".to_owned()),
+            )),
+        }
+    }
+
+    pub async fn get_release(
+        &self,
+        release_id: Uuid,
+    ) -> Result<Option<CatalogReleaseSnapshot>, CatalogError> {
+        let Some(model) = get_release_model(&self.database, release_id).await? else {
+            return Ok(None);
+        };
+        let artist = catalog_artist::Entity::find_by_id(model.artist_db_id)
+            .one(&self.database)
+            .await?
+            .ok_or_else(|| {
+                CatalogError::Database(DbErr::Custom(format!(
+                    "catalog release {release_id} references a missing artist"
+                )))
+            })?;
+        let copies = collection_copy::Entity::find()
+            .filter(collection_copy::Column::ReleaseDbId.eq(model.id))
+            .order_by_desc(collection_copy::Column::AcquiredAt)
+            .all(&self.database)
+            .await?;
+        release_model_to_snapshot(model, artist.artist_id, copies).map(Some)
+    }
+
+    pub async fn get_artist_collection(
+        &self,
+        artist_id: Uuid,
+    ) -> Result<Option<CatalogArtistCollection>, CatalogError> {
+        let Some(artist_model) = get_artist_model(&self.database, artist_id).await? else {
+            return Ok(None);
+        };
+        let release_models = catalog_release::Entity::find()
+            .filter(catalog_release::Column::ArtistDbId.eq(artist_model.id))
+            .order_by_asc(catalog_release::Column::ReleaseDate)
+            .order_by_asc(catalog_release::Column::Id)
+            .all(&self.database)
+            .await?;
+        let release_db_ids: Vec<_> = release_models.iter().map(|model| model.id).collect();
+        let mut copies_by_release: HashMap<i32, Vec<collection_copy::Model>> = HashMap::new();
+        if !release_db_ids.is_empty() {
+            for copy in collection_copy::Entity::find()
+                .filter(collection_copy::Column::ReleaseDbId.is_in(release_db_ids))
+                .order_by_desc(collection_copy::Column::AcquiredAt)
+                .all(&self.database)
+                .await?
+            {
+                copies_by_release
+                    .entry(copy.release_db_id)
+                    .or_default()
+                    .push(copy);
+            }
+        }
+        let releases = release_models
+            .into_iter()
+            .map(|model| {
+                let copies = copies_by_release.remove(&model.id).unwrap_or_default();
+                release_model_to_snapshot(model, artist_id, copies)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        let summary = CatalogCollectionSummary::from_releases(&releases);
+        Ok(Some(CatalogArtistCollection {
+            artist: artist_model_to_snapshot(artist_model)?,
+            summary,
+            releases,
+        }))
+    }
+
+    pub async fn update_artist(
+        &self,
+        artist_id: Uuid,
+        expected: CatalogRowVersion,
+        input: UpdateCatalogArtist,
+    ) -> Result<CatalogArtistSnapshot, CatalogError> {
+        require_non_empty("display_name", &input.display_name)?;
+        let next = expected.next("artist", artist_id)?;
+        let result = catalog_artist::Entity::update_many()
+            .col_expr(
+                catalog_artist::Column::DisplayName,
+                Expr::value(input.display_name),
+            )
+            .col_expr(
+                catalog_artist::Column::SortName,
+                Expr::value(input.sort_name),
+            )
+            .col_expr(catalog_artist::Column::Notes, Expr::value(input.notes))
+            .col_expr(
+                catalog_artist::Column::RowVersion,
+                Expr::value(next.as_i64("artist", artist_id)?),
+            )
+            .col_expr(
+                catalog_artist::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(catalog_artist::Column::ArtistId.eq(artist_id))
+            .filter(catalog_artist::Column::RowVersion.eq(expected.as_i64("artist", artist_id)?))
+            .exec(&self.database)
+            .await?;
+        if result.rows_affected == 1 {
+            return self
+                .get_artist(artist_id)
+                .await?
+                .ok_or(CatalogError::ArtistNotFound { artist_id });
+        }
+        match self.get_artist(artist_id).await? {
+            Some(actual) => Err(CatalogError::ArtistConflict {
+                artist_id,
+                expected,
+                actual: actual.row_version,
+            }),
+            None => Err(CatalogError::ArtistNotFound { artist_id }),
+        }
+    }
+
+    pub async fn update_release(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        input: UpdateCatalogRelease,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        require_non_empty("title", &input.title)?;
+        let next = expected.next("release", release_id)?;
+        let result = catalog_release::Entity::update_many()
+            .col_expr(catalog_release::Column::Title, Expr::value(input.title))
+            .col_expr(catalog_release::Column::Edition, Expr::value(input.edition))
+            .col_expr(catalog_release::Column::Catalog, Expr::value(input.catalog))
+            .col_expr(
+                catalog_release::Column::ReleaseDate,
+                Expr::value(input.release_date),
+            )
+            .col_expr(
+                catalog_release::Column::Kind,
+                Expr::value(input.kind.as_str()),
+            )
+            .col_expr(catalog_release::Column::Notes, Expr::value(input.notes))
+            .col_expr(
+                catalog_release::Column::RowVersion,
+                Expr::value(next.as_i64("release", release_id)?),
+            )
+            .col_expr(
+                catalog_release::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(catalog_release::Column::ReleaseId.eq(release_id))
+            .filter(catalog_release::Column::RowVersion.eq(expected.as_i64("release", release_id)?))
+            .exec(&self.database)
+            .await?;
+        if result.rows_affected == 1 {
+            return self
+                .get_release(release_id)
+                .await?
+                .ok_or(CatalogError::ReleaseNotFound { release_id });
+        }
+        self.release_conflict_or_not_found(release_id, expected)
+            .await
+    }
+
+    async fn set_release_lifecycle(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        wanted: bool,
+        unavailable: bool,
+        matched_album_id: Option<Uuid>,
+        active_ingest_job_id: Option<Uuid>,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        cas_release_lifecycle(
+            &self.database,
+            release_id,
+            expected,
+            wanted,
+            unavailable,
+            matched_album_id,
+            active_ingest_job_id,
+        )
+        .await?;
+        self.get_release(release_id)
+            .await?
+            .ok_or(CatalogError::ReleaseNotFound { release_id })
+    }
+
+    async fn record_copy(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        input: NewCollectionCopy,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        require_non_empty("source_label", &input.source_label)?;
+        AudioProperties::new(
+            input.codec,
+            input.sample_rate_hz,
+            input.bit_depth,
+            input.channels,
+        )
+        .map_err(|_| CatalogError::InvalidInput {
+            field: "audio_properties",
+            message: "bit depth and channel count must be positive when present",
+        })?;
+        if input.track_count == Some(0) {
+            return Err(CatalogError::InvalidInput {
+                field: "track_count",
+                message: "track count must be positive when present",
+            });
+        }
+        if input.byte_length == Some(0) {
+            return Err(CatalogError::InvalidInput {
+                field: "byte_length",
+                message: "byte length must be positive when present",
+            });
+        }
+        let copy_id = input.copy_id.unwrap_or_else(Uuid::new_v4);
+        let transaction = self.database.begin().await?;
+        cas_release_lifecycle(&transaction, release_id, expected, false, false, None, None).await?;
+        let release = get_release_model(&transaction, release_id)
+            .await?
+            .ok_or(CatalogError::ReleaseNotFound { release_id })?;
+        let active_model = collection_copy::ActiveModel {
+            id: NotSet,
+            copy_id: Set(copy_id),
+            release_db_id: Set(release.id),
+            source_kind: Set(input.source_kind.as_str().to_owned()),
+            source_label: Set(input.source_label),
+            private_locator: Set(input.private_locator),
+            codec: Set(input.codec.as_str().to_owned()),
+            sample_rate_hz: Set(optional_u32_to_i32(
+                copy_id,
+                "sample_rate_hz",
+                input.sample_rate_hz.map(NonZeroU32::get),
+            )?),
+            bit_depth: Set(input.bit_depth.map(i16::from)),
+            channels: Set(input.channels.map(i16::from)),
+            track_count: Set(optional_u32_to_i32(
+                copy_id,
+                "track_count",
+                input.track_count,
+            )?),
+            byte_length: Set(optional_u64_to_i64(
+                copy_id,
+                "byte_length",
+                input.byte_length,
+            )?),
+            manifest_digest: Set(input
+                .manifest_digest
+                .map(|digest| digest.as_bytes().to_vec())),
+            quality_verified: Set(input.quality_verified),
+            ingest_job_id: Set(input.ingest_job_id),
+            notes: Set(input.notes),
+            acquired_at: Set(now()),
+            created_at: NotSet,
+            updated_at: NotSet,
+        };
+        let result = collection_copy::Entity::insert(active_model)
+            .on_conflict(
+                OnConflict::column(collection_copy::Column::CopyId)
+                    .do_nothing()
+                    .to_owned(),
+            )
+            .do_nothing()
+            .exec_without_returning(&transaction)
+            .await?;
+        match result {
+            TryInsertResult::Inserted(1) => transaction.commit().await?,
+            TryInsertResult::Conflicted | TryInsertResult::Inserted(0) => {
+                return Err(CatalogError::CopyAlreadyExists { copy_id });
+            }
+            TryInsertResult::Inserted(_) | TryInsertResult::Empty => {
+                return Err(CatalogError::Database(DbErr::Custom(
+                    "collection copy insert affected an unexpected row count".to_owned(),
+                )));
+            }
+        }
+        self.get_release(release_id)
+            .await?
+            .ok_or(CatalogError::ReleaseNotFound { release_id })
+    }
+
+    async fn release_conflict_or_not_found(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        match self.get_release(release_id).await? {
+            Some(actual) => Err(CatalogError::ReleaseConflict {
+                release_id,
+                expected,
+                actual: actual.row_version,
+            }),
+            None => Err(CatalogError::ReleaseNotFound { release_id }),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct CatalogService {
+    repository: CatalogRepository,
+}
+
+impl CatalogService {
+    pub fn new(repository: CatalogRepository) -> Self {
+        Self { repository }
+    }
+
+    pub const fn repository(&self) -> &CatalogRepository {
+        &self.repository
+    }
+
+    pub async fn create_artist(
+        &self,
+        input: NewCatalogArtist,
+    ) -> Result<CatalogArtistSnapshot, CatalogError> {
+        require_non_empty("display_name", &input.display_name)?;
+        self.repository.create_artist(input).await
+    }
+
+    pub async fn update_artist(
+        &self,
+        artist_id: Uuid,
+        expected: CatalogRowVersion,
+        input: UpdateCatalogArtist,
+    ) -> Result<CatalogArtistSnapshot, CatalogError> {
+        self.repository
+            .update_artist(artist_id, expected, input)
+            .await
+    }
+
+    pub async fn list_artists(
+        &self,
+        search: Option<&str>,
+        limit: u64,
+        offset: u64,
+    ) -> Result<Vec<CatalogArtistSnapshot>, CatalogError> {
+        self.repository.list_artists(search, limit, offset).await
+    }
+
+    pub async fn create_release(
+        &self,
+        input: NewCatalogRelease,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        require_non_empty("title", &input.title)?;
+        self.repository.create_release(input).await
+    }
+
+    pub async fn update_release(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        input: UpdateCatalogRelease,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        self.repository
+            .update_release(release_id, expected, input)
+            .await
+    }
+
+    pub async fn artist_collection(
+        &self,
+        artist_id: Uuid,
+        state: Option<CollectionState>,
+    ) -> Result<Option<CatalogArtistCollection>, CatalogError> {
+        let Some(mut collection) = self.repository.get_artist_collection(artist_id).await? else {
+            return Ok(None);
+        };
+        if let Some(state) = state {
+            collection
+                .releases
+                .retain(|release| release.collection_state() == state);
+        }
+        collection.summary = CatalogCollectionSummary::from_releases(&collection.releases);
+        Ok(Some(collection))
+    }
+
+    pub async fn execute_release_command(
+        &self,
+        release_id: Uuid,
+        expected: CatalogRowVersion,
+        command: CatalogReleaseCommand,
+    ) -> Result<CatalogReleaseSnapshot, CatalogError> {
+        let current = self
+            .repository
+            .get_release(release_id)
+            .await?
+            .ok_or(CatalogError::ReleaseNotFound { release_id })?;
+        if current.row_version != expected {
+            return Err(CatalogError::ReleaseConflict {
+                release_id,
+                expected,
+                actual: current.row_version,
+            });
+        }
+        let state = current.collection_state();
+        match command {
+            CatalogReleaseCommand::MarkMissing => {
+                ensure_marker_transition(release_id, state, CollectionState::Missing)?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, false, false, None, None)
+                    .await
+            }
+            CatalogReleaseCommand::MarkWanted => {
+                ensure_marker_transition(release_id, state, CollectionState::Wanted)?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, true, false, None, None)
+                    .await
+            }
+            CatalogReleaseCommand::MarkUnavailable => {
+                ensure_marker_transition(release_id, state, CollectionState::Unavailable)?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, false, true, None, None)
+                    .await
+            }
+            CatalogReleaseCommand::RecordCopy(copy) => {
+                ensure_record_copy_transition(release_id, state)?;
+                self.repository
+                    .record_copy(release_id, expected, copy)
+                    .await
+            }
+            CatalogReleaseCommand::BeginIngest { job_id } => {
+                ensure_exact_transition(
+                    release_id,
+                    state,
+                    CollectionState::Acquired,
+                    CollectionState::Ingesting,
+                )?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, false, false, None, Some(job_id))
+                    .await
+            }
+            CatalogReleaseCommand::Publish { album_id } => {
+                ensure_exact_transition(
+                    release_id,
+                    state,
+                    CollectionState::Ingesting,
+                    CollectionState::Published,
+                )?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, false, false, Some(album_id), None)
+                    .await
+            }
+            CatalogReleaseCommand::ReturnToAcquired => {
+                if current.copies.is_empty() {
+                    return Err(CatalogError::NoAcquiredCopy { release_id });
+                }
+                ensure_transition(release_id, state, CollectionState::Acquired)?;
+                self.repository
+                    .set_release_lifecycle(release_id, expected, false, false, None, None)
+                    .await
+            }
+        }
+    }
+}
+
+async fn get_artist_model<C: ConnectionTrait>(
+    connection: &C,
+    artist_id: Uuid,
+) -> Result<Option<catalog_artist::Model>, CatalogError> {
+    Ok(catalog_artist::Entity::find()
+        .filter(catalog_artist::Column::ArtistId.eq(artist_id))
+        .one(connection)
+        .await?)
+}
+
+async fn get_release_model<C: ConnectionTrait>(
+    connection: &C,
+    release_id: Uuid,
+) -> Result<Option<catalog_release::Model>, CatalogError> {
+    Ok(catalog_release::Entity::find()
+        .filter(catalog_release::Column::ReleaseId.eq(release_id))
+        .one(connection)
+        .await?)
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn cas_release_lifecycle<C: ConnectionTrait>(
+    connection: &C,
+    release_id: Uuid,
+    expected: CatalogRowVersion,
+    wanted: bool,
+    unavailable: bool,
+    matched_album_id: Option<Uuid>,
+    active_ingest_job_id: Option<Uuid>,
+) -> Result<CatalogRowVersion, CatalogError> {
+    let next = expected.next("release", release_id)?;
+    let result = catalog_release::Entity::update_many()
+        .col_expr(catalog_release::Column::Wanted, Expr::value(wanted))
+        .col_expr(
+            catalog_release::Column::Unavailable,
+            Expr::value(unavailable),
+        )
+        .col_expr(
+            catalog_release::Column::MatchedAlbumId,
+            Expr::value(matched_album_id),
+        )
+        .col_expr(
+            catalog_release::Column::ActiveIngestJobId,
+            Expr::value(active_ingest_job_id),
+        )
+        .col_expr(
+            catalog_release::Column::RowVersion,
+            Expr::value(next.as_i64("release", release_id)?),
+        )
+        .col_expr(
+            catalog_release::Column::UpdatedAt,
+            Expr::current_timestamp().into(),
+        )
+        .filter(catalog_release::Column::ReleaseId.eq(release_id))
+        .filter(catalog_release::Column::RowVersion.eq(expected.as_i64("release", release_id)?))
+        .exec(connection)
+        .await?;
+    if result.rows_affected == 1 {
+        return Ok(next);
+    }
+    match get_release_model(connection, release_id).await? {
+        Some(actual) => Err(CatalogError::ReleaseConflict {
+            release_id,
+            expected,
+            actual: parse_row_version("release", release_id, actual.row_version)?,
+        }),
+        None => Err(CatalogError::ReleaseNotFound { release_id }),
+    }
+}
+
+fn artist_model_to_snapshot(
+    model: catalog_artist::Model,
+) -> Result<CatalogArtistSnapshot, CatalogError> {
+    let artist_id = model.artist_id;
+    Ok(CatalogArtistSnapshot {
+        artist_id,
+        display_name: model.display_name,
+        sort_name: model.sort_name,
+        notes: model.notes,
+        row_version: parse_row_version("artist", artist_id, model.row_version)?,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+fn release_model_to_snapshot(
+    model: catalog_release::Model,
+    artist_id: Uuid,
+    copies: Vec<collection_copy::Model>,
+) -> Result<CatalogReleaseSnapshot, CatalogError> {
+    let release_id = model.release_id;
+    let kind =
+        ReleaseKind::from_str(&model.kind).map_err(|_| CatalogError::InvalidPersistedValue {
+            entity: "release",
+            id: release_id,
+            field: "kind",
+            value: model.kind.clone(),
+        })?;
+    Ok(CatalogReleaseSnapshot {
+        release_id,
+        artist_id,
+        title: model.title,
+        edition: model.edition,
+        catalog: model.catalog,
+        release_date: model.release_date,
+        kind,
+        wanted: model.wanted,
+        unavailable: model.unavailable,
+        matched_album_id: model.matched_album_id,
+        active_ingest_job_id: model.active_ingest_job_id,
+        notes: model.notes,
+        row_version: parse_row_version("release", release_id, model.row_version)?,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+        copies: copies
+            .into_iter()
+            .map(|copy| copy_model_to_snapshot(release_id, copy))
+            .collect::<Result<_, _>>()?,
+    })
+}
+
+fn copy_model_to_snapshot(
+    _release_id: Uuid,
+    model: collection_copy::Model,
+) -> Result<CollectionCopySnapshot, CatalogError> {
+    let copy_id = model.copy_id;
+    let invalid = |field: &'static str, value: String| CatalogError::InvalidPersistedValue {
+        entity: "collection copy",
+        id: copy_id,
+        field,
+        value,
+    };
+    let source_kind = AcquisitionSourceKind::from_str(&model.source_kind)
+        .map_err(|_| invalid("source_kind", model.source_kind.clone()))?;
+    let codec =
+        AudioCodec::from_str(&model.codec).map_err(|_| invalid("codec", model.codec.clone()))?;
+    let sample_rate_hz = positive_i32_to_nonzero(model.sample_rate_hz)
+        .ok_or_else(|| invalid("sample_rate_hz", format!("{:?}", model.sample_rate_hz)))?;
+    let bit_depth = positive_i16_to_u8(model.bit_depth)
+        .ok_or_else(|| invalid("bit_depth", format!("{:?}", model.bit_depth)))?;
+    let channels = positive_i16_to_u8(model.channels)
+        .ok_or_else(|| invalid("channels", format!("{:?}", model.channels)))?;
+    AudioProperties::new(codec, sample_rate_hz, bit_depth, channels)
+        .map_err(|error| invalid("audio_properties", error.to_string()))?;
+    let track_count = positive_i32_to_u32(model.track_count)
+        .ok_or_else(|| invalid("track_count", format!("{:?}", model.track_count)))?;
+    let byte_length = positive_i64_to_u64(model.byte_length)
+        .ok_or_else(|| invalid("byte_length", format!("{:?}", model.byte_length)))?;
+    let manifest_digest = model
+        .manifest_digest
+        .map(|bytes| digest_from_bytes(copy_id, bytes))
+        .transpose()?;
+    Ok(CollectionCopySnapshot {
+        copy_id,
+        source_kind,
+        source_label: model.source_label,
+        codec,
+        sample_rate_hz,
+        bit_depth,
+        channels,
+        track_count,
+        byte_length,
+        manifest_digest,
+        quality_verified: model.quality_verified,
+        ingest_job_id: model.ingest_job_id,
+        notes: model.notes,
+        acquired_at: timestamp(model.acquired_at),
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+fn parse_row_version(
+    entity: &'static str,
+    id: Uuid,
+    value: i64,
+) -> Result<CatalogRowVersion, CatalogError> {
+    u64::try_from(value)
+        .ok()
+        .and_then(CatalogRowVersion::new)
+        .ok_or(CatalogError::InvalidPersistedValue {
+            entity,
+            id,
+            field: "row_version",
+            value: value.to_string(),
+        })
+}
+
+fn positive_i32_to_nonzero(value: Option<i32>) -> Option<Option<NonZeroU32>> {
+    match value {
+        None => Some(None),
+        Some(value) => u32::try_from(value)
+            .ok()
+            .and_then(NonZeroU32::new)
+            .map(Some),
+    }
+}
+
+fn positive_i16_to_u8(value: Option<i16>) -> Option<Option<u8>> {
+    match value {
+        None => Some(None),
+        Some(value) => u8::try_from(value)
+            .ok()
+            .filter(|value| *value > 0)
+            .map(Some),
+    }
+}
+
+fn positive_i32_to_u32(value: Option<i32>) -> Option<Option<u32>> {
+    match value {
+        None => Some(None),
+        Some(value) => u32::try_from(value)
+            .ok()
+            .filter(|value| *value > 0)
+            .map(Some),
+    }
+}
+
+fn positive_i64_to_u64(value: Option<i64>) -> Option<Option<u64>> {
+    match value {
+        None => Some(None),
+        Some(value) => u64::try_from(value)
+            .ok()
+            .filter(|value| *value > 0)
+            .map(Some),
+    }
+}
+
+fn digest_from_bytes(copy_id: Uuid, bytes: Vec<u8>) -> Result<Digest, CatalogError> {
+    let value = bytes
+        .try_into()
+        .map_err(|bytes: Vec<u8>| CatalogError::InvalidPersistedValue {
+            entity: "collection copy",
+            id: copy_id,
+            field: "manifest_digest",
+            value: format!("{} bytes", bytes.len()),
+        })?;
+    Ok(Digest::new(value))
+}
+
+fn optional_u32_to_i32(
+    id: Uuid,
+    field: &'static str,
+    value: Option<u32>,
+) -> Result<Option<i32>, CatalogError> {
+    value
+        .map(|value| {
+            i32::try_from(value).map_err(|_| CatalogError::NumericOutOfRange {
+                entity: "collection copy",
+                id,
+                field,
+            })
+        })
+        .transpose()
+}
+
+fn optional_u64_to_i64(
+    id: Uuid,
+    field: &'static str,
+    value: Option<u64>,
+) -> Result<Option<i64>, CatalogError> {
+    value
+        .map(|value| {
+            i64::try_from(value).map_err(|_| CatalogError::NumericOutOfRange {
+                entity: "collection copy",
+                id,
+                field,
+            })
+        })
+        .transpose()
+}
+
+fn require_non_empty(field: &'static str, value: &str) -> Result<(), CatalogError> {
+    if value.is_empty() {
+        Err(CatalogError::InvalidInput {
+            field,
+            message: "value must not be empty",
+        })
+    } else {
+        Ok(())
+    }
+}
+
+fn ensure_marker_transition(
+    release_id: Uuid,
+    from: CollectionState,
+    to: CollectionState,
+) -> Result<(), CatalogError> {
+    if matches!(
+        from,
+        CollectionState::Missing | CollectionState::Wanted | CollectionState::Unavailable
+    ) && from.can_transition_to(to)
+    {
+        Ok(())
+    } else {
+        Err(CatalogError::InvalidTransition {
+            release_id,
+            from,
+            to,
+        })
+    }
+}
+
+fn ensure_transition(
+    release_id: Uuid,
+    from: CollectionState,
+    to: CollectionState,
+) -> Result<(), CatalogError> {
+    if from.can_transition_to(to) {
+        Ok(())
+    } else {
+        Err(CatalogError::InvalidTransition {
+            release_id,
+            from,
+            to,
+        })
+    }
+}
+
+fn ensure_record_copy_transition(
+    release_id: Uuid,
+    from: CollectionState,
+) -> Result<(), CatalogError> {
+    if matches!(
+        from,
+        CollectionState::Missing
+            | CollectionState::Wanted
+            | CollectionState::Unavailable
+            | CollectionState::Acquired
+    ) {
+        Ok(())
+    } else {
+        Err(CatalogError::InvalidTransition {
+            release_id,
+            from,
+            to: CollectionState::Acquired,
+        })
+    }
+}
+
+fn ensure_exact_transition(
+    release_id: Uuid,
+    from: CollectionState,
+    required: CollectionState,
+    to: CollectionState,
+) -> Result<(), CatalogError> {
+    if from == required && from.can_transition_to(to) {
+        Ok(())
+    } else {
+        Err(CatalogError::InvalidTransition {
+            release_id,
+            from,
+            to,
+        })
+    }
+}
diff --git a/annim/src/catalog/sync.rs b/annim/src/catalog/sync.rs
new file mode 100644
index 00000000..fa4ba436
--- /dev/null
+++ b/annim/src/catalog/sync.rs
@@ -0,0 +1,2996 @@
+//! Durable synchronization of artist discographies from external catalogs.
+//!
+//! A sync run never treats a remote response as canonical metadata. Instead,
+//! it stores the exact response as an append-only observation. Parsed data is
+//! stored beside the response so parser changes are reviewable, while the raw
+//! SHA-256 makes accidental corruption detectable.
+//!
+//! Public snapshots deliberately omit `configuration_document` and
+//! `secret_ref`. Those values are worker-only inputs and must not leak through
+//! a future GraphQL query merely because a source was listed.
+
+use std::{fmt, str::FromStr, time::Duration};
+
+use anni_catalog::{CatalogSourceKind, SyncCoverage, SyncRunStatus};
+use anni_ingest::Digest;
+use sea_orm::{
+    prelude::{DateTimeUtc, Uuid},
+    sea_query::{Expr, Query},
+    ActiveValue::{NotSet, Set},
+    ColumnTrait, Condition, ConnectionTrait, DatabaseConnection, DbErr, EntityTrait, QueryFilter,
+    QueryOrder, QuerySelect, TransactionTrait,
+};
+use sha2::{Digest as ShaDigest, Sha256};
+use thiserror::Error;
+
+use super::CatalogRowVersion;
+use crate::{
+    config::{CatalogSecretRef, CatalogSyncProvisioningConfig},
+    entities::{
+        catalog_artist, catalog_source, catalog_source_release, catalog_source_release_revision,
+        catalog_sync_run, helper::timestamp,
+    },
+};
+
+const MAX_SYNC_ERROR_CHARS: usize = 512;
+const MAX_CLAIM_CAS_ATTEMPTS: usize = 16;
+
+#[cfg(feature = "postgres")]
+type PersistedTimestamp = chrono::NaiveDateTime;
+#[cfg(all(feature = "sqlite", not(feature = "postgres")))]
+type PersistedTimestamp = DateTimeUtc;
+
+#[cfg(feature = "postgres")]
+fn store_timestamp(value: DateTimeUtc) -> PersistedTimestamp {
+    value.naive_utc()
+}
+
+#[cfg(all(feature = "sqlite", not(feature = "postgres")))]
+fn store_timestamp(value: DateTimeUtc) -> PersistedTimestamp {
+    value
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogSourceSnapshot {
+    pub source_id: Uuid,
+    pub artist_id: Uuid,
+    pub kind: CatalogSourceKind,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+    pub enabled: bool,
+    pub provisioning_state: CatalogSourceProvisioningState,
+    pub row_version: CatalogRowVersion,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+impl fmt::Debug for CatalogSourceSnapshot {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogSourceSnapshot")
+            .field("source_id", &self.source_id)
+            .field("artist_id", &self.artist_id)
+            .field("kind", &self.kind)
+            .field("locator", &"[REDACTED]")
+            .field("storefront", &self.storefront)
+            .field("locale", &self.locale)
+            .field("enabled", &self.enabled)
+            .field("provisioning_state", &self.provisioning_state)
+            .field("row_version", &self.row_version)
+            .field("created_at", &self.created_at)
+            .field("updated_at", &self.updated_at)
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CatalogSourceProvisioningState {
+    ReadyToQueue,
+    Disabled,
+    CredentialNotConfigured,
+    CredentialBindingInvalid,
+    AdapterUnavailable,
+}
+
+impl CatalogSourceSnapshot {
+    /// Reports whether the browser-managed control plane can queue this source.
+    ///
+    /// Only the Apple Music adapter is installed in the production catalog
+    /// worker today. A configured reference means the worker can attempt to
+    /// resolve a credential; it does not claim that the token itself is valid.
+    pub const fn managed_provisioning_state(&self) -> CatalogSourceProvisioningState {
+        self.provisioning_state
+    }
+}
+
+/// Browser-safe request to register a source.
+///
+/// Adapter configuration and credential references are deliberately absent;
+/// [`CatalogSyncService`] adds trusted provisioning before persistence.
+#[derive(Clone, PartialEq, Eq)]
+pub struct NewManagedCatalogSource {
+    pub source_id: Option<Uuid>,
+    pub artist_id: Uuid,
+    pub kind: CatalogSourceKind,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+}
+
+impl fmt::Debug for NewManagedCatalogSource {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("NewManagedCatalogSource")
+            .field("source_id", &self.source_id)
+            .field("artist_id", &self.artist_id)
+            .field("kind", &self.kind)
+            .field("locator", &"[REDACTED]")
+            .field("storefront", &self.storefront)
+            .field("locale", &self.locale)
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct NewCatalogSource {
+    pub source_id: Option<Uuid>,
+    pub artist_id: Uuid,
+    pub kind: CatalogSourceKind,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+    /// Adapter configuration. This is accepted at the command boundary but is
+    /// intentionally absent from [`CatalogSourceSnapshot`].
+    pub configuration_document: Option<String>,
+    /// Reference into the worker's secret store, never the secret itself.
+    pub secret_ref: Option<String>,
+}
+
+impl fmt::Debug for NewCatalogSource {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("NewCatalogSource")
+            .field("source_id", &self.source_id)
+            .field("artist_id", &self.artist_id)
+            .field("kind", &self.kind)
+            .field("locator", &"[REDACTED]")
+            .field("storefront", &self.storefront)
+            .field("locale", &self.locale)
+            .field(
+                "configuration_document",
+                &self.configuration_document.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "secret_ref",
+                &self.secret_ref.as_ref().map(|_| "[REDACTED]"),
+            )
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogSyncRunSnapshot {
+    pub run_id: Uuid,
+    pub source_id: Uuid,
+    pub status: SyncRunStatus,
+    pub requested_cursor: Option<String>,
+    pub result_cursor: Option<String>,
+    pub observed_count: u32,
+    pub error_message: Option<String>,
+    pub coverage: SyncCoverage,
+    pub started_from_root: bool,
+    pub snapshot_complete: bool,
+    pub attempt_count: u32,
+    pub next_attempt_at: Option<DateTimeUtc>,
+    pub row_version: CatalogRowVersion,
+    pub created_at: DateTimeUtc,
+    pub started_at: Option<DateTimeUtc>,
+    pub finished_at: Option<DateTimeUtc>,
+}
+
+impl fmt::Debug for CatalogSyncRunSnapshot {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogSyncRunSnapshot")
+            .field("run_id", &self.run_id)
+            .field("source_id", &self.source_id)
+            .field("status", &self.status)
+            .field(
+                "requested_cursor",
+                &self.requested_cursor.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "result_cursor",
+                &self.result_cursor.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field("observed_count", &self.observed_count)
+            .field(
+                "error_message",
+                &self.error_message.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field("coverage", &self.coverage)
+            .field("started_from_root", &self.started_from_root)
+            .field("snapshot_complete", &self.snapshot_complete)
+            .field("attempt_count", &self.attempt_count)
+            .field("next_attempt_at", &self.next_attempt_at)
+            .field("row_version", &self.row_version)
+            .field("created_at", &self.created_at)
+            .field("started_at", &self.started_at)
+            .field("finished_at", &self.finished_at)
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct NewCatalogSyncRun {
+    pub run_id: Option<Uuid>,
+    pub source_id: Uuid,
+    pub requested_cursor: Option<String>,
+}
+
+impl fmt::Debug for NewCatalogSyncRun {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("NewCatalogSyncRun")
+            .field("run_id", &self.run_id)
+            .field("source_id", &self.source_id)
+            .field(
+                "requested_cursor",
+                &self.requested_cursor.as_ref().map(|_| "[REDACTED]"),
+            )
+            .finish()
+    }
+}
+
+/// Worker-only execution envelope for a catalog run.
+///
+/// This is deliberately never inserted into the GraphQL schema. The custom
+/// Debug implementation exposes only non-secret identifiers and counters.
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogSyncLease {
+    pub run_id: Uuid,
+    pub source_id: Uuid,
+    pub kind: CatalogSourceKind,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+    pub configuration_document: Option<String>,
+    pub secret_ref: Option<String>,
+    pub requested_cursor: Option<String>,
+    pub lease_token: Uuid,
+    pub lease_expires_at: DateTimeUtc,
+    pub attempt_count: u32,
+    pub row_version: CatalogRowVersion,
+}
+
+impl fmt::Debug for CatalogSyncLease {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogSyncLease")
+            .field("run_id", &self.run_id)
+            .field("source_id", &self.source_id)
+            .field("kind", &self.kind)
+            .field("locator", &"[REDACTED]")
+            .field("storefront", &self.storefront)
+            .field("locale", &self.locale)
+            .field(
+                "configuration_document",
+                &self.configuration_document.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "secret_ref",
+                &self.secret_ref.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "requested_cursor",
+                &self.requested_cursor.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field("lease_token", &"[REDACTED]")
+            .field("lease_expires_at", &self.lease_expires_at)
+            .field("attempt_count", &self.attempt_count)
+            .field("row_version", &self.row_version)
+            .finish()
+    }
+}
+
+/// One exact release observation produced by a source adapter.
+///
+/// No Unicode normalization or whitespace rewriting occurs here: both
+/// documents are hashed and persisted byte-for-byte as supplied.
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogReleaseObservation {
+    pub external_release_id: String,
+    pub source_url: String,
+    pub raw_document: String,
+    pub parsed_document: String,
+}
+
+impl fmt::Debug for CatalogReleaseObservation {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogReleaseObservation")
+            .field("external_release_id", &self.external_release_id)
+            .field("source_url", &"[REDACTED]")
+            .field("raw_document_bytes", &self.raw_document.len())
+            .field("parsed_document_bytes", &self.parsed_document.len())
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogObservationSnapshot {
+    pub source_release_id: Uuid,
+    pub external_release_id: String,
+    pub source_url: String,
+    pub revision: u64,
+    pub raw_sha256: Digest,
+    pub first_seen_at: DateTimeUtc,
+    pub last_seen_at: DateTimeUtc,
+    pub not_seen_since: Option<DateTimeUtc>,
+    pub row_version: CatalogRowVersion,
+}
+
+impl fmt::Debug for CatalogObservationSnapshot {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogObservationSnapshot")
+            .field("source_release_id", &self.source_release_id)
+            .field("external_release_id", &self.external_release_id)
+            .field("source_url", &"[REDACTED]")
+            .field("revision", &self.revision)
+            .field("raw_sha256", &self.raw_sha256)
+            .field("first_seen_at", &self.first_seen_at)
+            .field("last_seen_at", &self.last_seen_at)
+            .field("not_seen_since", &self.not_seen_since)
+            .field("row_version", &self.row_version)
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RecordedCatalogObservation {
+    pub run: CatalogSyncRunSnapshot,
+    pub observation: CatalogObservationSnapshot,
+    /// False when the exact raw and parsed documents already formed the latest
+    /// revision. Seeing the same release in a later run still clears absence
+    /// and advances the run, but does not duplicate evidence.
+    pub revision_appended: bool,
+    /// False for duplicate adapter output within the same run. This prevents a
+    /// retry from inflating `observed_count`.
+    pub first_observation_in_run: bool,
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub enum FinishCatalogSyncRun {
+    Succeeded {
+        result_cursor: Option<String>,
+        coverage: SyncCoverage,
+        snapshot_complete: bool,
+    },
+    Failed {
+        error_message: String,
+    },
+    Cancelled {
+        message: Option<String>,
+    },
+}
+
+impl fmt::Debug for FinishCatalogSyncRun {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Succeeded {
+                result_cursor,
+                coverage,
+                snapshot_complete,
+            } => formatter
+                .debug_struct("Succeeded")
+                .field(
+                    "result_cursor",
+                    &result_cursor.as_ref().map(|_| "[REDACTED]"),
+                )
+                .field("coverage", coverage)
+                .field("snapshot_complete", snapshot_complete)
+                .finish(),
+            Self::Failed { .. } => formatter
+                .debug_struct("Failed")
+                .field("error_message", &"[REDACTED]")
+                .finish(),
+            Self::Cancelled { message } => formatter
+                .debug_struct("Cancelled")
+                .field("message", &message.as_ref().map(|_| "[REDACTED]"))
+                .finish(),
+        }
+    }
+}
+
+impl FinishCatalogSyncRun {
+    fn status(&self) -> SyncRunStatus {
+        match self {
+            Self::Succeeded { .. } => SyncRunStatus::Succeeded,
+            Self::Failed { .. } => SyncRunStatus::Failed,
+            Self::Cancelled { .. } => SyncRunStatus::Cancelled,
+        }
+    }
+
+    fn result_cursor(&self) -> Option<&str> {
+        match self {
+            Self::Succeeded { result_cursor, .. } => result_cursor.as_deref(),
+            Self::Failed { .. } | Self::Cancelled { .. } => None,
+        }
+    }
+
+    fn coverage(&self) -> SyncCoverage {
+        match self {
+            Self::Succeeded { coverage, .. } => *coverage,
+            Self::Failed { .. } | Self::Cancelled { .. } => SyncCoverage::DiscoveryOnly,
+        }
+    }
+
+    fn snapshot_complete(&self) -> bool {
+        matches!(
+            self,
+            Self::Succeeded {
+                snapshot_complete: true,
+                ..
+            }
+        )
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FinishedCatalogSyncRun {
+    pub run: CatalogSyncRunSnapshot,
+    /// Number of releases whose first absence marker was set by this run.
+    /// Releases already absent retain their original `not_seen_since` date.
+    pub newly_not_seen: u32,
+}
+
+#[derive(Debug, Error)]
+pub enum CatalogSyncError {
+    #[error("catalog artist {artist_id} does not exist")]
+    ArtistNotFound { artist_id: Uuid },
+    #[error("catalog source {source_id} already exists")]
+    SourceAlreadyExists { source_id: Uuid },
+    #[error("catalog source identity already exists for artist {artist_id}: {kind}")]
+    SourceIdentityAlreadyExists {
+        artist_id: Uuid,
+        kind: CatalogSourceKind,
+    },
+    #[error("catalog source {source_id} does not exist")]
+    SourceNotFound { source_id: Uuid },
+    #[error(
+        "catalog source {source_id} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    SourceConflict {
+        source_id: Uuid,
+        expected: CatalogRowVersion,
+        actual: CatalogRowVersion,
+    },
+    #[error("catalog source {source_id} is disabled")]
+    SourceDisabled { source_id: Uuid },
+    #[error("catalog source credential is not configured for {kind}")]
+    CredentialNotConfigured { kind: CatalogSourceKind },
+    #[error("catalog source credential binding is invalid for {kind}")]
+    CredentialBindingInvalid { kind: CatalogSourceKind },
+    #[error("catalog source adapter is not available for {kind}")]
+    AdapterUnavailable { kind: CatalogSourceKind },
+    #[error("catalog source {source_id} already has a running or contending sync run")]
+    SourceBusy { source_id: Uuid },
+    #[error("catalog sync run {run_id} already exists")]
+    RunAlreadyExists { run_id: Uuid },
+    #[error("catalog sync run {run_id} does not exist")]
+    RunNotFound { run_id: Uuid },
+    #[error(
+        "catalog sync run {run_id} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    RunConflict {
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        actual: CatalogRowVersion,
+    },
+    #[error("catalog sync run {run_id} cannot transition from {from} to {to}")]
+    InvalidRunTransition {
+        run_id: Uuid,
+        from: SyncRunStatus,
+        to: SyncRunStatus,
+    },
+    #[error("catalog sync run {run_id} is {status}, not running")]
+    RunNotRunning { run_id: Uuid, status: SyncRunStatus },
+    #[error("catalog sync run {run_id} is not currently claimable")]
+    RunNotClaimable { run_id: Uuid },
+    #[error("catalog sync run {run_id} is not owned by this worker lease")]
+    LeaseMismatch { run_id: Uuid },
+    #[error("catalog source release {source_release_id} changed concurrently")]
+    ObservationConflict { source_release_id: Uuid },
+    #[error("invalid catalog sync {field}: {message}")]
+    InvalidInput {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("persisted {entity} {id} contains invalid {field}: {value}")]
+    InvalidPersistedValue {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+        value: String,
+    },
+    #[error("persisted source release {source_release_id} has no observation revision")]
+    MissingObservationRevision { source_release_id: Uuid },
+    #[error("persisted source release {source_release_id} revision {revision} has an invalid digest length: {actual}")]
+    InvalidObservationDigestLength {
+        source_release_id: Uuid,
+        revision: u64,
+        actual: usize,
+    },
+    #[error(
+        "persisted source release {source_release_id} revision {revision} failed its SHA-256 check"
+    )]
+    ObservationDigestMismatch {
+        source_release_id: Uuid,
+        revision: u64,
+    },
+    #[error("{entity} {id} has an out-of-range {field}")]
+    NumericOutOfRange {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+    },
+    #[error(transparent)]
+    Database(#[from] DbErr),
+}
+
+#[derive(Clone)]
+pub struct CatalogSyncService {
+    database: DatabaseConnection,
+    provisioning: CatalogSyncProvisioningConfig,
+}
+
+impl CatalogSyncService {
+    pub fn new(database: DatabaseConnection) -> Self {
+        Self::with_provisioning(database, CatalogSyncProvisioningConfig::default())
+    }
+
+    pub fn with_provisioning(
+        database: DatabaseConnection,
+        provisioning: CatalogSyncProvisioningConfig,
+    ) -> Self {
+        Self {
+            database,
+            provisioning,
+        }
+    }
+
+    /// Registers a browser-managed source after binding deployment-owned
+    /// adapter provisioning. The caller cannot supply configuration documents
+    /// or secret references.
+    pub async fn create_managed_source(
+        &self,
+        input: NewManagedCatalogSource,
+    ) -> Result<CatalogSourceSnapshot, CatalogSyncError> {
+        let secret_ref = match input.kind {
+            CatalogSourceKind::AppleMusic => Some(
+                self.provisioning
+                    .apple_music_secret_ref()
+                    .ok_or(CatalogSyncError::CredentialNotConfigured { kind: input.kind })?
+                    .as_str()
+                    .to_owned(),
+            ),
+            CatalogSourceKind::RecordLabel
+            | CatalogSourceKind::ArtistWebsite
+            | CatalogSourceKind::Vgmdb
+            | CatalogSourceKind::Manual => None,
+        };
+        self.create_source(NewCatalogSource {
+            source_id: input.source_id,
+            artist_id: input.artist_id,
+            kind: input.kind,
+            locator: input.locator,
+            storefront: input.storefront,
+            locale: input.locale,
+            configuration_document: None,
+            secret_ref,
+        })
+        .await
+    }
+
+    /// Binds the configured Apple Music credential reference to legacy source
+    /// rows that predate server-side provisioning.
+    ///
+    /// Existing non-null references are never replaced. Each update uses the
+    /// source row version as a compare-and-swap guard, so this is safe to run on
+    /// every Annim startup and returns only the number of rows it changed.
+    pub async fn provision_existing_sources(&self) -> Result<u64, CatalogSyncError> {
+        let Some(secret_ref) = self.provisioning.apple_music_secret_ref() else {
+            return Ok(0);
+        };
+        let sources = catalog_source::Entity::find()
+            .filter(catalog_source::Column::Kind.eq(CatalogSourceKind::AppleMusic.as_str()))
+            .filter(catalog_source::Column::SecretRef.is_null())
+            .all(&self.database)
+            .await?;
+        let mut changed = 0_u64;
+        for source in sources {
+            let current =
+                parse_row_version("catalog source", source.source_id, source.row_version)?;
+            let next = next_row_version("catalog source", source.source_id, current)?;
+            let updated = catalog_source::Entity::update_many()
+                .col_expr(
+                    catalog_source::Column::SecretRef,
+                    Expr::value(Some(secret_ref.as_str().to_owned())),
+                )
+                .col_expr(
+                    catalog_source::Column::RowVersion,
+                    Expr::value(row_version_as_i64(
+                        "catalog source",
+                        source.source_id,
+                        next,
+                    )?),
+                )
+                .col_expr(
+                    catalog_source::Column::UpdatedAt,
+                    Expr::current_timestamp().into(),
+                )
+                .filter(catalog_source::Column::Id.eq(source.id))
+                .filter(catalog_source::Column::SecretRef.is_null())
+                .filter(catalog_source::Column::RowVersion.eq(row_version_as_i64(
+                    "catalog source",
+                    source.source_id,
+                    current,
+                )?))
+                .exec(&self.database)
+                .await?;
+            changed = changed.saturating_add(updated.rows_affected);
+        }
+        Ok(changed)
+    }
+
+    pub async fn create_source(
+        &self,
+        input: NewCatalogSource,
+    ) -> Result<CatalogSourceSnapshot, CatalogSyncError> {
+        require_non_empty("locator", &input.locator)?;
+        let artist = get_artist_model(&self.database, input.artist_id)
+            .await?
+            .ok_or(CatalogSyncError::ArtistNotFound {
+                artist_id: input.artist_id,
+            })?;
+        let source_id = input.source_id.unwrap_or_else(Uuid::new_v4);
+        let identity_locator = input.locator.clone();
+        let active_model = catalog_source::ActiveModel {
+            id: NotSet,
+            source_id: Set(source_id),
+            artist_db_id: Set(artist.id),
+            kind: Set(input.kind.as_str().to_owned()),
+            locator: Set(input.locator),
+            storefront: Set(input.storefront),
+            locale: Set(input.locale),
+            configuration_document: Set(input.configuration_document),
+            secret_ref: Set(input.secret_ref),
+            enabled: Set(true),
+            row_version: Set(1),
+            created_at: NotSet,
+            updated_at: NotSet,
+        };
+
+        if let Err(error) = catalog_source::Entity::insert(active_model)
+            .exec_without_returning(&self.database)
+            .await
+        {
+            if get_source_model(&self.database, source_id).await?.is_some() {
+                return Err(CatalogSyncError::SourceAlreadyExists { source_id });
+            }
+            if catalog_source::Entity::find()
+                .filter(catalog_source::Column::ArtistDbId.eq(artist.id))
+                .filter(catalog_source::Column::Kind.eq(input.kind.as_str()))
+                .filter(catalog_source::Column::Locator.eq(&identity_locator))
+                .one(&self.database)
+                .await?
+                .is_some()
+            {
+                return Err(CatalogSyncError::SourceIdentityAlreadyExists {
+                    artist_id: input.artist_id,
+                    kind: input.kind,
+                });
+            }
+            return Err(error.into());
+        }
+
+        self.get_source(source_id)
+            .await?
+            .ok_or(CatalogSyncError::SourceNotFound { source_id })
+    }
+
+    pub async fn get_source(
+        &self,
+        source_id: Uuid,
+    ) -> Result<Option<CatalogSourceSnapshot>, CatalogSyncError> {
+        let Some(source) = get_source_model(&self.database, source_id).await? else {
+            return Ok(None);
+        };
+        let artist = catalog_artist::Entity::find_by_id(source.artist_db_id)
+            .one(&self.database)
+            .await?
+            .ok_or_else(|| {
+                CatalogSyncError::Database(DbErr::Custom(format!(
+                    "catalog source {source_id} references a missing artist"
+                )))
+            })?;
+        source_model_to_snapshot(source, artist.artist_id).map(Some)
+    }
+
+    /// Lists the configured catalog sources for one artist in a stable order.
+    /// Adapter configuration, secret references, and observation documents
+    /// remain private because they are not part of the returned snapshot.
+    pub async fn list_sources_for_artist(
+        &self,
+        artist_id: Uuid,
+    ) -> Result<Vec<CatalogSourceSnapshot>, CatalogSyncError> {
+        let artist = get_artist_model(&self.database, artist_id)
+            .await?
+            .ok_or(CatalogSyncError::ArtistNotFound { artist_id })?;
+        catalog_source::Entity::find()
+            .filter(catalog_source::Column::ArtistDbId.eq(artist.id))
+            .order_by_asc(catalog_source::Column::Kind)
+            .order_by_asc(catalog_source::Column::CreatedAt)
+            .all(&self.database)
+            .await?
+            .into_iter()
+            .map(|source| source_model_to_snapshot(source, artist_id))
+            .collect()
+    }
+
+    /// Enables or disables a source under optimistic concurrency control.
+    /// Repeating the current value with the current row version is idempotent
+    /// and does not create a meaningless new version.
+    pub async fn set_source_enabled(
+        &self,
+        source_id: Uuid,
+        expected: CatalogRowVersion,
+        enabled: bool,
+    ) -> Result<CatalogSourceSnapshot, CatalogSyncError> {
+        let current = get_source_model(&self.database, source_id)
+            .await?
+            .ok_or(CatalogSyncError::SourceNotFound { source_id })?;
+        let actual = parse_row_version("catalog source", source_id, current.row_version)?;
+        if actual != expected {
+            return Err(CatalogSyncError::SourceConflict {
+                source_id,
+                expected,
+                actual,
+            });
+        }
+        if current.enabled == enabled {
+            return self
+                .get_source(source_id)
+                .await?
+                .ok_or(CatalogSyncError::SourceNotFound { source_id });
+        }
+        let next = next_row_version("catalog source", source_id, expected)?;
+        let updated = catalog_source::Entity::update_many()
+            .col_expr(catalog_source::Column::Enabled, Expr::value(enabled))
+            .col_expr(
+                catalog_source::Column::RowVersion,
+                Expr::value(row_version_as_i64("catalog source", source_id, next)?),
+            )
+            .col_expr(
+                catalog_source::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(catalog_source::Column::SourceId.eq(source_id))
+            .filter(catalog_source::Column::RowVersion.eq(row_version_as_i64(
+                "catalog source",
+                source_id,
+                expected,
+            )?))
+            .exec(&self.database)
+            .await?;
+        if updated.rows_affected != 1 {
+            return source_conflict_or_not_found(&self.database, source_id, expected).await;
+        }
+        self.get_source(source_id)
+            .await?
+            .ok_or(CatalogSyncError::SourceNotFound { source_id })
+    }
+
+    /// Queue a run. A worker must subsequently claim it with the returned row
+    /// version before it may write observations.
+    pub async fn start_run(
+        &self,
+        input: NewCatalogSyncRun,
+    ) -> Result<CatalogSyncRunSnapshot, CatalogSyncError> {
+        let transaction = self.database.begin().await?;
+        let source = get_source_model(&transaction, input.source_id)
+            .await?
+            .ok_or(CatalogSyncError::SourceNotFound {
+                source_id: input.source_id,
+            })?;
+        if !source.enabled {
+            return Err(CatalogSyncError::SourceDisabled {
+                source_id: input.source_id,
+            });
+        }
+        let another_active = catalog_sync_run::Entity::find()
+            .filter(catalog_sync_run::Column::SourceDbId.eq(source.id))
+            .filter(
+                Condition::any()
+                    .add(catalog_sync_run::Column::Status.eq(SyncRunStatus::Queued.as_str()))
+                    .add(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str())),
+            )
+            .one(&transaction)
+            .await?
+            .is_some();
+        if another_active {
+            return Err(CatalogSyncError::SourceBusy {
+                source_id: input.source_id,
+            });
+        }
+
+        // The source row is the per-source enqueue mutex. The active-run query
+        // gives a useful fast failure, while this CAS closes the race between
+        // concurrent server processes that both observed an empty queue.
+        let source_version =
+            parse_row_version("catalog source", source.source_id, source.row_version)?;
+        let next_source_version =
+            next_row_version("catalog source", source.source_id, source_version)?;
+        let source_claim = catalog_source::Entity::update_many()
+            .col_expr(
+                catalog_source::Column::RowVersion,
+                Expr::value(row_version_as_i64(
+                    "catalog source",
+                    source.source_id,
+                    next_source_version,
+                )?),
+            )
+            .col_expr(
+                catalog_source::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(catalog_source::Column::Id.eq(source.id))
+            .filter(catalog_source::Column::Enabled.eq(true))
+            .filter(catalog_source::Column::RowVersion.eq(row_version_as_i64(
+                "catalog source",
+                source.source_id,
+                source_version,
+            )?))
+            .exec(&transaction)
+            .await?;
+        if source_claim.rows_affected != 1 {
+            return Err(CatalogSyncError::SourceBusy {
+                source_id: input.source_id,
+            });
+        }
+
+        let run_id = input.run_id.unwrap_or_else(Uuid::new_v4);
+        let started_from_root = input.requested_cursor.is_none();
+        let active_model = catalog_sync_run::ActiveModel {
+            id: NotSet,
+            run_id: Set(run_id),
+            source_db_id: Set(source.id),
+            status: Set(SyncRunStatus::Queued.as_str().to_owned()),
+            requested_cursor: Set(input.requested_cursor),
+            result_cursor: Set(None),
+            observed_count: Set(0),
+            error_message: Set(None),
+            coverage: Set(SyncCoverage::DiscoveryOnly.as_str().to_owned()),
+            started_from_root: Set(started_from_root),
+            snapshot_complete: Set(false),
+            lease_token: Set(None),
+            lease_expires_at: Set(None),
+            next_attempt_at: Set(None),
+            attempt_count: Set(0),
+            row_version: Set(1),
+            created_at: NotSet,
+            started_at: Set(None),
+            finished_at: Set(None),
+        };
+        if let Err(error) = catalog_sync_run::Entity::insert(active_model)
+            .exec_without_returning(&transaction)
+            .await
+        {
+            if get_run_model(&transaction, run_id).await?.is_some() {
+                return Err(CatalogSyncError::RunAlreadyExists { run_id });
+            }
+            return Err(error.into());
+        }
+        transaction.commit().await?;
+        self.get_run(run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })
+    }
+
+    /// Queues work only when the installed Web-managed adapter can run it.
+    /// Trusted internal callers may use [`Self::start_run`] directly.
+    pub async fn start_managed_run(
+        &self,
+        input: NewCatalogSyncRun,
+    ) -> Result<CatalogSyncRunSnapshot, CatalogSyncError> {
+        let source =
+            self.get_source(input.source_id)
+                .await?
+                .ok_or(CatalogSyncError::SourceNotFound {
+                    source_id: input.source_id,
+                })?;
+        match source.managed_provisioning_state() {
+            CatalogSourceProvisioningState::ReadyToQueue => self.start_run(input).await,
+            CatalogSourceProvisioningState::Disabled => Err(CatalogSyncError::SourceDisabled {
+                source_id: source.source_id,
+            }),
+            CatalogSourceProvisioningState::CredentialNotConfigured => {
+                Err(CatalogSyncError::CredentialNotConfigured { kind: source.kind })
+            }
+            CatalogSourceProvisioningState::CredentialBindingInvalid => {
+                Err(CatalogSyncError::CredentialBindingInvalid { kind: source.kind })
+            }
+            CatalogSourceProvisioningState::AdapterUnavailable => {
+                Err(CatalogSyncError::AdapterUnavailable { kind: source.kind })
+            }
+        }
+    }
+
+    pub async fn get_run(
+        &self,
+        run_id: Uuid,
+    ) -> Result<Option<CatalogSyncRunSnapshot>, CatalogSyncError> {
+        let Some(run) = get_run_model(&self.database, run_id).await? else {
+            return Ok(None);
+        };
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&self.database)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        run_model_to_snapshot(run, source.source_id).map(Some)
+    }
+
+    /// Lists one source's run history newest-first with stable pagination.
+    pub async fn list_runs_for_source(
+        &self,
+        source_id: Uuid,
+        limit: u64,
+        offset: u64,
+    ) -> Result<Vec<CatalogSyncRunSnapshot>, CatalogSyncError> {
+        let source = get_source_model(&self.database, source_id)
+            .await?
+            .ok_or(CatalogSyncError::SourceNotFound { source_id })?;
+        catalog_sync_run::Entity::find()
+            .filter(catalog_sync_run::Column::SourceDbId.eq(source.id))
+            .order_by_desc(catalog_sync_run::Column::CreatedAt)
+            .order_by_desc(catalog_sync_run::Column::Id)
+            .limit(limit)
+            .offset(offset)
+            .all(&self.database)
+            .await?
+            .into_iter()
+            .map(|run| run_model_to_snapshot(run, source_id))
+            .collect()
+    }
+
+    /// Claims a specific queued run or recovers its expired worker lease.
+    pub async fn claim_run(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_for: Duration,
+    ) -> Result<CatalogSyncLease, CatalogSyncError> {
+        self.claim_run_at(run_id, expected, chrono::Utc::now(), lease_for)
+            .await
+    }
+
+    async fn claim_run_at(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        claimed_at: DateTimeUtc,
+        lease_for: Duration,
+    ) -> Result<CatalogSyncLease, CatalogSyncError> {
+        let lease_expires_at = lease_deadline(claimed_at, lease_for)?;
+        let stored_now = store_timestamp(claimed_at);
+        let transaction = self.database.begin().await?;
+        let run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let actual = parse_row_version("sync run", run_id, run.row_version)?;
+        if actual != expected {
+            return Err(CatalogSyncError::RunConflict {
+                run_id,
+                expected,
+                actual,
+            });
+        }
+        let status = parse_run_status(run_id, &run.status)?;
+        let claimable = match status {
+            SyncRunStatus::Queued => run
+                .next_attempt_at
+                .as_ref()
+                .is_none_or(|not_before| timestamp(not_before.to_owned()) <= claimed_at),
+            SyncRunStatus::Running => run
+                .lease_expires_at
+                .as_ref()
+                .is_none_or(|expires_at| timestamp(expires_at.to_owned()) <= claimed_at),
+            SyncRunStatus::Succeeded | SyncRunStatus::Failed | SyncRunStatus::Cancelled => false,
+        };
+        if !claimable {
+            return Err(CatalogSyncError::RunNotClaimable { run_id });
+        }
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        if !source.enabled {
+            return Err(CatalogSyncError::SourceDisabled {
+                source_id: source.source_id,
+            });
+        }
+
+        // `last_seen_at >= started_at` is used to make unchanged observations
+        // idempotent within a run. That inference is only sound when runs for
+        // one source cannot overlap, so the source row is also advanced under
+        // CAS as a durable claim mutex.
+        let another_running = catalog_sync_run::Entity::find()
+            .filter(catalog_sync_run::Column::SourceDbId.eq(source.id))
+            .filter(catalog_sync_run::Column::RunId.ne(run_id))
+            .filter(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str()))
+            .filter(catalog_sync_run::Column::LeaseExpiresAt.gt(stored_now))
+            .one(&transaction)
+            .await?
+            .is_some();
+        if another_running {
+            return Err(CatalogSyncError::SourceBusy {
+                source_id: source.source_id,
+            });
+        }
+        let source_version =
+            parse_row_version("catalog source", source.source_id, source.row_version)?;
+        let next_source_version =
+            next_row_version("catalog source", source.source_id, source_version)?;
+        let source_claim = catalog_source::Entity::update_many()
+            .col_expr(
+                catalog_source::Column::RowVersion,
+                Expr::value(row_version_as_i64(
+                    "catalog source",
+                    source.source_id,
+                    next_source_version,
+                )?),
+            )
+            .col_expr(
+                catalog_source::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(catalog_source::Column::Id.eq(source.id))
+            .filter(catalog_source::Column::RowVersion.eq(row_version_as_i64(
+                "catalog source",
+                source.source_id,
+                source_version,
+            )?))
+            .exec(&transaction)
+            .await?;
+        if source_claim.rows_affected != 1 {
+            return Err(CatalogSyncError::SourceBusy {
+                source_id: source.source_id,
+            });
+        }
+
+        let next = next_row_version("sync run", run_id, expected)?;
+        let attempt_count =
+            run.attempt_count
+                .checked_add(1)
+                .ok_or(CatalogSyncError::NumericOutOfRange {
+                    entity: "sync run",
+                    id: run_id,
+                    field: "attempt_count",
+                })?;
+        let lease_token = Uuid::new_v4();
+        let started_at = run.started_at.unwrap_or(stored_now);
+        let result = catalog_sync_run::Entity::update_many()
+            .col_expr(
+                catalog_sync_run::Column::Status,
+                Expr::value(SyncRunStatus::Running.as_str()),
+            )
+            .col_expr(catalog_sync_run::Column::StartedAt, Expr::value(started_at))
+            .col_expr(
+                catalog_sync_run::Column::LeaseToken,
+                Expr::value(Some(lease_token)),
+            )
+            .col_expr(
+                catalog_sync_run::Column::LeaseExpiresAt,
+                Expr::value(Some(store_timestamp(lease_expires_at))),
+            )
+            .col_expr(
+                catalog_sync_run::Column::NextAttemptAt,
+                Expr::value(None::<PersistedTimestamp>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::AttemptCount,
+                Expr::value(attempt_count),
+            )
+            .col_expr(
+                catalog_sync_run::Column::ErrorMessage,
+                Expr::value(None::<String>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RowVersion,
+                Expr::value(row_version_as_i64("sync run", run_id, next)?),
+            )
+            .filter(catalog_sync_run::Column::RunId.eq(run_id))
+            .filter(
+                catalog_sync_run::Column::RowVersion
+                    .eq(row_version_as_i64("sync run", run_id, expected)?),
+            )
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return run_conflict_or_not_found(&transaction, run_id, expected).await;
+        }
+        let updated = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let lease = lease_from_models(updated, source, lease_token, lease_expires_at)?;
+        transaction.commit().await?;
+        Ok(lease)
+    }
+
+    /// Claims the oldest due run. Expired leases are eligible, so a dead
+    /// worker cannot wedge catalog synchronization permanently.
+    pub async fn claim_next(
+        &self,
+        lease_for: Duration,
+    ) -> Result<Option<CatalogSyncLease>, CatalogSyncError> {
+        self.claim_next_at(chrono::Utc::now(), lease_for).await
+    }
+
+    async fn claim_next_at(
+        &self,
+        claimed_at: DateTimeUtc,
+        lease_for: Duration,
+    ) -> Result<Option<CatalogSyncLease>, CatalogSyncError> {
+        // Validate before polling so an empty queue does not hide bad worker
+        // configuration.
+        lease_deadline(claimed_at, lease_for)?;
+        let stored_now = store_timestamp(claimed_at);
+        let enabled_source_ids = Query::select()
+            .column(catalog_source::Column::Id)
+            .from(catalog_source::Entity)
+            .and_where(catalog_source::Column::Enabled.eq(true))
+            .to_owned();
+        let mut skipped_run_ids = Vec::new();
+        let mut skipped_source_db_ids = Vec::new();
+        for _ in 0..MAX_CLAIM_CAS_ATTEMPTS {
+            let queued_due = Condition::all()
+                .add(catalog_sync_run::Column::Status.eq(SyncRunStatus::Queued.as_str()))
+                .add(
+                    Condition::any()
+                        .add(catalog_sync_run::Column::NextAttemptAt.is_null())
+                        .add(catalog_sync_run::Column::NextAttemptAt.lte(stored_now)),
+                );
+            let expired_running = Condition::all()
+                .add(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str()))
+                .add(
+                    Condition::any()
+                        .add(catalog_sync_run::Column::LeaseExpiresAt.is_null())
+                        .add(catalog_sync_run::Column::LeaseExpiresAt.lte(stored_now)),
+                );
+            let mut query = catalog_sync_run::Entity::find()
+                .filter(Condition::any().add(queued_due).add(expired_running))
+                .filter(
+                    catalog_sync_run::Column::SourceDbId.in_subquery(enabled_source_ids.clone()),
+                )
+                .order_by_asc(catalog_sync_run::Column::NextAttemptAt)
+                .order_by_asc(catalog_sync_run::Column::CreatedAt)
+                .order_by_asc(catalog_sync_run::Column::Id)
+                .limit(1);
+            if !skipped_run_ids.is_empty() {
+                query = query
+                    .filter(catalog_sync_run::Column::RunId.is_not_in(skipped_run_ids.clone()));
+            }
+            if !skipped_source_db_ids.is_empty() {
+                query = query.filter(
+                    catalog_sync_run::Column::SourceDbId.is_not_in(skipped_source_db_ids.clone()),
+                );
+            }
+            let Some(run) = query.one(&self.database).await? else {
+                return Ok(None);
+            };
+            let expected = parse_row_version("sync run", run.run_id, run.row_version)?;
+            match self
+                .claim_run_at(run.run_id, expected, claimed_at, lease_for)
+                .await
+            {
+                Ok(lease) => return Ok(Some(lease)),
+                Err(
+                    CatalogSyncError::SourceBusy { .. } | CatalogSyncError::SourceDisabled { .. },
+                ) => {
+                    skipped_source_db_ids.push(run.source_db_id);
+                }
+                Err(
+                    CatalogSyncError::RunConflict { .. } | CatalogSyncError::RunNotClaimable { .. },
+                ) => skipped_run_ids.push(run.run_id),
+                Err(error) => return Err(error),
+            }
+        }
+        Ok(None)
+    }
+
+    pub async fn renew_lease(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_token: Uuid,
+        lease_for: Duration,
+    ) -> Result<CatalogSyncLease, CatalogSyncError> {
+        self.renew_lease_at(run_id, expected, lease_token, chrono::Utc::now(), lease_for)
+            .await
+    }
+
+    async fn renew_lease_at(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_token: Uuid,
+        renewed_at: DateTimeUtc,
+        lease_for: Duration,
+    ) -> Result<CatalogSyncLease, CatalogSyncError> {
+        let lease_expires_at = lease_deadline(renewed_at, lease_for)?;
+        let transaction = self.database.begin().await?;
+        let run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        ensure_current_lease(&run, expected, lease_token, renewed_at)?;
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        let next = next_row_version("sync run", run_id, expected)?;
+        let result = catalog_sync_run::Entity::update_many()
+            .col_expr(
+                catalog_sync_run::Column::LeaseExpiresAt,
+                Expr::value(Some(store_timestamp(lease_expires_at))),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RowVersion,
+                Expr::value(row_version_as_i64("sync run", run_id, next)?),
+            )
+            .filter(catalog_sync_run::Column::RunId.eq(run_id))
+            .filter(catalog_sync_run::Column::LeaseToken.eq(lease_token))
+            .filter(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str()))
+            .filter(
+                catalog_sync_run::Column::RowVersion
+                    .eq(row_version_as_i64("sync run", run_id, expected)?),
+            )
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return run_conflict_or_not_found(&transaction, run_id, expected).await;
+        }
+        let updated = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let lease = lease_from_models(updated, source, lease_token, lease_expires_at)?;
+        transaction.commit().await?;
+        Ok(lease)
+    }
+
+    /// Releases a current worker lease back to the queue after a recoverable
+    /// adapter failure. Progress and observations remain attached to the same
+    /// run; a later claim receives a fresh token and increments attempt_count.
+    pub async fn retry_run(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_token: Uuid,
+        error_message: &str,
+        resume_cursor: Option<String>,
+        not_before: DateTimeUtc,
+    ) -> Result<CatalogSyncRunSnapshot, CatalogSyncError> {
+        if error_message.is_empty() {
+            return Err(CatalogSyncError::InvalidInput {
+                field: "error_message",
+                message: "retry must include an error message",
+            });
+        }
+        let checked_at = chrono::Utc::now();
+        let transaction = self.database.begin().await?;
+        let run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        ensure_current_lease(&run, expected, lease_token, checked_at)?;
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        let next = next_row_version("sync run", run_id, expected)?;
+        let stored_error = sanitize_sync_error(error_message)
+            .unwrap_or_else(|| "source adapter retry scheduled".to_owned());
+        let result = catalog_sync_run::Entity::update_many()
+            .col_expr(
+                catalog_sync_run::Column::Status,
+                Expr::value(SyncRunStatus::Queued.as_str()),
+            )
+            .col_expr(
+                catalog_sync_run::Column::ErrorMessage,
+                Expr::value(Some(stored_error)),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RequestedCursor,
+                Expr::value(resume_cursor),
+            )
+            .col_expr(
+                catalog_sync_run::Column::LeaseToken,
+                Expr::value(None::<Uuid>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::LeaseExpiresAt,
+                Expr::value(None::<PersistedTimestamp>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::NextAttemptAt,
+                Expr::value(Some(store_timestamp(not_before))),
+            )
+            .col_expr(
+                catalog_sync_run::Column::SnapshotComplete,
+                Expr::value(false),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RowVersion,
+                Expr::value(row_version_as_i64("sync run", run_id, next)?),
+            )
+            .filter(catalog_sync_run::Column::RunId.eq(run_id))
+            .filter(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str()))
+            .filter(catalog_sync_run::Column::LeaseToken.eq(lease_token))
+            .filter(
+                catalog_sync_run::Column::RowVersion
+                    .eq(row_version_as_i64("sync run", run_id, expected)?),
+            )
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return run_conflict_or_not_found(&transaction, run_id, expected).await;
+        }
+        let updated = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let snapshot = run_model_to_snapshot(updated, source.source_id)?;
+        transaction.commit().await?;
+        Ok(snapshot)
+    }
+
+    /// Persist an observation and advance the run under one transaction.
+    ///
+    /// `expected` is the run version returned by `claim_run` or the previous
+    /// call. This serializes a worker's progress and makes retry behavior
+    /// explicit to both Web clients and background jobs.
+    pub async fn record_observation(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_token: Uuid,
+        input: CatalogReleaseObservation,
+    ) -> Result<RecordedCatalogObservation, CatalogSyncError> {
+        validate_observation(&input)?;
+        let raw_sha256 = sha256(input.raw_document.as_bytes());
+        let transaction = self.database.begin().await?;
+        let run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let observed_at_utc = chrono::Utc::now();
+        ensure_current_lease(&run, expected, lease_token, observed_at_utc)?;
+        let started_at = run
+            .started_at
+            .ok_or_else(|| CatalogSyncError::InvalidPersistedValue {
+                entity: "sync run",
+                id: run_id,
+                field: "started_at",
+                value: "missing for running run".to_owned(),
+            })?;
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        let observed_at = store_timestamp(observed_at_utc);
+
+        let existing =
+            get_source_release_model(&transaction, run.source_db_id, &input.external_release_id)
+                .await?;
+
+        let (release, revision, revision_appended, first_observation_in_run) =
+            if let Some(existing) = existing {
+                let latest = latest_revision(&transaction, existing.id).await?.ok_or(
+                    CatalogSyncError::MissingObservationRevision {
+                        source_release_id: existing.source_release_id,
+                    },
+                )?;
+                let latest_revision = checked_revision(&latest, existing.source_release_id)?;
+                let latest_digest = checked_revision_digest(&latest, existing.source_release_id)?;
+                let same_content = latest_digest == raw_sha256
+                    && latest.raw_document == input.raw_document
+                    && latest.parsed_document == input.parsed_document;
+                let seen_in_this_run = existing.last_seen_at >= started_at;
+
+                // A worker retry after a timeout is a read, not a new event.
+                // The expected run version is still checked above, so stale
+                // callers cannot mistake another worker's progress for theirs.
+                if seen_in_this_run
+                    && same_content
+                    && existing.source_url == input.source_url
+                    && existing.not_seen_since.is_none()
+                {
+                    let run_snapshot = run_model_to_snapshot(run, source.source_id)?;
+                    let observation =
+                        observation_snapshot(existing, latest_revision, latest_digest)?;
+                    transaction.commit().await?;
+                    return Ok(RecordedCatalogObservation {
+                        run: run_snapshot,
+                        observation,
+                        revision_appended: false,
+                        first_observation_in_run: false,
+                    });
+                }
+
+                let expected_release_version = parse_row_version(
+                    "source release",
+                    existing.source_release_id,
+                    existing.row_version,
+                )?;
+                let next_release_version = next_row_version(
+                    "source release",
+                    existing.source_release_id,
+                    expected_release_version,
+                )?;
+                let result = catalog_source_release::Entity::update_many()
+                    .col_expr(
+                        catalog_source_release::Column::SourceUrl,
+                        Expr::value(&input.source_url),
+                    )
+                    .col_expr(
+                        catalog_source_release::Column::LastSeenAt,
+                        Expr::value(observed_at),
+                    )
+                    .col_expr(
+                        catalog_source_release::Column::NotSeenSince,
+                        Expr::value(None::<DateTimeUtc>),
+                    )
+                    .col_expr(
+                        catalog_source_release::Column::RowVersion,
+                        Expr::value(row_version_as_i64(
+                            "source release",
+                            existing.source_release_id,
+                            next_release_version,
+                        )?),
+                    )
+                    .filter(catalog_source_release::Column::Id.eq(existing.id))
+                    .filter(
+                        catalog_source_release::Column::RowVersion.eq(row_version_as_i64(
+                            "source release",
+                            existing.source_release_id,
+                            expected_release_version,
+                        )?),
+                    )
+                    .exec(&transaction)
+                    .await?;
+                if result.rows_affected != 1 {
+                    return Err(CatalogSyncError::ObservationConflict {
+                        source_release_id: existing.source_release_id,
+                    });
+                }
+
+                let revision = if same_content {
+                    latest_revision
+                } else {
+                    let next_revision = next_revision(existing.source_release_id, latest_revision)?;
+                    insert_revision(
+                        &transaction,
+                        existing.id,
+                        next_revision,
+                        run_id,
+                        &input,
+                        raw_sha256,
+                        observed_at,
+                    )
+                    .await?;
+                    next_revision
+                };
+                let release = catalog_source_release::Entity::find_by_id(existing.id)
+                    .one(&transaction)
+                    .await?
+                    .ok_or(CatalogSyncError::ObservationConflict {
+                        source_release_id: existing.source_release_id,
+                    })?;
+                (release, revision, !same_content, !seen_in_this_run)
+            } else {
+                let source_release_id = Uuid::new_v4();
+                let insert =
+                    catalog_source_release::Entity::insert(catalog_source_release::ActiveModel {
+                        id: NotSet,
+                        source_release_id: Set(source_release_id),
+                        source_db_id: Set(run.source_db_id),
+                        external_release_id: Set(input.external_release_id.clone()),
+                        source_url: Set(input.source_url.clone()),
+                        linked_release_db_id: Set(None),
+                        first_seen_at: Set(observed_at),
+                        last_seen_at: Set(observed_at),
+                        not_seen_since: Set(None),
+                        row_version: Set(1),
+                    })
+                    .exec(&transaction)
+                    .await?;
+                insert_revision(
+                    &transaction,
+                    insert.last_insert_id,
+                    1,
+                    run_id,
+                    &input,
+                    raw_sha256,
+                    observed_at,
+                )
+                .await?;
+                let release = catalog_source_release::Entity::find_by_id(insert.last_insert_id)
+                    .one(&transaction)
+                    .await?
+                    .ok_or(CatalogSyncError::ObservationConflict { source_release_id })?;
+                (release, 1, true, true)
+            };
+
+        let next_run_version = next_row_version("sync run", run_id, expected)?;
+        let observed_count = checked_observed_count(run_id, run.observed_count)?;
+        let next_observed_count = if first_observation_in_run {
+            observed_count
+                .checked_add(1)
+                .filter(|value| i32::try_from(*value).is_ok())
+                .ok_or(CatalogSyncError::NumericOutOfRange {
+                    entity: "sync run",
+                    id: run_id,
+                    field: "observed_count",
+                })?
+        } else {
+            observed_count
+        };
+        let result = catalog_sync_run::Entity::update_many()
+            .col_expr(
+                catalog_sync_run::Column::ObservedCount,
+                Expr::value(i32::try_from(next_observed_count).map_err(|_| {
+                    CatalogSyncError::NumericOutOfRange {
+                        entity: "sync run",
+                        id: run_id,
+                        field: "observed_count",
+                    }
+                })?),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RowVersion,
+                Expr::value(row_version_as_i64("sync run", run_id, next_run_version)?),
+            )
+            .filter(catalog_sync_run::Column::RunId.eq(run_id))
+            .filter(
+                catalog_sync_run::Column::RowVersion
+                    .eq(row_version_as_i64("sync run", run_id, expected)?),
+            )
+            .filter(catalog_sync_run::Column::Status.eq(SyncRunStatus::Running.as_str()))
+            .filter(catalog_sync_run::Column::LeaseToken.eq(lease_token))
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return run_conflict_or_not_found(&transaction, run_id, expected).await;
+        }
+
+        let updated_run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let run_snapshot = run_model_to_snapshot(updated_run, source.source_id)?;
+        let observation = observation_snapshot(release, revision, raw_sha256)?;
+        transaction.commit().await?;
+        Ok(RecordedCatalogObservation {
+            run: run_snapshot,
+            observation,
+            revision_appended,
+            first_observation_in_run,
+        })
+    }
+
+    /// Finish a run. Only a successful run is allowed to infer absence; failed
+    /// or cancelled runs leave the previous collection view untouched.
+    pub async fn finish_run(
+        &self,
+        run_id: Uuid,
+        expected: CatalogRowVersion,
+        lease_token: Uuid,
+        outcome: FinishCatalogSyncRun,
+    ) -> Result<FinishedCatalogSyncRun, CatalogSyncError> {
+        if matches!(&outcome, FinishCatalogSyncRun::Failed { error_message } if error_message.is_empty())
+        {
+            return Err(CatalogSyncError::InvalidInput {
+                field: "error_message",
+                message: "failure must include an error message",
+            });
+        }
+        let transaction = self.database.begin().await?;
+        let run = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let actual = parse_row_version("sync run", run_id, run.row_version)?;
+        if actual != expected {
+            return Err(CatalogSyncError::RunConflict {
+                run_id,
+                expected,
+                actual,
+            });
+        }
+        let status = parse_run_status(run_id, &run.status)?;
+        let next_status = outcome.status();
+        let stored_error = match &outcome {
+            FinishCatalogSyncRun::Succeeded { .. } => None,
+            FinishCatalogSyncRun::Failed { error_message } => Some(
+                sanitize_sync_error(error_message)
+                    .unwrap_or_else(|| "source adapter failed".to_owned()),
+            ),
+            FinishCatalogSyncRun::Cancelled { message } => {
+                message.as_deref().and_then(sanitize_sync_error)
+            }
+        };
+        let source = catalog_source::Entity::find_by_id(run.source_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_run_source(run_id))?;
+        let coverage = outcome.coverage();
+        let snapshot_complete = outcome.snapshot_complete();
+
+        // Retrying a completed command with the current version is a no-op.
+        if status == next_status
+            && run.result_cursor.as_deref() == outcome.result_cursor()
+            && run.error_message.as_deref() == stored_error.as_deref()
+            && run.coverage == coverage.as_str()
+            && run.snapshot_complete == snapshot_complete
+            && run.finished_at.is_some()
+        {
+            let snapshot = run_model_to_snapshot(run, source.source_id)?;
+            transaction.commit().await?;
+            return Ok(FinishedCatalogSyncRun {
+                run: snapshot,
+                newly_not_seen: 0,
+            });
+        }
+        if !status.can_transition_to(next_status) || status == next_status {
+            return Err(CatalogSyncError::InvalidRunTransition {
+                run_id,
+                from: status,
+                to: next_status,
+            });
+        }
+
+        let finished_at_utc = chrono::Utc::now();
+        ensure_current_lease(&run, expected, lease_token, finished_at_utc)?;
+        let finished_at = store_timestamp(finished_at_utc);
+        let mut newly_not_seen = 0_u32;
+        if next_status == SyncRunStatus::Succeeded
+            && coverage.may_infer_absence()
+            && run.started_from_root
+            && snapshot_complete
+        {
+            let started_at =
+                run.started_at
+                    .ok_or_else(|| CatalogSyncError::InvalidPersistedValue {
+                        entity: "sync run",
+                        id: run_id,
+                        field: "started_at",
+                        value: "missing for successful run".to_owned(),
+                    })?;
+            let absent = catalog_source_release::Entity::find()
+                .filter(catalog_source_release::Column::SourceDbId.eq(run.source_db_id))
+                .filter(catalog_source_release::Column::LastSeenAt.lt(started_at))
+                .filter(catalog_source_release::Column::NotSeenSince.is_null())
+                .all(&transaction)
+                .await?;
+            for release in absent {
+                let current = parse_row_version(
+                    "source release",
+                    release.source_release_id,
+                    release.row_version,
+                )?;
+                let next = next_row_version("source release", release.source_release_id, current)?;
+                let result = catalog_source_release::Entity::update_many()
+                    .col_expr(
+                        catalog_source_release::Column::NotSeenSince,
+                        Expr::value(finished_at),
+                    )
+                    .col_expr(
+                        catalog_source_release::Column::RowVersion,
+                        Expr::value(row_version_as_i64(
+                            "source release",
+                            release.source_release_id,
+                            next,
+                        )?),
+                    )
+                    .filter(catalog_source_release::Column::Id.eq(release.id))
+                    .filter(
+                        catalog_source_release::Column::RowVersion.eq(row_version_as_i64(
+                            "source release",
+                            release.source_release_id,
+                            current,
+                        )?),
+                    )
+                    .exec(&transaction)
+                    .await?;
+                if result.rows_affected != 1 {
+                    return Err(CatalogSyncError::ObservationConflict {
+                        source_release_id: release.source_release_id,
+                    });
+                }
+                newly_not_seen =
+                    newly_not_seen
+                        .checked_add(1)
+                        .ok_or(CatalogSyncError::NumericOutOfRange {
+                            entity: "sync run",
+                            id: run_id,
+                            field: "newly_not_seen",
+                        })?;
+            }
+        }
+
+        let next = next_row_version("sync run", run_id, expected)?;
+        let result = catalog_sync_run::Entity::update_many()
+            .col_expr(
+                catalog_sync_run::Column::Status,
+                Expr::value(next_status.as_str()),
+            )
+            .col_expr(
+                catalog_sync_run::Column::ResultCursor,
+                Expr::value(outcome.result_cursor().map(str::to_owned)),
+            )
+            .col_expr(
+                catalog_sync_run::Column::ErrorMessage,
+                Expr::value(stored_error),
+            )
+            .col_expr(
+                catalog_sync_run::Column::Coverage,
+                Expr::value(coverage.as_str()),
+            )
+            .col_expr(
+                catalog_sync_run::Column::SnapshotComplete,
+                Expr::value(snapshot_complete),
+            )
+            .col_expr(
+                catalog_sync_run::Column::FinishedAt,
+                Expr::value(finished_at),
+            )
+            .col_expr(
+                catalog_sync_run::Column::LeaseToken,
+                Expr::value(None::<Uuid>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::LeaseExpiresAt,
+                Expr::value(None::<PersistedTimestamp>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::NextAttemptAt,
+                Expr::value(None::<PersistedTimestamp>),
+            )
+            .col_expr(
+                catalog_sync_run::Column::RowVersion,
+                Expr::value(row_version_as_i64("sync run", run_id, next)?),
+            )
+            .filter(catalog_sync_run::Column::RunId.eq(run_id))
+            .filter(
+                catalog_sync_run::Column::RowVersion
+                    .eq(row_version_as_i64("sync run", run_id, expected)?),
+            )
+            .filter(catalog_sync_run::Column::Status.eq(status.as_str()))
+            .filter(catalog_sync_run::Column::LeaseToken.eq(lease_token))
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return run_conflict_or_not_found(&transaction, run_id, expected).await;
+        }
+
+        let updated = get_run_model(&transaction, run_id)
+            .await?
+            .ok_or(CatalogSyncError::RunNotFound { run_id })?;
+        let snapshot = run_model_to_snapshot(updated, source.source_id)?;
+        transaction.commit().await?;
+        Ok(FinishedCatalogSyncRun {
+            run: snapshot,
+            newly_not_seen,
+        })
+    }
+}
+
+async fn get_artist_model<C: ConnectionTrait>(
+    connection: &C,
+    artist_id: Uuid,
+) -> Result<Option<catalog_artist::Model>, DbErr> {
+    catalog_artist::Entity::find()
+        .filter(catalog_artist::Column::ArtistId.eq(artist_id))
+        .one(connection)
+        .await
+}
+
+async fn get_source_model<C: ConnectionTrait>(
+    connection: &C,
+    source_id: Uuid,
+) -> Result<Option<catalog_source::Model>, DbErr> {
+    catalog_source::Entity::find()
+        .filter(catalog_source::Column::SourceId.eq(source_id))
+        .one(connection)
+        .await
+}
+
+async fn get_run_model<C: ConnectionTrait>(
+    connection: &C,
+    run_id: Uuid,
+) -> Result<Option<catalog_sync_run::Model>, DbErr> {
+    catalog_sync_run::Entity::find()
+        .filter(catalog_sync_run::Column::RunId.eq(run_id))
+        .one(connection)
+        .await
+}
+
+fn lease_deadline(
+    claimed_at: DateTimeUtc,
+    lease_for: Duration,
+) -> Result<DateTimeUtc, CatalogSyncError> {
+    if lease_for.is_zero() {
+        return Err(CatalogSyncError::InvalidInput {
+            field: "lease_for",
+            message: "duration must be positive",
+        });
+    }
+    let delta =
+        chrono::Duration::from_std(lease_for).map_err(|_| CatalogSyncError::InvalidInput {
+            field: "lease_for",
+            message: "duration is too large",
+        })?;
+    claimed_at
+        .checked_add_signed(delta)
+        .ok_or(CatalogSyncError::InvalidInput {
+            field: "lease_for",
+            message: "duration overflows timestamp",
+        })
+}
+
+fn ensure_current_lease(
+    run: &catalog_sync_run::Model,
+    expected: CatalogRowVersion,
+    lease_token: Uuid,
+    checked_at: DateTimeUtc,
+) -> Result<(), CatalogSyncError> {
+    let run_id = run.run_id;
+    let actual = parse_row_version("sync run", run_id, run.row_version)?;
+    if actual != expected {
+        return Err(CatalogSyncError::RunConflict {
+            run_id,
+            expected,
+            actual,
+        });
+    }
+    let status = parse_run_status(run_id, &run.status)?;
+    if status != SyncRunStatus::Running {
+        return Err(CatalogSyncError::RunNotRunning { run_id, status });
+    }
+    let current = run.lease_token == Some(lease_token)
+        && run
+            .lease_expires_at
+            .as_ref()
+            .is_some_and(|expires_at| timestamp(expires_at.to_owned()) > checked_at);
+    if !current {
+        return Err(CatalogSyncError::LeaseMismatch { run_id });
+    }
+    Ok(())
+}
+
+fn lease_from_models(
+    run: catalog_sync_run::Model,
+    source: catalog_source::Model,
+    lease_token: Uuid,
+    lease_expires_at: DateTimeUtc,
+) -> Result<CatalogSyncLease, CatalogSyncError> {
+    let run_id = run.run_id;
+    let source_id = source.source_id;
+    let kind = CatalogSourceKind::from_str(&source.kind).map_err(|_| {
+        CatalogSyncError::InvalidPersistedValue {
+            entity: "catalog source",
+            id: source_id,
+            field: "kind",
+            value: source.kind.clone(),
+        }
+    })?;
+    Ok(CatalogSyncLease {
+        run_id,
+        source_id,
+        kind,
+        locator: source.locator,
+        storefront: source.storefront,
+        locale: source.locale,
+        configuration_document: source.configuration_document,
+        secret_ref: source.secret_ref,
+        requested_cursor: run.requested_cursor,
+        lease_token,
+        lease_expires_at,
+        attempt_count: checked_attempt_count(run_id, run.attempt_count)?,
+        row_version: parse_row_version("sync run", run_id, run.row_version)?,
+    })
+}
+
+async fn get_source_release_model<C: ConnectionTrait>(
+    connection: &C,
+    source_db_id: i32,
+    external_release_id: &str,
+) -> Result<Option<catalog_source_release::Model>, DbErr> {
+    catalog_source_release::Entity::find()
+        .filter(catalog_source_release::Column::SourceDbId.eq(source_db_id))
+        .filter(catalog_source_release::Column::ExternalReleaseId.eq(external_release_id))
+        .one(connection)
+        .await
+}
+
+async fn latest_revision<C: ConnectionTrait>(
+    connection: &C,
+    source_release_db_id: i32,
+) -> Result<Option<catalog_source_release_revision::Model>, DbErr> {
+    catalog_source_release_revision::Entity::find()
+        .filter(catalog_source_release_revision::Column::SourceReleaseDbId.eq(source_release_db_id))
+        .order_by_desc(catalog_source_release_revision::Column::Revision)
+        .one(connection)
+        .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn insert_revision<C: ConnectionTrait>(
+    connection: &C,
+    source_release_db_id: i32,
+    revision: u64,
+    run_id: Uuid,
+    input: &CatalogReleaseObservation,
+    raw_sha256: Digest,
+    observed_at: PersistedTimestamp,
+) -> Result<(), CatalogSyncError> {
+    let persisted_revision =
+        i64::try_from(revision).map_err(|_| CatalogSyncError::NumericOutOfRange {
+            entity: "source release revision",
+            id: run_id,
+            field: "revision",
+        })?;
+    catalog_source_release_revision::Entity::insert(catalog_source_release_revision::ActiveModel {
+        id: NotSet,
+        source_release_db_id: Set(source_release_db_id),
+        revision: Set(persisted_revision),
+        sync_run_id: Set(run_id),
+        raw_document: Set(input.raw_document.clone()),
+        parsed_document: Set(input.parsed_document.clone()),
+        raw_sha256: Set(raw_sha256.as_bytes().to_vec()),
+        observed_at: Set(observed_at),
+    })
+    .exec_without_returning(connection)
+    .await?;
+    Ok(())
+}
+
+async fn run_conflict_or_not_found<C: ConnectionTrait, T>(
+    connection: &C,
+    run_id: Uuid,
+    expected: CatalogRowVersion,
+) -> Result<T, CatalogSyncError> {
+    match get_run_model(connection, run_id).await? {
+        Some(actual) => Err(CatalogSyncError::RunConflict {
+            run_id,
+            expected,
+            actual: parse_row_version("sync run", run_id, actual.row_version)?,
+        }),
+        None => Err(CatalogSyncError::RunNotFound { run_id }),
+    }
+}
+
+async fn source_conflict_or_not_found<C: ConnectionTrait, T>(
+    connection: &C,
+    source_id: Uuid,
+    expected: CatalogRowVersion,
+) -> Result<T, CatalogSyncError> {
+    match get_source_model(connection, source_id).await? {
+        Some(actual) => Err(CatalogSyncError::SourceConflict {
+            source_id,
+            expected,
+            actual: parse_row_version("catalog source", source_id, actual.row_version)?,
+        }),
+        None => Err(CatalogSyncError::SourceNotFound { source_id }),
+    }
+}
+
+fn source_model_to_snapshot(
+    model: catalog_source::Model,
+    artist_id: Uuid,
+) -> Result<CatalogSourceSnapshot, CatalogSyncError> {
+    let source_id = model.source_id;
+    let kind = CatalogSourceKind::from_str(&model.kind).map_err(|_| {
+        CatalogSyncError::InvalidPersistedValue {
+            entity: "catalog source",
+            id: source_id,
+            field: "kind",
+            value: model.kind.clone(),
+        }
+    })?;
+    let provisioning_state =
+        source_provisioning_state(kind, model.enabled, model.secret_ref.as_deref());
+    Ok(CatalogSourceSnapshot {
+        source_id,
+        artist_id,
+        kind,
+        locator: model.locator,
+        storefront: model.storefront,
+        locale: model.locale,
+        enabled: model.enabled,
+        provisioning_state,
+        row_version: parse_row_version("catalog source", source_id, model.row_version)?,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+fn source_provisioning_state(
+    kind: CatalogSourceKind,
+    enabled: bool,
+    secret_ref: Option<&str>,
+) -> CatalogSourceProvisioningState {
+    if !enabled {
+        return CatalogSourceProvisioningState::Disabled;
+    }
+    match kind {
+        CatalogSourceKind::AppleMusic => match secret_ref {
+            None => CatalogSourceProvisioningState::CredentialNotConfigured,
+            Some(value)
+                if CatalogSecretRef::parse("catalog_source.secret_ref", value.to_owned())
+                    .is_ok() =>
+            {
+                CatalogSourceProvisioningState::ReadyToQueue
+            }
+            Some(_) => CatalogSourceProvisioningState::CredentialBindingInvalid,
+        },
+        CatalogSourceKind::RecordLabel
+        | CatalogSourceKind::ArtistWebsite
+        | CatalogSourceKind::Vgmdb
+        | CatalogSourceKind::Manual => CatalogSourceProvisioningState::AdapterUnavailable,
+    }
+}
+
+fn run_model_to_snapshot(
+    model: catalog_sync_run::Model,
+    source_id: Uuid,
+) -> Result<CatalogSyncRunSnapshot, CatalogSyncError> {
+    let run_id = model.run_id;
+    let coverage = parse_sync_coverage(run_id, &model.coverage)?;
+    Ok(CatalogSyncRunSnapshot {
+        run_id,
+        source_id,
+        status: parse_run_status(run_id, &model.status)?,
+        requested_cursor: model.requested_cursor,
+        result_cursor: model.result_cursor,
+        observed_count: checked_observed_count(run_id, model.observed_count)?,
+        error_message: model.error_message,
+        coverage,
+        started_from_root: model.started_from_root,
+        snapshot_complete: model.snapshot_complete,
+        attempt_count: checked_attempt_count(run_id, model.attempt_count)?,
+        next_attempt_at: model.next_attempt_at.map(timestamp),
+        row_version: parse_row_version("sync run", run_id, model.row_version)?,
+        created_at: timestamp(model.created_at),
+        started_at: model.started_at.map(timestamp),
+        finished_at: model.finished_at.map(timestamp),
+    })
+}
+
+fn observation_snapshot(
+    model: catalog_source_release::Model,
+    revision: u64,
+    raw_sha256: Digest,
+) -> Result<CatalogObservationSnapshot, CatalogSyncError> {
+    let source_release_id = model.source_release_id;
+    Ok(CatalogObservationSnapshot {
+        source_release_id,
+        external_release_id: model.external_release_id,
+        source_url: model.source_url,
+        revision,
+        raw_sha256,
+        first_seen_at: timestamp(model.first_seen_at),
+        last_seen_at: timestamp(model.last_seen_at),
+        not_seen_since: model.not_seen_since.map(timestamp),
+        row_version: parse_row_version("source release", source_release_id, model.row_version)?,
+    })
+}
+
+fn checked_revision(
+    model: &catalog_source_release_revision::Model,
+    source_release_id: Uuid,
+) -> Result<u64, CatalogSyncError> {
+    u64::try_from(model.revision)
+        .ok()
+        .filter(|revision| *revision > 0)
+        .ok_or_else(|| CatalogSyncError::InvalidPersistedValue {
+            entity: "source release",
+            id: source_release_id,
+            field: "revision",
+            value: model.revision.to_string(),
+        })
+}
+
+fn checked_revision_digest(
+    model: &catalog_source_release_revision::Model,
+    source_release_id: Uuid,
+) -> Result<Digest, CatalogSyncError> {
+    let revision = checked_revision(model, source_release_id)?;
+    let actual = model.raw_sha256.len();
+    let stored = <[u8; Digest::LENGTH]>::try_from(model.raw_sha256.as_slice())
+        .map(Digest::new)
+        .map_err(|_| CatalogSyncError::InvalidObservationDigestLength {
+            source_release_id,
+            revision,
+            actual,
+        })?;
+    if sha256(model.raw_document.as_bytes()) != stored {
+        return Err(CatalogSyncError::ObservationDigestMismatch {
+            source_release_id,
+            revision,
+        });
+    }
+    Ok(stored)
+}
+
+fn validate_observation(input: &CatalogReleaseObservation) -> Result<(), CatalogSyncError> {
+    require_non_empty("external_release_id", &input.external_release_id)?;
+    require_non_empty("source_url", &input.source_url)?;
+    require_non_empty("raw_document", &input.raw_document)?;
+    require_non_empty("parsed_document", &input.parsed_document)
+}
+
+fn require_non_empty(field: &'static str, value: &str) -> Result<(), CatalogSyncError> {
+    if value.is_empty() {
+        Err(CatalogSyncError::InvalidInput {
+            field,
+            message: "value must not be empty",
+        })
+    } else {
+        Ok(())
+    }
+}
+
+/// Keep operator-facing failures useful without persisting credentials or
+/// signed endpoints returned by a source adapter. Detailed adapter errors
+/// belong in a worker-local, access-controlled log.
+fn sanitize_sync_error(message: &str) -> Option<String> {
+    let lowercase = message.to_ascii_lowercase();
+    let sensitive = message.contains("://")
+        || message.contains('?')
+        || [
+            "authorization",
+            "credential",
+            "password",
+            "secret",
+            "signature",
+            "token",
+        ]
+        .iter()
+        .any(|needle| lowercase.contains(needle));
+    if sensitive {
+        return None;
+    }
+
+    let sanitized: String = message
+        .chars()
+        .filter(|character| !character.is_control())
+        .take(MAX_SYNC_ERROR_CHARS)
+        .collect();
+    (!sanitized.is_empty()).then_some(sanitized)
+}
+
+fn parse_run_status(run_id: Uuid, value: &str) -> Result<SyncRunStatus, CatalogSyncError> {
+    SyncRunStatus::from_str(value).map_err(|_| CatalogSyncError::InvalidPersistedValue {
+        entity: "sync run",
+        id: run_id,
+        field: "status",
+        value: value.to_owned(),
+    })
+}
+
+fn parse_sync_coverage(run_id: Uuid, value: &str) -> Result<SyncCoverage, CatalogSyncError> {
+    SyncCoverage::from_str(value).map_err(|_| CatalogSyncError::InvalidPersistedValue {
+        entity: "sync run",
+        id: run_id,
+        field: "coverage",
+        value: value.to_owned(),
+    })
+}
+
+fn checked_observed_count(run_id: Uuid, value: i32) -> Result<u32, CatalogSyncError> {
+    u32::try_from(value).map_err(|_| CatalogSyncError::InvalidPersistedValue {
+        entity: "sync run",
+        id: run_id,
+        field: "observed_count",
+        value: value.to_string(),
+    })
+}
+
+fn checked_attempt_count(run_id: Uuid, value: i32) -> Result<u32, CatalogSyncError> {
+    u32::try_from(value).map_err(|_| CatalogSyncError::InvalidPersistedValue {
+        entity: "sync run",
+        id: run_id,
+        field: "attempt_count",
+        value: value.to_string(),
+    })
+}
+
+fn parse_row_version(
+    entity: &'static str,
+    id: Uuid,
+    value: i64,
+) -> Result<CatalogRowVersion, CatalogSyncError> {
+    u64::try_from(value)
+        .ok()
+        .and_then(CatalogRowVersion::new)
+        .ok_or_else(|| CatalogSyncError::InvalidPersistedValue {
+            entity,
+            id,
+            field: "row_version",
+            value: value.to_string(),
+        })
+}
+
+fn row_version_as_i64(
+    entity: &'static str,
+    id: Uuid,
+    version: CatalogRowVersion,
+) -> Result<i64, CatalogSyncError> {
+    i64::try_from(version.get()).map_err(|_| CatalogSyncError::NumericOutOfRange {
+        entity,
+        id,
+        field: "row_version",
+    })
+}
+
+fn next_row_version(
+    entity: &'static str,
+    id: Uuid,
+    version: CatalogRowVersion,
+) -> Result<CatalogRowVersion, CatalogSyncError> {
+    version
+        .get()
+        .checked_add(1)
+        .filter(|value| i64::try_from(*value).is_ok())
+        .and_then(CatalogRowVersion::new)
+        .ok_or(CatalogSyncError::NumericOutOfRange {
+            entity,
+            id,
+            field: "row_version",
+        })
+}
+
+fn next_revision(source_release_id: Uuid, revision: u64) -> Result<u64, CatalogSyncError> {
+    revision
+        .checked_add(1)
+        .filter(|value| i64::try_from(*value).is_ok())
+        .ok_or(CatalogSyncError::NumericOutOfRange {
+            entity: "source release",
+            id: source_release_id,
+            field: "revision",
+        })
+}
+
+fn sha256(value: &[u8]) -> Digest {
+    let mut hasher = Sha256::new();
+    hasher.update(value);
+    Digest::new(hasher.finalize().into())
+}
+
+fn missing_run_source(run_id: Uuid) -> CatalogSyncError {
+    CatalogSyncError::Database(DbErr::Custom(format!(
+        "catalog sync run {run_id} references a missing source"
+    )))
+}
+
+#[cfg(all(test, feature = "sqlite"))]
+mod tests {
+    use sea_orm::{ConnectOptions, Database};
+    use sea_orm_migration::MigratorTrait;
+
+    use super::*;
+    use crate::migrator::Migrator;
+
+    async fn migrated_database() -> DatabaseConnection {
+        let mut options = ConnectOptions::new("sqlite::memory:");
+        options.max_connections(1);
+        let database = Database::connect(options).await.unwrap();
+        Migrator::up(&database, None).await.unwrap();
+        database
+    }
+
+    async fn insert_artist(database: &DatabaseConnection, artist_id: Uuid) {
+        catalog_artist::Entity::insert(catalog_artist::ActiveModel {
+            id: NotSet,
+            artist_id: Set(artist_id),
+            display_name: Set("Artist（公式）".to_owned()),
+            sort_name: Set(None),
+            notes: Set(None),
+            row_version: Set(1),
+            created_at: NotSet,
+            updated_at: NotSet,
+        })
+        .exec_without_returning(database)
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn managed_apple_sources_bind_and_backfill_only_trusted_secret_references() {
+        let database = migrated_database().await;
+        let artist_id = Uuid::new_v4();
+        insert_artist(&database, artist_id).await;
+        let secret_ref = "apple/developer-token.jwt";
+        let provisioning = CatalogSyncProvisioningConfig::from_lookup(|name| {
+            (name == crate::config::APPLE_MUSIC_SECRET_REF_ENV).then(|| secret_ref.to_owned())
+        })
+        .unwrap();
+        let service = CatalogSyncService::with_provisioning(database.clone(), provisioning);
+
+        let managed = service
+            .create_managed_source(NewManagedCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::AppleMusic,
+                locator: "1370700".to_owned(),
+                storefront: Some("jp".to_owned()),
+                locale: Some("ja-JP".to_owned()),
+            })
+            .await
+            .unwrap();
+        assert_eq!(
+            managed.provisioning_state,
+            CatalogSourceProvisioningState::ReadyToQueue
+        );
+
+        let legacy = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::AppleMusic,
+                locator: "1370701".to_owned(),
+                storefront: Some("jp".to_owned()),
+                locale: None,
+                configuration_document: None,
+                secret_ref: None,
+            })
+            .await
+            .unwrap();
+        assert_eq!(
+            legacy.provisioning_state,
+            CatalogSourceProvisioningState::CredentialNotConfigured
+        );
+
+        let invalid = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::AppleMusic,
+                locator: "1370702".to_owned(),
+                storefront: Some("jp".to_owned()),
+                locale: None,
+                configuration_document: None,
+                secret_ref: Some("../legacy-token".to_owned()),
+            })
+            .await
+            .unwrap();
+        assert_eq!(
+            invalid.provisioning_state,
+            CatalogSourceProvisioningState::CredentialBindingInvalid
+        );
+
+        assert_eq!(service.provision_existing_sources().await.unwrap(), 1);
+        assert_eq!(service.provision_existing_sources().await.unwrap(), 0);
+        let managed_model = get_source_model(&database, managed.source_id)
+            .await
+            .unwrap()
+            .unwrap();
+        let legacy_model = get_source_model(&database, legacy.source_id)
+            .await
+            .unwrap()
+            .unwrap();
+        let invalid_model = get_source_model(&database, invalid.source_id)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(managed_model.secret_ref.as_deref(), Some(secret_ref));
+        assert_eq!(legacy_model.secret_ref.as_deref(), Some(secret_ref));
+        assert_eq!(legacy_model.row_version, 2);
+        assert_eq!(invalid_model.secret_ref.as_deref(), Some("../legacy-token"));
+        assert_eq!(invalid_model.row_version, 1);
+        assert_eq!(
+            service
+                .get_source(legacy.source_id)
+                .await
+                .unwrap()
+                .unwrap()
+                .provisioning_state,
+            CatalogSourceProvisioningState::ReadyToQueue
+        );
+        assert!(matches!(
+            service
+                .start_managed_run(NewCatalogSyncRun {
+                    run_id: None,
+                    source_id: invalid.source_id,
+                    requested_cursor: None,
+                })
+                .await,
+            Err(CatalogSyncError::CredentialBindingInvalid { .. })
+        ));
+    }
+
+    #[tokio::test]
+    async fn sync_lifecycle_deduplicates_active_runs_and_pauses_disabled_sources() {
+        let database = migrated_database().await;
+        let artist_id = Uuid::new_v4();
+        insert_artist(&database, artist_id).await;
+        let service = CatalogSyncService::new(database);
+        let source = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::Vgmdb,
+                locator: "https://vgmdb.net/artist/1234".to_owned(),
+                storefront: None,
+                locale: None,
+                configuration_document: None,
+                secret_ref: None,
+            })
+            .await
+            .unwrap();
+
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        assert!(matches!(
+            service
+                .start_run(NewCatalogSyncRun {
+                    run_id: None,
+                    source_id: source.source_id,
+                    requested_cursor: None,
+                })
+                .await,
+            Err(CatalogSyncError::SourceBusy { .. })
+        ));
+        assert_eq!(
+            service
+                .list_runs_for_source(source.source_id, 10, 0)
+                .await
+                .unwrap()
+                .iter()
+                .map(|run| run.run_id)
+                .collect::<Vec<_>>(),
+            [queued.run_id]
+        );
+
+        let after_enqueue = service.get_source(source.source_id).await.unwrap().unwrap();
+        assert_eq!(after_enqueue.row_version.get(), 2);
+        assert!(matches!(
+            service
+                .set_source_enabled(source.source_id, source.row_version, false)
+                .await,
+            Err(CatalogSyncError::SourceConflict { .. })
+        ));
+        let disabled = service
+            .set_source_enabled(source.source_id, after_enqueue.row_version, false)
+            .await
+            .unwrap();
+        assert_eq!(disabled.row_version.get(), 3);
+        assert_eq!(
+            disabled.provisioning_state,
+            CatalogSourceProvisioningState::Disabled
+        );
+        let other_source = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::Manual,
+                locator: "manual://artist/1234".to_owned(),
+                storefront: None,
+                locale: None,
+                configuration_document: None,
+                secret_ref: None,
+            })
+            .await
+            .unwrap();
+        let other_queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: other_source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        let other_running = service
+            .claim_next(Duration::from_secs(60))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(other_running.run_id, other_queued.run_id);
+        service
+            .finish_run(
+                other_running.run_id,
+                other_running.row_version,
+                other_running.lease_token,
+                FinishCatalogSyncRun::Cancelled { message: None },
+            )
+            .await
+            .unwrap();
+        assert!(service
+            .claim_next(Duration::from_secs(60))
+            .await
+            .unwrap()
+            .is_none());
+
+        let enabled = service
+            .set_source_enabled(source.source_id, disabled.row_version, true)
+            .await
+            .unwrap();
+        assert_eq!(enabled.row_version.get(), 4);
+        let idempotent = service
+            .set_source_enabled(source.source_id, enabled.row_version, true)
+            .await
+            .unwrap();
+        assert_eq!(idempotent.row_version, enabled.row_version);
+        let running = service
+            .claim_next(Duration::from_secs(60))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(running.run_id, queued.run_id);
+        let finished = service
+            .finish_run(
+                running.run_id,
+                running.row_version,
+                running.lease_token,
+                FinishCatalogSyncRun::Cancelled { message: None },
+            )
+            .await
+            .unwrap();
+        assert_eq!(finished.run.status, SyncRunStatus::Cancelled);
+
+        let next = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        let history = service
+            .list_runs_for_source(source.source_id, 10, 0)
+            .await
+            .unwrap();
+        assert_eq!(history.len(), 2);
+        assert_eq!(history[0].run_id, next.run_id);
+        assert_eq!(history[1].run_id, queued.run_id);
+    }
+
+    #[tokio::test]
+    async fn observations_are_idempotent_versioned_and_never_deleted_when_absent() {
+        let database = migrated_database().await;
+        let artist_id = Uuid::new_v4();
+        insert_artist(&database, artist_id).await;
+        let service = CatalogSyncService::new(database.clone());
+        let lease_for = Duration::from_secs(60);
+
+        let source = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::Vgmdb,
+                locator: "https://vgmdb.net/artist/1234".to_owned(),
+                storefront: None,
+                locale: Some("ja-JP".to_owned()),
+                configuration_document: Some(r#"{"page_size":50}"#.to_owned()),
+                secret_ref: Some("secret/catalog/vgmdb".to_owned()),
+            })
+            .await
+            .unwrap();
+        let listed = service.list_sources_for_artist(artist_id).await.unwrap();
+        assert_eq!(listed.len(), 1);
+        assert_eq!(listed[0].source_id, source.source_id);
+        assert_eq!(listed[0].locator, "https://vgmdb.net/artist/1234");
+
+        let first = CatalogReleaseObservation {
+            external_release_id: "album/作品・A〜B～C".to_owned(),
+            source_url: "https://vgmdb.net/album/100".to_owned(),
+            raw_document: r#"{"title":"作品・A〜B～C (初回)"}"#.to_owned(),
+            parsed_document: r#"{"title":"作品・A〜B～C (初回)","kind":"album"}"#.to_owned(),
+        };
+        let second = CatalogReleaseObservation {
+            external_release_id: "album/別作品".to_owned(),
+            source_url: "https://vgmdb.net/album/200".to_owned(),
+            raw_document: r#"{"title":"別作品"}"#.to_owned(),
+            parsed_document: r#"{"title":"別作品","kind":"album"}"#.to_owned(),
+        };
+
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        let running = service
+            .claim_run(queued.run_id, queued.row_version, lease_for)
+            .await
+            .unwrap();
+        assert!(matches!(
+            service
+                .start_run(NewCatalogSyncRun {
+                    run_id: None,
+                    source_id: source.source_id,
+                    requested_cursor: None,
+                })
+                .await,
+            Err(CatalogSyncError::SourceBusy { .. })
+        ));
+        let recorded = service
+            .record_observation(
+                running.run_id,
+                running.row_version,
+                running.lease_token,
+                first.clone(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(recorded.run.observed_count, 1);
+        assert_eq!(recorded.observation.revision, 1);
+        assert!(recorded.revision_appended);
+        assert!(recorded.first_observation_in_run);
+
+        let replayed = service
+            .record_observation(
+                recorded.run.run_id,
+                recorded.run.row_version,
+                running.lease_token,
+                first.clone(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(replayed.run.row_version, recorded.run.row_version);
+        assert_eq!(replayed.run.observed_count, 1);
+        assert!(!replayed.revision_appended);
+        assert!(!replayed.first_observation_in_run);
+
+        let recorded_second = service
+            .record_observation(
+                replayed.run.run_id,
+                replayed.run.row_version,
+                running.lease_token,
+                second.clone(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(recorded_second.run.observed_count, 2);
+        let finished = service
+            .finish_run(
+                recorded_second.run.run_id,
+                recorded_second.run.row_version,
+                running.lease_token,
+                FinishCatalogSyncRun::Succeeded {
+                    result_cursor: None,
+                    coverage: SyncCoverage::FullSnapshot,
+                    snapshot_complete: true,
+                },
+            )
+            .await
+            .unwrap();
+        assert_eq!(finished.newly_not_seen, 0);
+
+        // A successful incremental run sees only the first release. It is
+        // useful evidence, but it must not infer that the second release
+        // disappeared.
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: Some("incremental:page:2".to_owned()),
+            })
+            .await
+            .unwrap();
+        let running = service
+            .claim_run(queued.run_id, queued.row_version, lease_for)
+            .await
+            .unwrap();
+        let recorded = service
+            .record_observation(
+                running.run_id,
+                running.row_version,
+                running.lease_token,
+                first.clone(),
+            )
+            .await
+            .unwrap();
+        assert!(!recorded.revision_appended);
+        assert!(recorded.first_observation_in_run);
+        let finished = service
+            .finish_run(
+                recorded.run.run_id,
+                recorded.run.row_version,
+                running.lease_token,
+                FinishCatalogSyncRun::Succeeded {
+                    result_cursor: None,
+                    coverage: SyncCoverage::Incremental,
+                    snapshot_complete: true,
+                },
+            )
+            .await
+            .unwrap();
+        assert_eq!(finished.newly_not_seen, 0);
+        let still_present = get_source_release_model(
+            &database,
+            catalog_source::Entity::find()
+                .filter(catalog_source::Column::SourceId.eq(source.source_id))
+                .one(&database)
+                .await
+                .unwrap()
+                .unwrap()
+                .id,
+            &second.external_release_id,
+        )
+        .await
+        .unwrap()
+        .unwrap();
+        assert!(still_present.not_seen_since.is_none());
+
+        // Only a complete full snapshot from the root may infer absence.
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        let running = service
+            .claim_run(queued.run_id, queued.row_version, lease_for)
+            .await
+            .unwrap();
+        let recorded = service
+            .record_observation(
+                running.run_id,
+                running.row_version,
+                running.lease_token,
+                first.clone(),
+            )
+            .await
+            .unwrap();
+        let finished = service
+            .finish_run(
+                recorded.run.run_id,
+                recorded.run.row_version,
+                running.lease_token,
+                FinishCatalogSyncRun::Succeeded {
+                    result_cursor: None,
+                    coverage: SyncCoverage::FullSnapshot,
+                    snapshot_complete: true,
+                },
+            )
+            .await
+            .unwrap();
+        assert_eq!(finished.newly_not_seen, 1);
+        let absent = get_source_release_model(
+            &database,
+            catalog_source::Entity::find()
+                .filter(catalog_source::Column::SourceId.eq(source.source_id))
+                .one(&database)
+                .await
+                .unwrap()
+                .unwrap()
+                .id,
+            &second.external_release_id,
+        )
+        .await
+        .unwrap()
+        .unwrap();
+        assert!(absent.not_seen_since.is_some());
+
+        // Re-parsing the same raw document differently is new reviewable
+        // evidence even though its raw SHA-256 is unchanged.
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: None,
+            })
+            .await
+            .unwrap();
+        let running = service
+            .claim_run(queued.run_id, queued.row_version, lease_for)
+            .await
+            .unwrap();
+        let mut reparsed = first;
+        reparsed.parsed_document =
+            r#"{"title":"作品・A〜B～C (初回)","kind":"album","parser":2}"#.to_owned();
+        let recorded = service
+            .record_observation(
+                running.run_id,
+                running.row_version,
+                running.lease_token,
+                reparsed,
+            )
+            .await
+            .unwrap();
+        assert!(recorded.revision_appended);
+        assert_eq!(recorded.observation.revision, 2);
+    }
+
+    #[tokio::test]
+    async fn catalog_leases_expire_recover_and_redact_worker_configuration() {
+        let database = migrated_database().await;
+        let artist_id = Uuid::new_v4();
+        insert_artist(&database, artist_id).await;
+        let service = CatalogSyncService::new(database);
+        let locator = "https://artist.example/discography?token=source-secret";
+        let source = service
+            .create_source(NewCatalogSource {
+                source_id: None,
+                artist_id,
+                kind: CatalogSourceKind::ArtistWebsite,
+                locator: locator.to_owned(),
+                storefront: None,
+                locale: Some("ja-JP".to_owned()),
+                configuration_document: Some("{\"authorization\":\"config-secret\"}".to_owned()),
+                secret_ref: Some("secret/catalog/artist".to_owned()),
+            })
+            .await
+            .unwrap();
+        let queued = service
+            .start_run(NewCatalogSyncRun {
+                run_id: None,
+                source_id: source.source_id,
+                requested_cursor: Some("cursor-secret".to_owned()),
+            })
+            .await
+            .unwrap();
+        let now = chrono::Utc::now();
+        let first = service
+            .claim_run_at(
+                queued.run_id,
+                queued.row_version,
+                now - chrono::Duration::minutes(2),
+                Duration::from_secs(30),
+            )
+            .await
+            .unwrap();
+        assert_eq!(first.attempt_count, 1);
+        let debug = format!("{first:?}");
+        for secret in [
+            locator,
+            "source-secret",
+            "config-secret",
+            "secret/catalog/artist",
+            "cursor-secret",
+            &first.lease_token.to_string(),
+        ] {
+            assert!(!debug.contains(secret));
+        }
+
+        assert!(matches!(
+            service
+                .record_observation(
+                    first.run_id,
+                    first.row_version,
+                    first.lease_token,
+                    CatalogReleaseObservation {
+                        external_release_id: "album/not-written".to_owned(),
+                        source_url: "https://artist.example/album/not-written".to_owned(),
+                        raw_document: "{}".to_owned(),
+                        parsed_document: "{}".to_owned(),
+                    },
+                )
+                .await,
+            Err(CatalogSyncError::LeaseMismatch { .. })
+        ));
+
+        let recovered = service
+            .claim_next_at(now, Duration::from_secs(60))
+            .await
+            .unwrap()
+            .expect("expired run is recoverable");
+        assert_eq!(recovered.run_id, first.run_id);
+        assert_eq!(recovered.attempt_count, 2);
+        assert_ne!(recovered.lease_token, first.lease_token);
+
+        let renewed = service
+            .renew_lease_at(
+                recovered.run_id,
+                recovered.row_version,
+                recovered.lease_token,
+                now,
+                Duration::from_secs(120),
+            )
+            .await
+            .unwrap();
+        assert_eq!(renewed.lease_token, recovered.lease_token);
+        assert!(renewed.lease_expires_at > recovered.lease_expires_at);
+        assert!(renewed.row_version > recovered.row_version);
+        assert!(matches!(
+            service
+                .renew_lease(
+                    renewed.run_id,
+                    renewed.row_version,
+                    first.lease_token,
+                    Duration::from_secs(60),
+                )
+                .await,
+            Err(CatalogSyncError::LeaseMismatch { .. })
+        ));
+
+        let not_before = now + chrono::Duration::seconds(30);
+        let retried = service
+            .retry_run(
+                renewed.run_id,
+                renewed.row_version,
+                renewed.lease_token,
+                "GET https://artist.example?token=must-not-persist failed",
+                Some("resume-cursor-secret".to_owned()),
+                not_before,
+            )
+            .await
+            .unwrap();
+        assert_eq!(retried.status, SyncRunStatus::Queued);
+        assert_eq!(retried.next_attempt_at, Some(not_before));
+        assert_eq!(
+            retried.error_message.as_deref(),
+            Some("source adapter retry scheduled")
+        );
+        assert!(service
+            .claim_next_at(now + chrono::Duration::seconds(20), Duration::from_secs(60))
+            .await
+            .unwrap()
+            .is_none());
+        let third = service
+            .claim_next_at(now + chrono::Duration::seconds(31), Duration::from_secs(60))
+            .await
+            .unwrap()
+            .expect("scheduled retry becomes claimable");
+        assert_eq!(third.run_id, renewed.run_id);
+        assert_eq!(third.attempt_count, 3);
+        assert_eq!(
+            third.requested_cursor.as_deref(),
+            Some("resume-cursor-secret")
+        );
+        assert!(!format!("{third:?}").contains("resume-cursor-secret"));
+    }
+
+    #[test]
+    fn commands_and_failures_do_not_expose_source_secrets() {
+        let source = NewCatalogSource {
+            source_id: None,
+            artist_id: Uuid::new_v4(),
+            kind: CatalogSourceKind::ArtistWebsite,
+            locator: "https://artist.example/discography?token=visible".to_owned(),
+            storefront: None,
+            locale: None,
+            configuration_document: Some("{\"authorization\":\"secret-value\"}".to_owned()),
+            secret_ref: Some("secret/catalog/artist".to_owned()),
+        };
+        let debug = format!("{source:?}");
+        assert!(!debug.contains("artist.example"));
+        assert!(!debug.contains("secret-value"));
+        assert!(!debug.contains("secret/catalog/artist"));
+
+        assert_eq!(
+            sanitize_sync_error("upstream returned 503"),
+            Some("upstream returned 503".to_owned())
+        );
+        assert_eq!(
+            sanitize_sync_error("GET https://artist.example/a?token=secret failed"),
+            None
+        );
+        assert_eq!(sanitize_sync_error("token expired"), None);
+        assert_eq!(
+            sanitize_sync_error(&"x".repeat(MAX_SYNC_ERROR_CHARS + 20))
+                .expect("plain message is retained")
+                .chars()
+                .count(),
+            MAX_SYNC_ERROR_CHARS
+        );
+    }
+}
diff --git a/annim/src/config.rs b/annim/src/config.rs
new file mode 100644
index 00000000..ffbbbe34
--- /dev/null
+++ b/annim/src/config.rs
@@ -0,0 +1,359 @@
+use std::{
+    collections::HashSet,
+    fmt,
+    net::{AddrParseError, SocketAddr},
+    path::{Component, Path},
+    sync::Arc,
+};
+
+use axum::http::HeaderValue;
+use thiserror::Error;
+use url::Url;
+
+pub const DEFAULT_BIND_ADDR: &str = "127.0.0.1:8000";
+pub const APPLE_MUSIC_SECRET_REF_ENV: &str = "ANNIM_CATALOG_APPLE_MUSIC_SECRET_REF";
+
+const MAX_CATALOG_SECRET_REF_BYTES: usize = 512;
+
+/// Trusted server-side bindings used when the browser registers catalog sources.
+///
+/// Values are opaque references into the catalog worker's secret root. The
+/// browser never submits or receives these references, and Annim never reads
+/// the referenced secret file.
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct CatalogSyncProvisioningConfig {
+    apple_music_secret_ref: Option<CatalogSecretRef>,
+}
+
+impl fmt::Debug for CatalogSyncProvisioningConfig {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CatalogSyncProvisioningConfig")
+            .field(
+                "apple_music_secret_ref",
+                &self.apple_music_secret_ref.as_ref().map(|_| "[REDACTED]"),
+            )
+            .finish()
+    }
+}
+
+impl CatalogSyncProvisioningConfig {
+    pub fn from_env() -> Result<Self, CatalogSyncProvisioningConfigError> {
+        Self::from_lookup(|name| std::env::var(name).ok())
+    }
+
+    pub fn from_lookup(
+        mut lookup: impl FnMut(&str) -> Option<String>,
+    ) -> Result<Self, CatalogSyncProvisioningConfigError> {
+        let apple_music_secret_ref = lookup(APPLE_MUSIC_SECRET_REF_ENV)
+            .map(|value| CatalogSecretRef::parse(APPLE_MUSIC_SECRET_REF_ENV, value))
+            .transpose()?;
+        Ok(Self {
+            apple_music_secret_ref,
+        })
+    }
+
+    pub fn apple_music_secret_ref(&self) -> Option<&CatalogSecretRef> {
+        self.apple_music_secret_ref.as_ref()
+    }
+}
+
+/// An opaque relative reference into the catalog worker's secret root.
+///
+/// It intentionally implements neither `Display` nor serialization so a
+/// reference cannot be logged or placed in an API response by convenience.
+#[derive(Clone, PartialEq, Eq)]
+pub struct CatalogSecretRef(String);
+
+impl fmt::Debug for CatalogSecretRef {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("[REDACTED]")
+    }
+}
+
+impl CatalogSecretRef {
+    pub fn parse(
+        name: &'static str,
+        value: String,
+    ) -> Result<Self, CatalogSyncProvisioningConfigError> {
+        validate_catalog_secret_reference(name, &value)?;
+        Ok(Self(value))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum CatalogSyncProvisioningConfigError {
+    #[error(
+        "{name} must be a relative secret file reference without traversal, control characters, or backslashes"
+    )]
+    InvalidSecretReference { name: &'static str },
+}
+
+fn validate_catalog_secret_reference(
+    name: &'static str,
+    value: &str,
+) -> Result<(), CatalogSyncProvisioningConfigError> {
+    let path = Path::new(value);
+    let valid = !value.is_empty()
+        && value.len() <= MAX_CATALOG_SECRET_REF_BYTES
+        && !value.contains('\\')
+        && !value.chars().any(char::is_control)
+        && !looks_like_compact_jwt(value)
+        && !path.is_absolute()
+        && path
+            .components()
+            .all(|component| matches!(component, Component::Normal(_)));
+    if valid {
+        Ok(())
+    } else {
+        Err(CatalogSyncProvisioningConfigError::InvalidSecretReference { name })
+    }
+}
+
+fn looks_like_compact_jwt(value: &str) -> bool {
+    if value.contains('/') {
+        return false;
+    }
+    let segments = value.split('.').collect::<Vec<_>>();
+    segments.len() == 3
+        && segments.iter().all(|segment| {
+            !segment.is_empty()
+                && segment.chars().all(|character| {
+                    character.is_ascii_alphanumeric() || matches!(character, '-' | '_')
+                })
+        })
+}
+
+/// Network-facing settings for Annim.
+///
+/// The default listener is loopback-only. Deployments that bind a non-loopback
+/// address should terminate TLS at a trusted reverse proxy and explicitly set
+/// every browser origin that may access the API.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ServerConfig {
+    bind_addr: SocketAddr,
+    allowed_origins: Arc<[HeaderValue]>,
+    graphiql_enabled: bool,
+}
+
+impl ServerConfig {
+    pub fn from_env() -> Result<Self, ServerConfigError> {
+        Self::from_lookup(|name| std::env::var(name).ok())
+    }
+
+    pub fn from_lookup(
+        mut lookup: impl FnMut(&str) -> Option<String>,
+    ) -> Result<Self, ServerConfigError> {
+        let bind_addr = lookup("ANNIM_BIND_ADDR")
+            .unwrap_or_else(|| DEFAULT_BIND_ADDR.to_owned())
+            .parse()
+            .map_err(ServerConfigError::InvalidBindAddress)?;
+        let allowed_origins = parse_allowed_origins(
+            lookup("ANNIM_ALLOWED_ORIGINS")
+                .as_deref()
+                .unwrap_or_default(),
+        )?;
+        let graphiql_enabled = parse_boolean(
+            "ANNIM_GRAPHIQL_ENABLED",
+            lookup("ANNIM_GRAPHIQL_ENABLED").as_deref(),
+            false,
+        )?;
+
+        Ok(Self {
+            bind_addr,
+            allowed_origins: allowed_origins.into(),
+            graphiql_enabled,
+        })
+    }
+
+    pub fn bind_addr(&self) -> SocketAddr {
+        self.bind_addr
+    }
+
+    pub fn allowed_origins(&self) -> &[HeaderValue] {
+        &self.allowed_origins
+    }
+
+    pub fn graphiql_enabled(&self) -> bool {
+        self.graphiql_enabled
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum ServerConfigError {
+    #[error("ANNIM_BIND_ADDR must be a socket address with an explicit port")]
+    InvalidBindAddress(#[source] AddrParseError),
+    #[error("ANNIM_ALLOWED_ORIGINS contains an invalid origin")]
+    InvalidOrigin,
+    #[error("{name} must be either true or false, got {value}")]
+    InvalidBoolean { name: &'static str, value: String },
+}
+
+fn parse_allowed_origins(value: &str) -> Result<Vec<HeaderValue>, ServerConfigError> {
+    let mut unique = HashSet::new();
+    let mut origins = Vec::new();
+
+    for candidate in value
+        .split(',')
+        .map(str::trim)
+        .filter(|item| !item.is_empty())
+    {
+        let parsed = Url::parse(candidate).map_err(|_| ServerConfigError::InvalidOrigin)?;
+        let canonical = parsed.origin().ascii_serialization();
+        let valid = matches!(parsed.scheme(), "http" | "https")
+            && parsed.username().is_empty()
+            && parsed.password().is_none()
+            && parsed.host().is_some()
+            && parsed.path() == "/"
+            && parsed.query().is_none()
+            && parsed.fragment().is_none()
+            && canonical == candidate;
+        if !valid {
+            return Err(ServerConfigError::InvalidOrigin);
+        }
+        if unique.insert(canonical.clone()) {
+            origins.push(
+                HeaderValue::from_str(&canonical).map_err(|_| ServerConfigError::InvalidOrigin)?,
+            );
+        }
+    }
+
+    Ok(origins)
+}
+
+fn parse_boolean(
+    name: &'static str,
+    value: Option<&str>,
+    default: bool,
+) -> Result<bool, ServerConfigError> {
+    match value {
+        None => Ok(default),
+        Some("true") => Ok(true),
+        Some("false") => Ok(false),
+        Some(value) => Err(ServerConfigError::InvalidBoolean {
+            name,
+            value: value.to_owned(),
+        }),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_are_loopback_only_and_disable_browser_features() {
+        let config = ServerConfig::from_lookup(|_| None).unwrap();
+
+        assert_eq!(config.bind_addr().to_string(), DEFAULT_BIND_ADDR);
+        assert!(config.allowed_origins().is_empty());
+        assert!(!config.graphiql_enabled());
+    }
+
+    #[test]
+    fn explicit_origins_are_canonical_exact_and_deduplicated() {
+        let config = ServerConfig::from_lookup(|name| match name {
+            "ANNIM_BIND_ADDR" => Some("[::1]:9000".to_owned()),
+            "ANNIM_ALLOWED_ORIGINS" => {
+                Some("https://ui.example,http://127.0.0.1:5173,https://ui.example".to_owned())
+            }
+            "ANNIM_GRAPHIQL_ENABLED" => Some("true".to_owned()),
+            _ => None,
+        })
+        .unwrap();
+
+        assert_eq!(config.bind_addr().to_string(), "[::1]:9000");
+        assert_eq!(
+            config.allowed_origins(),
+            ["https://ui.example", "http://127.0.0.1:5173"]
+        );
+        assert!(config.graphiql_enabled());
+    }
+
+    #[test]
+    fn invalid_network_configuration_fails_closed() {
+        for origin in [
+            "*",
+            "null",
+            "https://ui.example/",
+            "https://ui.example/path",
+            "https://user@ui.example",
+        ] {
+            assert!(matches!(
+                ServerConfig::from_lookup(
+                    |name| (name == "ANNIM_ALLOWED_ORIGINS").then(|| origin.to_owned())
+                ),
+                Err(ServerConfigError::InvalidOrigin)
+            ));
+        }
+        assert!(matches!(
+            ServerConfig::from_lookup(
+                |name| (name == "ANNIM_BIND_ADDR").then(|| "0.0.0.0".to_owned())
+            ),
+            Err(ServerConfigError::InvalidBindAddress(_))
+        ));
+        assert!(matches!(
+            ServerConfig::from_lookup(
+                |name| (name == "ANNIM_GRAPHIQL_ENABLED").then(|| "yes".to_owned())
+            ),
+            Err(ServerConfigError::InvalidBoolean { .. })
+        ));
+
+        let secret_origin = "https://operator:do-not-log@ui.example";
+        let error = ServerConfig::from_lookup(|name| {
+            (name == "ANNIM_ALLOWED_ORIGINS").then(|| secret_origin.to_owned())
+        })
+        .unwrap_err();
+        let rendered = format!("{error:?}: {error}");
+        assert!(!rendered.contains("do-not-log"));
+    }
+
+    #[test]
+    fn catalog_provisioning_accepts_only_redacted_relative_secret_references() {
+        let secret_ref = "apple/developer-token.jwt";
+        let configured = CatalogSyncProvisioningConfig::from_lookup(|name| {
+            (name == APPLE_MUSIC_SECRET_REF_ENV).then(|| secret_ref.to_owned())
+        })
+        .unwrap();
+        assert_eq!(
+            configured
+                .apple_music_secret_ref()
+                .map(CatalogSecretRef::as_str),
+            Some(secret_ref)
+        );
+        assert!(!format!("{:?}", configured).contains(secret_ref));
+
+        let missing = CatalogSyncProvisioningConfig::from_lookup(|_| None).unwrap();
+        assert!(missing.apple_music_secret_ref().is_none());
+
+        for invalid in [
+            "",
+            "/run/secrets/apple.jwt",
+            "../apple.jwt",
+            "apple/../developer-token.jwt",
+            ".",
+            "apple\\developer-token.jwt",
+            "apple/developer-token.jwt\n",
+            "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIifQ.signature",
+        ] {
+            assert!(matches!(
+                CatalogSyncProvisioningConfig::from_lookup(|name| {
+                    (name == APPLE_MUSIC_SECRET_REF_ENV).then(|| invalid.to_owned())
+                }),
+                Err(CatalogSyncProvisioningConfigError::InvalidSecretReference { .. })
+            ));
+        }
+
+        let too_long = "a".repeat(MAX_CATALOG_SECRET_REF_BYTES + 1);
+        assert!(matches!(
+            CatalogSyncProvisioningConfig::from_lookup(|name| {
+                (name == APPLE_MUSIC_SECRET_REF_ENV).then(|| too_long.clone())
+            }),
+            Err(CatalogSyncProvisioningConfigError::InvalidSecretReference { .. })
+        ));
+    }
+}
diff --git a/annim/src/cover/mod.rs b/annim/src/cover/mod.rs
new file mode 100644
index 00000000..08d5b5e5
--- /dev/null
+++ b/annim/src/cover/mod.rs
@@ -0,0 +1,1709 @@
+//! Durable cover discovery, download leasing, and selection.
+//!
+//! Remote URLs are deliberately confined to persistence and [`CoverFetchLease`].
+//! Ordinary API snapshots reveal only whether a remote URL exists, so signed
+//! query parameters cannot accidentally escape through GraphQL or logs.
+
+use std::{num::NonZeroU32, str::FromStr, time::Duration};
+
+use anni_catalog::{
+    canonicalize_cover_url, cover_asset_storage_key, preferred_amazon_artwork_url,
+    preferred_apple_artwork_url, CoverCandidateState, CoverMediaType, CoverSourceKind,
+    CoverUrlError,
+};
+use anni_ingest::Digest;
+use sea_orm::{
+    prelude::{DateTimeUtc, Uuid},
+    sea_query::{Condition, Expr, OnConflict},
+    ActiveValue::{NotSet, Set},
+    ColumnTrait, ConnectionTrait, DatabaseConnection, DbErr, EntityTrait, QueryFilter, QueryOrder,
+    TransactionTrait, TryInsertResult,
+};
+use thiserror::Error;
+
+use crate::entities::{
+    catalog_release, cover_asset, cover_candidate, cover_selection,
+    helper::{now, timestamp},
+};
+
+const MAX_CLAIM_CAS_ATTEMPTS: usize = 16;
+const MAX_FAILURE_CODE_BYTES: usize = 64;
+const MAX_FAILURE_MESSAGE_CHARS: usize = 512;
+
+/// Optimistic-lock version shared by candidates and selections.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct CoverRowVersion(u64);
+
+impl CoverRowVersion {
+    pub const INITIAL: Self = Self(1);
+
+    pub const fn new(value: u64) -> Option<Self> {
+        if value == 0 {
+            None
+        } else {
+            Some(Self(value))
+        }
+    }
+
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+
+    fn as_i64(self, entity: &'static str, id: Uuid) -> Result<i64, CoverError> {
+        i64::try_from(self.0).map_err(|_| CoverError::NumericOutOfRange {
+            entity,
+            id,
+            field: "row_version",
+        })
+    }
+
+    fn next(self, entity: &'static str, id: Uuid) -> Result<Self, CoverError> {
+        self.0
+            .checked_add(1)
+            .filter(|value| i64::try_from(*value).is_ok())
+            .map(Self)
+            .ok_or(CoverError::NumericOutOfRange {
+                entity,
+                id,
+                field: "row_version",
+            })
+    }
+}
+
+impl std::fmt::Display for CoverRowVersion {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CoverAssetSnapshot {
+    pub asset_id: Uuid,
+    pub content_sha256: Digest,
+    pub storage_key: String,
+    pub media_type: CoverMediaType,
+    pub width: NonZeroU32,
+    pub height: NonZeroU32,
+    pub byte_length: u64,
+    pub fetched_at: DateTimeUtc,
+    pub verified_at: DateTimeUtc,
+    pub created_at: DateTimeUtc,
+}
+
+/// A client-safe candidate view.
+///
+/// It intentionally has no submitted/canonical/effective URL and no free-form
+/// error message. The error code is a bounded machine-readable value.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CoverCandidateSnapshot {
+    pub candidate_id: Uuid,
+    pub release_id: Uuid,
+    pub disc_number: u16,
+    pub source_kind: CoverSourceKind,
+    pub source_release_revision_db_id: Option<i32>,
+    pub state: CoverCandidateState,
+    pub asset: Option<CoverAssetSnapshot>,
+    pub has_remote_url: bool,
+    pub attempt_count: u32,
+    pub next_attempt_at: Option<DateTimeUtc>,
+    pub last_http_status: Option<u16>,
+    pub last_error_code: Option<String>,
+    pub fetched_at: Option<DateTimeUtc>,
+    pub row_version: CoverRowVersion,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CoverSelectionSnapshot {
+    pub selection_id: Uuid,
+    pub release_id: Uuid,
+    pub disc_number: u16,
+    pub candidate_id: Uuid,
+    /// The immutable bytes selected at that moment, not a later candidate
+    /// lookup. This is the durable selection freeze.
+    pub asset: CoverAssetSnapshot,
+    pub row_version: CoverRowVersion,
+    pub selected_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct NewCoverCandidate {
+    pub candidate_id: Option<Uuid>,
+    pub release_id: Uuid,
+    /// Zero is release-level artwork; positive values are one-based discs.
+    pub disc_number: u16,
+    pub source_kind: CoverSourceKind,
+    pub source_release_revision_db_id: Option<i32>,
+    pub submitted_url: String,
+}
+
+impl std::fmt::Debug for NewCoverCandidate {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("NewCoverCandidate")
+            .field("candidate_id", &self.candidate_id)
+            .field("release_id", &self.release_id)
+            .field("disc_number", &self.disc_number)
+            .field("source_kind", &self.source_kind)
+            .field(
+                "source_release_revision_db_id",
+                &self.source_release_revision_db_id,
+            )
+            .field("submitted_url", &"[REDACTED]")
+            .finish()
+    }
+}
+
+/// The only public value that contains a fetch URL. It is intended for the
+/// background worker and guarded by a short-lived opaque lease token.
+#[derive(Clone, PartialEq, Eq)]
+pub struct CoverFetchLease {
+    pub candidate_id: Uuid,
+    pub release_id: Uuid,
+    pub disc_number: u16,
+    pub source_kind: CoverSourceKind,
+    pub request_url: String,
+    pub lease_token: Uuid,
+    pub lease_expires_at: DateTimeUtc,
+    pub attempt_count: u32,
+    pub row_version: CoverRowVersion,
+}
+
+impl std::fmt::Debug for CoverFetchLease {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("CoverFetchLease")
+            .field("candidate_id", &self.candidate_id)
+            .field("release_id", &self.release_id)
+            .field("disc_number", &self.disc_number)
+            .field("source_kind", &self.source_kind)
+            .field("request_url", &"[REDACTED]")
+            .field("lease_token", &"[REDACTED]")
+            .field("lease_expires_at", &self.lease_expires_at)
+            .field("attempt_count", &self.attempt_count)
+            .field("row_version", &self.row_version)
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct VerifiedCoverAsset {
+    pub content_sha256: Digest,
+    pub media_type: CoverMediaType,
+    pub width: NonZeroU32,
+    pub height: NonZeroU32,
+    pub byte_length: u64,
+    /// The final URL after redirects. It remains private like the submitted
+    /// and canonical forms.
+    pub effective_url: Option<String>,
+}
+
+impl std::fmt::Debug for VerifiedCoverAsset {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("VerifiedCoverAsset")
+            .field("content_sha256", &self.content_sha256)
+            .field("media_type", &self.media_type)
+            .field("width", &self.width)
+            .field("height", &self.height)
+            .field("byte_length", &self.byte_length)
+            .field(
+                "effective_url",
+                &self.effective_url.as_ref().map(|_| "[REDACTED]"),
+            )
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct CoverFetchFailure {
+    pub code: String,
+    pub message: Option<String>,
+    pub http_status: Option<u16>,
+}
+
+impl std::fmt::Debug for CoverFetchFailure {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("CoverFetchFailure")
+            .field("code", &self.code)
+            .field("message", &self.message.as_ref().map(|_| "[REDACTED]"))
+            .field("http_status", &self.http_status)
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SelectCover {
+    pub release_id: Uuid,
+    pub disc_number: u16,
+    pub candidate_id: Uuid,
+    /// `None` creates the selection and asserts that no selection exists.
+    /// `Some` replaces an existing selection with optimistic locking.
+    pub expected_row_version: Option<CoverRowVersion>,
+}
+
+#[derive(Debug, Error)]
+pub enum CoverError {
+    #[error("catalog release {release_id} does not exist")]
+    ReleaseNotFound { release_id: Uuid },
+    #[error("cover candidate {candidate_id} already exists")]
+    CandidateAlreadyExists { candidate_id: Uuid },
+    #[error("cover candidate {candidate_id} does not exist")]
+    CandidateNotFound { candidate_id: Uuid },
+    #[error(
+        "cover candidate {candidate_id} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    CandidateConflict {
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        actual: CoverRowVersion,
+    },
+    #[error("cover candidate {candidate_id} cannot transition from {from} to {to}")]
+    InvalidCandidateTransition {
+        candidate_id: Uuid,
+        from: CoverCandidateState,
+        to: CoverCandidateState,
+    },
+    #[error("cover candidate {candidate_id} is not owned by this worker lease")]
+    LeaseMismatch { candidate_id: Uuid },
+    #[error("cover candidate {candidate_id} is not verified")]
+    CandidateNotVerified { candidate_id: Uuid },
+    #[error(
+        "cover candidate {candidate_id} belongs to release {actual_release_id} disc {actual_disc_number}, not release {expected_release_id} disc {expected_disc_number}"
+    )]
+    CandidateScopeMismatch {
+        candidate_id: Uuid,
+        expected_release_id: Uuid,
+        expected_disc_number: u16,
+        actual_release_id: Uuid,
+        actual_disc_number: u16,
+    },
+    #[error("cover candidate {candidate_id} does not reference a verified asset")]
+    CandidateAssetMissing { candidate_id: Uuid },
+    #[error("cover selection for release {release_id} disc {disc_number} already exists")]
+    SelectionAlreadyExists { release_id: Uuid, disc_number: u16 },
+    #[error("cover selection for release {release_id} disc {disc_number} does not exist")]
+    SelectionNotFound { release_id: Uuid, disc_number: u16 },
+    #[error(
+        "cover selection for release {release_id} disc {disc_number} changed concurrently: expected {expected}, actual {actual}"
+    )]
+    SelectionConflict {
+        release_id: Uuid,
+        disc_number: u16,
+        expected: CoverRowVersion,
+        actual: CoverRowVersion,
+    },
+    #[error("invalid cover URL: {0}")]
+    InvalidUrl(#[source] CoverUrlError),
+    #[error("invalid cover {field}: {message}")]
+    InvalidInput {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("persisted {entity} {id} contains invalid {field}: {value}")]
+    InvalidPersistedValue {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+        value: String,
+    },
+    #[error("{entity} {id} has an out-of-range {field}")]
+    NumericOutOfRange {
+        entity: &'static str,
+        id: Uuid,
+        field: &'static str,
+    },
+    #[error("cover asset digest {digest} conflicts with previously verified metadata")]
+    AssetDigestConflict { digest: Digest },
+    #[error(transparent)]
+    Database(#[from] DbErr),
+}
+
+#[derive(Clone)]
+pub struct CoverRepository {
+    database: DatabaseConnection,
+}
+
+impl CoverRepository {
+    pub fn new(database: DatabaseConnection) -> Self {
+        Self { database }
+    }
+
+    pub async fn create_candidate(
+        &self,
+        input: NewCoverCandidate,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        let release = get_release_model(&self.database, input.release_id)
+            .await?
+            .ok_or(CoverError::ReleaseNotFound {
+                release_id: input.release_id,
+            })?;
+        let disc_number = store_disc_number(input.disc_number, input.release_id)?;
+        if input.submitted_url.is_empty() {
+            return Err(CoverError::InvalidInput {
+                field: "submitted_url",
+                message: "value must not be empty",
+            });
+        }
+        let canonical_url = preferred_url(input.source_kind, &input.submitted_url)?;
+        let candidate_id = input.candidate_id.unwrap_or_else(Uuid::new_v4);
+        let result = cover_candidate::Entity::insert(cover_candidate::ActiveModel {
+            id: NotSet,
+            candidate_id: Set(candidate_id),
+            release_db_id: Set(release.id),
+            disc_number: Set(disc_number),
+            source_kind: Set(input.source_kind.as_str().to_owned()),
+            source_release_revision_db_id: Set(input.source_release_revision_db_id),
+            submitted_url: Set(Some(input.submitted_url)),
+            canonical_url: Set(Some(canonical_url)),
+            effective_url: Set(None),
+            state: Set(CoverCandidateState::Discovered.as_str().to_owned()),
+            asset_db_id: Set(None),
+            attempt_count: Set(0),
+            lease_token: Set(None),
+            lease_expires_at: Set(None),
+            next_attempt_at: Set(None),
+            last_http_status: Set(None),
+            last_error_code: Set(None),
+            last_error_message: Set(None),
+            fetched_at: Set(None),
+            row_version: Set(1),
+            created_at: NotSet,
+            updated_at: NotSet,
+        })
+        .on_conflict(
+            OnConflict::column(cover_candidate::Column::CandidateId)
+                .do_nothing()
+                .to_owned(),
+        )
+        .do_nothing()
+        .exec_without_returning(&self.database)
+        .await?;
+        match result {
+            TryInsertResult::Inserted(1) => self
+                .get_candidate(candidate_id)
+                .await?
+                .ok_or(CoverError::CandidateNotFound { candidate_id }),
+            TryInsertResult::Inserted(0) | TryInsertResult::Conflicted => {
+                Err(CoverError::CandidateAlreadyExists { candidate_id })
+            }
+            TryInsertResult::Inserted(_) | TryInsertResult::Empty => Err(CoverError::Database(
+                DbErr::Custom("cover candidate insert affected an unexpected row count".into()),
+            )),
+        }
+    }
+
+    pub async fn get_candidate(
+        &self,
+        candidate_id: Uuid,
+    ) -> Result<Option<CoverCandidateSnapshot>, CoverError> {
+        let Some(candidate) = get_candidate_model(&self.database, candidate_id).await? else {
+            return Ok(None);
+        };
+        candidate_to_snapshot(&self.database, candidate)
+            .await
+            .map(Some)
+    }
+
+    pub async fn list_candidates(
+        &self,
+        release_id: Uuid,
+        disc_number: Option<u16>,
+    ) -> Result<Vec<CoverCandidateSnapshot>, CoverError> {
+        let release = get_release_model(&self.database, release_id)
+            .await?
+            .ok_or(CoverError::ReleaseNotFound { release_id })?;
+        let mut query = cover_candidate::Entity::find()
+            .filter(cover_candidate::Column::ReleaseDbId.eq(release.id));
+        if let Some(disc_number) = disc_number {
+            query = query.filter(
+                cover_candidate::Column::DiscNumber.eq(store_disc_number(disc_number, release_id)?),
+            );
+        }
+        let models = query
+            .order_by_asc(cover_candidate::Column::DiscNumber)
+            .order_by_asc(cover_candidate::Column::Id)
+            .all(&self.database)
+            .await?;
+        let mut snapshots = Vec::with_capacity(models.len());
+        for model in models {
+            snapshots.push(candidate_to_snapshot(&self.database, model).await?);
+        }
+        Ok(snapshots)
+    }
+
+    pub async fn queue_candidate(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        not_before: Option<DateTimeUtc>,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        let current = get_candidate_model(&self.database, candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })?;
+        ensure_candidate_version(&current, expected)?;
+        let state = parse_candidate_state(candidate_id, &current.state)?;
+        if !state.can_transition_to(CoverCandidateState::Queued) {
+            return Err(CoverError::InvalidCandidateTransition {
+                candidate_id,
+                from: state,
+                to: CoverCandidateState::Queued,
+            });
+        }
+        let next = expected.next("cover candidate", candidate_id)?;
+        let result = cover_candidate::Entity::update_many()
+            .col_expr(
+                cover_candidate::Column::State,
+                Expr::value(CoverCandidateState::Queued.as_str()),
+            )
+            .col_expr(
+                cover_candidate::Column::LeaseToken,
+                Expr::value(None::<Uuid>),
+            )
+            .col_expr(
+                cover_candidate::Column::LeaseExpiresAt,
+                Expr::value(None::<StoredTimestamp>),
+            )
+            .col_expr(
+                cover_candidate::Column::NextAttemptAt,
+                Expr::value(not_before.map(store_timestamp)),
+            )
+            .col_expr(
+                cover_candidate::Column::RowVersion,
+                Expr::value(next.as_i64("cover candidate", candidate_id)?),
+            )
+            .col_expr(
+                cover_candidate::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(cover_candidate::Column::CandidateId.eq(candidate_id))
+            .filter(
+                cover_candidate::Column::RowVersion
+                    .eq(expected.as_i64("cover candidate", candidate_id)?),
+            )
+            .exec(&self.database)
+            .await?;
+        if result.rows_affected != 1 {
+            return self
+                .candidate_conflict_or_not_found(candidate_id, expected)
+                .await;
+        }
+        self.get_candidate(candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })
+    }
+
+    /// Claim one due candidate using a compare-and-swap update. An expired
+    /// fetching lease is reclaimable, which prevents a dead worker from
+    /// permanently wedging the queue.
+    pub async fn claim_next(
+        &self,
+        lease_for: Duration,
+    ) -> Result<Option<CoverFetchLease>, CoverError> {
+        self.claim_next_at(chrono::Utc::now(), lease_for).await
+    }
+
+    pub async fn claim_next_at(
+        &self,
+        claimed_at: DateTimeUtc,
+        lease_for: Duration,
+    ) -> Result<Option<CoverFetchLease>, CoverError> {
+        if lease_for.is_zero() {
+            return Err(CoverError::InvalidInput {
+                field: "lease_for",
+                message: "duration must be positive",
+            });
+        }
+        let lease_delta =
+            chrono::Duration::from_std(lease_for).map_err(|_| CoverError::InvalidInput {
+                field: "lease_for",
+                message: "duration is too large",
+            })?;
+        let lease_expires_at =
+            claimed_at
+                .checked_add_signed(lease_delta)
+                .ok_or(CoverError::InvalidInput {
+                    field: "lease_for",
+                    message: "duration overflows timestamp",
+                })?;
+        let stored_now = store_timestamp(claimed_at);
+
+        for _ in 0..MAX_CLAIM_CAS_ATTEMPTS {
+            let queued_due = Condition::all()
+                .add(cover_candidate::Column::State.eq(CoverCandidateState::Queued.as_str()))
+                .add(
+                    Condition::any()
+                        .add(cover_candidate::Column::NextAttemptAt.is_null())
+                        .add(cover_candidate::Column::NextAttemptAt.lte(stored_now)),
+                );
+            let expired_fetch = Condition::all()
+                .add(cover_candidate::Column::State.eq(CoverCandidateState::Fetching.as_str()))
+                .add(cover_candidate::Column::LeaseExpiresAt.lte(stored_now));
+            let Some(candidate) = cover_candidate::Entity::find()
+                .filter(Condition::any().add(queued_due).add(expired_fetch))
+                .order_by_asc(cover_candidate::Column::NextAttemptAt)
+                .order_by_asc(cover_candidate::Column::Id)
+                .one(&self.database)
+                .await?
+            else {
+                return Ok(None);
+            };
+            let candidate_id = candidate.candidate_id;
+            // Validate persisted values before changing queue state. A corrupt
+            // row should stay inspectable instead of being leased and then
+            // abandoned until its timeout.
+            let release = catalog_release::Entity::find_by_id(candidate.release_db_id)
+                .one(&self.database)
+                .await?
+                .ok_or_else(|| missing_reference("cover candidate", candidate_id, "release"))?;
+            let request_url = candidate
+                .effective_url
+                .clone()
+                .or_else(|| candidate.canonical_url.clone())
+                .or_else(|| candidate.submitted_url.clone())
+                .ok_or(CoverError::InvalidPersistedValue {
+                    entity: "cover candidate",
+                    id: candidate_id,
+                    field: "request_url",
+                    value: "missing".to_owned(),
+                })?;
+            let disc_number = load_disc_number(candidate_id, candidate.disc_number)?;
+            let source_kind = parse_source_kind(candidate_id, &candidate.source_kind)?;
+            let current_version =
+                parse_row_version("cover candidate", candidate_id, candidate.row_version)?;
+            let next_version = current_version.next("cover candidate", candidate_id)?;
+            let attempt_count =
+                candidate
+                    .attempt_count
+                    .checked_add(1)
+                    .ok_or(CoverError::NumericOutOfRange {
+                        entity: "cover candidate",
+                        id: candidate_id,
+                        field: "attempt_count",
+                    })?;
+            let lease_token = Uuid::new_v4();
+            let result = cover_candidate::Entity::update_many()
+                .col_expr(
+                    cover_candidate::Column::State,
+                    Expr::value(CoverCandidateState::Fetching.as_str()),
+                )
+                .col_expr(
+                    cover_candidate::Column::AttemptCount,
+                    Expr::value(attempt_count),
+                )
+                .col_expr(
+                    cover_candidate::Column::LeaseToken,
+                    Expr::value(Some(lease_token)),
+                )
+                .col_expr(
+                    cover_candidate::Column::LeaseExpiresAt,
+                    Expr::value(Some(store_timestamp(lease_expires_at))),
+                )
+                .col_expr(
+                    cover_candidate::Column::NextAttemptAt,
+                    Expr::value(None::<StoredTimestamp>),
+                )
+                .col_expr(
+                    cover_candidate::Column::RowVersion,
+                    Expr::value(next_version.as_i64("cover candidate", candidate_id)?),
+                )
+                .col_expr(
+                    cover_candidate::Column::UpdatedAt,
+                    Expr::current_timestamp().into(),
+                )
+                .filter(cover_candidate::Column::Id.eq(candidate.id))
+                .filter(cover_candidate::Column::RowVersion.eq(candidate.row_version))
+                .exec(&self.database)
+                .await?;
+            if result.rows_affected != 1 {
+                continue;
+            }
+
+            return Ok(Some(CoverFetchLease {
+                candidate_id,
+                release_id: release.release_id,
+                disc_number,
+                source_kind,
+                request_url,
+                lease_token,
+                lease_expires_at,
+                attempt_count: u32::try_from(attempt_count).map_err(|_| {
+                    CoverError::NumericOutOfRange {
+                        entity: "cover candidate",
+                        id: candidate_id,
+                        field: "attempt_count",
+                    }
+                })?,
+                row_version: next_version,
+            }));
+        }
+        // Repeated CAS misses indicate contention, not absence. Returning no
+        // lease lets the worker poll again without turning contention into an
+        // operational error.
+        Ok(None)
+    }
+
+    pub async fn complete_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        verified: VerifiedCoverAsset,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        if verified.byte_length == 0 {
+            return Err(CoverError::InvalidInput {
+                field: "byte_length",
+                message: "value must be positive",
+            });
+        }
+        if let Some(effective_url) = &verified.effective_url {
+            // Validation is intentional; the exact effective value is stored
+            // below, not the potentially rewritten validation result.
+            canonicalize_cover_url(effective_url).map_err(CoverError::InvalidUrl)?;
+        }
+
+        let transaction = self.database.begin().await?;
+        let candidate = get_candidate_model(&transaction, candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })?;
+        ensure_worker_lease(
+            &candidate,
+            expected,
+            lease_token,
+            CoverCandidateState::Verified,
+        )?;
+        let asset = get_or_insert_asset(&transaction, &verified).await?;
+        let next = expected.next("cover candidate", candidate_id)?;
+        let effective_url = verified.effective_url.or(candidate.effective_url.clone());
+        let result = cover_candidate::Entity::update_many()
+            .col_expr(
+                cover_candidate::Column::State,
+                Expr::value(CoverCandidateState::Verified.as_str()),
+            )
+            .col_expr(
+                cover_candidate::Column::AssetDbId,
+                Expr::value(Some(asset.id)),
+            )
+            .col_expr(
+                cover_candidate::Column::EffectiveUrl,
+                Expr::value(effective_url),
+            )
+            .col_expr(
+                cover_candidate::Column::LeaseToken,
+                Expr::value(None::<Uuid>),
+            )
+            .col_expr(
+                cover_candidate::Column::LeaseExpiresAt,
+                Expr::value(None::<StoredTimestamp>),
+            )
+            .col_expr(
+                cover_candidate::Column::NextAttemptAt,
+                Expr::value(None::<StoredTimestamp>),
+            )
+            .col_expr(
+                cover_candidate::Column::LastHttpStatus,
+                Expr::value(None::<i32>),
+            )
+            .col_expr(
+                cover_candidate::Column::LastErrorCode,
+                Expr::value(None::<String>),
+            )
+            .col_expr(
+                cover_candidate::Column::LastErrorMessage,
+                Expr::value(None::<String>),
+            )
+            .col_expr(cover_candidate::Column::FetchedAt, Expr::value(Some(now())))
+            .col_expr(
+                cover_candidate::Column::RowVersion,
+                Expr::value(next.as_i64("cover candidate", candidate_id)?),
+            )
+            .col_expr(
+                cover_candidate::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(cover_candidate::Column::Id.eq(candidate.id))
+            .filter(cover_candidate::Column::RowVersion.eq(candidate.row_version))
+            .filter(cover_candidate::Column::LeaseToken.eq(Some(lease_token)))
+            .exec(&transaction)
+            .await?;
+        if result.rows_affected != 1 {
+            return Err(CoverError::LeaseMismatch { candidate_id });
+        }
+        transaction.commit().await?;
+        self.get_candidate(candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })
+    }
+
+    pub async fn retry_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+        not_before: DateTimeUtc,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.finish_with_failure(
+            candidate_id,
+            expected,
+            lease_token,
+            failure,
+            CoverCandidateState::Queued,
+            Some(not_before),
+        )
+        .await
+    }
+
+    pub async fn reject_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.finish_with_failure(
+            candidate_id,
+            expected,
+            lease_token,
+            failure,
+            CoverCandidateState::Rejected,
+            None,
+        )
+        .await
+    }
+
+    async fn finish_with_failure(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+        target: CoverCandidateState,
+        not_before: Option<DateTimeUtc>,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        validate_failure(&failure)?;
+        let candidate = get_candidate_model(&self.database, candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })?;
+        ensure_worker_lease(&candidate, expected, lease_token, target)?;
+        let next = expected.next("cover candidate", candidate_id)?;
+        let status = failure.http_status.map(i32::from);
+        let safe_message = failure.message.as_deref().and_then(sanitize_message);
+        let result = cover_candidate::Entity::update_many()
+            .col_expr(cover_candidate::Column::State, Expr::value(target.as_str()))
+            .col_expr(
+                cover_candidate::Column::LeaseToken,
+                Expr::value(None::<Uuid>),
+            )
+            .col_expr(
+                cover_candidate::Column::LeaseExpiresAt,
+                Expr::value(None::<StoredTimestamp>),
+            )
+            .col_expr(
+                cover_candidate::Column::NextAttemptAt,
+                Expr::value(not_before.map(store_timestamp)),
+            )
+            .col_expr(cover_candidate::Column::LastHttpStatus, Expr::value(status))
+            .col_expr(
+                cover_candidate::Column::LastErrorCode,
+                Expr::value(Some(failure.code)),
+            )
+            .col_expr(
+                cover_candidate::Column::LastErrorMessage,
+                Expr::value(safe_message),
+            )
+            .col_expr(
+                cover_candidate::Column::RowVersion,
+                Expr::value(next.as_i64("cover candidate", candidate_id)?),
+            )
+            .col_expr(
+                cover_candidate::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(cover_candidate::Column::Id.eq(candidate.id))
+            .filter(cover_candidate::Column::RowVersion.eq(candidate.row_version))
+            .filter(cover_candidate::Column::LeaseToken.eq(Some(lease_token)))
+            .exec(&self.database)
+            .await?;
+        if result.rows_affected != 1 {
+            return Err(CoverError::LeaseMismatch { candidate_id });
+        }
+        self.get_candidate(candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })
+    }
+
+    pub async fn reject_candidate(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        reason_code: String,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        validate_failure_code(&reason_code)?;
+        let candidate = get_candidate_model(&self.database, candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })?;
+        ensure_candidate_version(&candidate, expected)?;
+        let state = parse_candidate_state(candidate_id, &candidate.state)?;
+        // A fetching candidate can only be rejected by the lease owner.
+        if state == CoverCandidateState::Fetching
+            || !state.can_transition_to(CoverCandidateState::Rejected)
+        {
+            return Err(CoverError::InvalidCandidateTransition {
+                candidate_id,
+                from: state,
+                to: CoverCandidateState::Rejected,
+            });
+        }
+        let next = expected.next("cover candidate", candidate_id)?;
+        let result = cover_candidate::Entity::update_many()
+            .col_expr(
+                cover_candidate::Column::State,
+                Expr::value(CoverCandidateState::Rejected.as_str()),
+            )
+            .col_expr(
+                cover_candidate::Column::LastErrorCode,
+                Expr::value(Some(reason_code)),
+            )
+            .col_expr(
+                cover_candidate::Column::LastErrorMessage,
+                Expr::value(None::<String>),
+            )
+            .col_expr(
+                cover_candidate::Column::NextAttemptAt,
+                Expr::value(None::<StoredTimestamp>),
+            )
+            .col_expr(
+                cover_candidate::Column::RowVersion,
+                Expr::value(next.as_i64("cover candidate", candidate_id)?),
+            )
+            .col_expr(
+                cover_candidate::Column::UpdatedAt,
+                Expr::current_timestamp().into(),
+            )
+            .filter(cover_candidate::Column::Id.eq(candidate.id))
+            .filter(cover_candidate::Column::RowVersion.eq(candidate.row_version))
+            .exec(&self.database)
+            .await?;
+        if result.rows_affected != 1 {
+            return self
+                .candidate_conflict_or_not_found(candidate_id, expected)
+                .await;
+        }
+        self.get_candidate(candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound { candidate_id })
+    }
+
+    pub async fn select_cover(
+        &self,
+        input: SelectCover,
+    ) -> Result<CoverSelectionSnapshot, CoverError> {
+        let transaction = self.database.begin().await?;
+        let release = get_release_model(&transaction, input.release_id)
+            .await?
+            .ok_or(CoverError::ReleaseNotFound {
+                release_id: input.release_id,
+            })?;
+        let disc_number = store_disc_number(input.disc_number, input.release_id)?;
+        let candidate = get_candidate_model(&transaction, input.candidate_id)
+            .await?
+            .ok_or(CoverError::CandidateNotFound {
+                candidate_id: input.candidate_id,
+            })?;
+        let actual_release = catalog_release::Entity::find_by_id(candidate.release_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_reference("cover candidate", input.candidate_id, "release"))?;
+        let actual_disc = load_disc_number(input.candidate_id, candidate.disc_number)?;
+        if candidate.release_db_id != release.id || candidate.disc_number != disc_number {
+            return Err(CoverError::CandidateScopeMismatch {
+                candidate_id: input.candidate_id,
+                expected_release_id: input.release_id,
+                expected_disc_number: input.disc_number,
+                actual_release_id: actual_release.release_id,
+                actual_disc_number: actual_disc,
+            });
+        }
+        if parse_candidate_state(input.candidate_id, &candidate.state)?
+            != CoverCandidateState::Verified
+        {
+            return Err(CoverError::CandidateNotVerified {
+                candidate_id: input.candidate_id,
+            });
+        }
+        let asset_db_id = candidate
+            .asset_db_id
+            .ok_or(CoverError::CandidateAssetMissing {
+                candidate_id: input.candidate_id,
+            })?;
+        cover_asset::Entity::find_by_id(asset_db_id)
+            .one(&transaction)
+            .await?
+            .ok_or_else(|| missing_reference("cover candidate", input.candidate_id, "asset"))?;
+
+        let existing = cover_selection::Entity::find()
+            .filter(cover_selection::Column::ReleaseDbId.eq(release.id))
+            .filter(cover_selection::Column::DiscNumber.eq(disc_number))
+            .one(&transaction)
+            .await?;
+        match (existing, input.expected_row_version) {
+            (None, Some(_)) => {
+                return Err(CoverError::SelectionNotFound {
+                    release_id: input.release_id,
+                    disc_number: input.disc_number,
+                });
+            }
+            (None, None) => {
+                let selection_id = Uuid::new_v4();
+                let inserted = cover_selection::Entity::insert(cover_selection::ActiveModel {
+                    id: NotSet,
+                    selection_id: Set(selection_id),
+                    release_db_id: Set(release.id),
+                    disc_number: Set(disc_number),
+                    candidate_db_id: Set(candidate.id),
+                    asset_db_id: Set(asset_db_id),
+                    row_version: Set(1),
+                    selected_at: Set(now()),
+                    updated_at: NotSet,
+                })
+                .on_conflict(
+                    OnConflict::columns([
+                        cover_selection::Column::ReleaseDbId,
+                        cover_selection::Column::DiscNumber,
+                    ])
+                    .do_nothing()
+                    .to_owned(),
+                )
+                .do_nothing()
+                .exec_without_returning(&transaction)
+                .await?;
+                if !matches!(inserted, TryInsertResult::Inserted(1)) {
+                    return Err(CoverError::SelectionAlreadyExists {
+                        release_id: input.release_id,
+                        disc_number: input.disc_number,
+                    });
+                }
+            }
+            (Some(_), None) => {
+                return Err(CoverError::SelectionAlreadyExists {
+                    release_id: input.release_id,
+                    disc_number: input.disc_number,
+                });
+            }
+            (Some(selection), Some(expected)) => {
+                let actual = parse_row_version(
+                    "cover selection",
+                    selection.selection_id,
+                    selection.row_version,
+                )?;
+                if actual != expected {
+                    return Err(CoverError::SelectionConflict {
+                        release_id: input.release_id,
+                        disc_number: input.disc_number,
+                        expected,
+                        actual,
+                    });
+                }
+                let next = expected.next("cover selection", selection.selection_id)?;
+                let result = cover_selection::Entity::update_many()
+                    .col_expr(
+                        cover_selection::Column::CandidateDbId,
+                        Expr::value(candidate.id),
+                    )
+                    .col_expr(cover_selection::Column::AssetDbId, Expr::value(asset_db_id))
+                    .col_expr(
+                        cover_selection::Column::RowVersion,
+                        Expr::value(next.as_i64("cover selection", selection.selection_id)?),
+                    )
+                    .col_expr(
+                        cover_selection::Column::SelectedAt,
+                        Expr::current_timestamp().into(),
+                    )
+                    .col_expr(
+                        cover_selection::Column::UpdatedAt,
+                        Expr::current_timestamp().into(),
+                    )
+                    .filter(cover_selection::Column::Id.eq(selection.id))
+                    .filter(cover_selection::Column::RowVersion.eq(selection.row_version))
+                    .exec(&transaction)
+                    .await?;
+                if result.rows_affected != 1 {
+                    let current = cover_selection::Entity::find_by_id(selection.id)
+                        .one(&transaction)
+                        .await?;
+                    return match current {
+                        Some(current) => Err(CoverError::SelectionConflict {
+                            release_id: input.release_id,
+                            disc_number: input.disc_number,
+                            expected,
+                            actual: parse_row_version(
+                                "cover selection",
+                                current.selection_id,
+                                current.row_version,
+                            )?,
+                        }),
+                        None => Err(CoverError::SelectionNotFound {
+                            release_id: input.release_id,
+                            disc_number: input.disc_number,
+                        }),
+                    };
+                }
+            }
+        }
+        transaction.commit().await?;
+        self.get_selection(input.release_id, input.disc_number)
+            .await?
+            .ok_or(CoverError::SelectionNotFound {
+                release_id: input.release_id,
+                disc_number: input.disc_number,
+            })
+    }
+
+    pub async fn get_selection(
+        &self,
+        release_id: Uuid,
+        disc_number: u16,
+    ) -> Result<Option<CoverSelectionSnapshot>, CoverError> {
+        let Some(release) = get_release_model(&self.database, release_id).await? else {
+            return Ok(None);
+        };
+        let stored_disc = store_disc_number(disc_number, release_id)?;
+        let Some(selection) = cover_selection::Entity::find()
+            .filter(cover_selection::Column::ReleaseDbId.eq(release.id))
+            .filter(cover_selection::Column::DiscNumber.eq(stored_disc))
+            .one(&self.database)
+            .await?
+        else {
+            return Ok(None);
+        };
+        selection_to_snapshot(&self.database, release_id, selection)
+            .await
+            .map(Some)
+    }
+
+    async fn candidate_conflict_or_not_found(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        match self.get_candidate(candidate_id).await? {
+            Some(actual) => Err(CoverError::CandidateConflict {
+                candidate_id,
+                expected,
+                actual: actual.row_version,
+            }),
+            None => Err(CoverError::CandidateNotFound { candidate_id }),
+        }
+    }
+}
+
+/// Application-facing facade. Keeping workers and web resolvers on this one
+/// facade prevents either surface from bypassing repository invariants.
+#[derive(Clone)]
+pub struct CoverService {
+    repository: CoverRepository,
+}
+
+impl CoverService {
+    pub fn new(repository: CoverRepository) -> Self {
+        Self { repository }
+    }
+
+    pub const fn repository(&self) -> &CoverRepository {
+        &self.repository
+    }
+
+    pub async fn create_candidate(
+        &self,
+        input: NewCoverCandidate,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository.create_candidate(input).await
+    }
+
+    pub async fn get_candidate(
+        &self,
+        candidate_id: Uuid,
+    ) -> Result<Option<CoverCandidateSnapshot>, CoverError> {
+        self.repository.get_candidate(candidate_id).await
+    }
+
+    pub async fn list_candidates(
+        &self,
+        release_id: Uuid,
+        disc_number: Option<u16>,
+    ) -> Result<Vec<CoverCandidateSnapshot>, CoverError> {
+        self.repository
+            .list_candidates(release_id, disc_number)
+            .await
+    }
+
+    pub async fn queue_candidate(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        not_before: Option<DateTimeUtc>,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository
+            .queue_candidate(candidate_id, expected, not_before)
+            .await
+    }
+
+    pub async fn claim_next(
+        &self,
+        lease_for: Duration,
+    ) -> Result<Option<CoverFetchLease>, CoverError> {
+        self.repository.claim_next(lease_for).await
+    }
+
+    pub async fn complete_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        verified: VerifiedCoverAsset,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository
+            .complete_fetch(candidate_id, expected, lease_token, verified)
+            .await
+    }
+
+    pub async fn retry_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+        not_before: DateTimeUtc,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository
+            .retry_fetch(candidate_id, expected, lease_token, failure, not_before)
+            .await
+    }
+
+    pub async fn reject_fetch(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository
+            .reject_fetch(candidate_id, expected, lease_token, failure)
+            .await
+    }
+
+    pub async fn reject_candidate(
+        &self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        reason_code: String,
+    ) -> Result<CoverCandidateSnapshot, CoverError> {
+        self.repository
+            .reject_candidate(candidate_id, expected, reason_code)
+            .await
+    }
+
+    pub async fn select_cover(
+        &self,
+        input: SelectCover,
+    ) -> Result<CoverSelectionSnapshot, CoverError> {
+        self.repository.select_cover(input).await
+    }
+
+    pub async fn get_selection(
+        &self,
+        release_id: Uuid,
+        disc_number: u16,
+    ) -> Result<Option<CoverSelectionSnapshot>, CoverError> {
+        self.repository.get_selection(release_id, disc_number).await
+    }
+}
+
+async fn get_release_model<C: ConnectionTrait>(
+    connection: &C,
+    release_id: Uuid,
+) -> Result<Option<catalog_release::Model>, CoverError> {
+    Ok(catalog_release::Entity::find()
+        .filter(catalog_release::Column::ReleaseId.eq(release_id))
+        .one(connection)
+        .await?)
+}
+
+async fn get_candidate_model<C: ConnectionTrait>(
+    connection: &C,
+    candidate_id: Uuid,
+) -> Result<Option<cover_candidate::Model>, CoverError> {
+    Ok(cover_candidate::Entity::find()
+        .filter(cover_candidate::Column::CandidateId.eq(candidate_id))
+        .one(connection)
+        .await?)
+}
+
+async fn candidate_to_snapshot<C: ConnectionTrait>(
+    connection: &C,
+    model: cover_candidate::Model,
+) -> Result<CoverCandidateSnapshot, CoverError> {
+    let candidate_id = model.candidate_id;
+    let release = catalog_release::Entity::find_by_id(model.release_db_id)
+        .one(connection)
+        .await?
+        .ok_or_else(|| missing_reference("cover candidate", candidate_id, "release"))?;
+    let asset = match model.asset_db_id {
+        Some(asset_id) => Some(
+            cover_asset::Entity::find_by_id(asset_id)
+                .one(connection)
+                .await?
+                .ok_or_else(|| missing_reference("cover candidate", candidate_id, "asset"))?
+                .try_into()?,
+        ),
+        None => None,
+    };
+    Ok(CoverCandidateSnapshot {
+        candidate_id,
+        release_id: release.release_id,
+        disc_number: load_disc_number(candidate_id, model.disc_number)?,
+        source_kind: parse_source_kind(candidate_id, &model.source_kind)?,
+        source_release_revision_db_id: model.source_release_revision_db_id,
+        state: parse_candidate_state(candidate_id, &model.state)?,
+        asset,
+        has_remote_url: model.effective_url.is_some()
+            || model.canonical_url.is_some()
+            || model.submitted_url.is_some(),
+        attempt_count: u32::try_from(model.attempt_count).map_err(|_| {
+            CoverError::InvalidPersistedValue {
+                entity: "cover candidate",
+                id: candidate_id,
+                field: "attempt_count",
+                value: model.attempt_count.to_string(),
+            }
+        })?,
+        next_attempt_at: model.next_attempt_at.map(timestamp),
+        last_http_status: model
+            .last_http_status
+            .map(|value| {
+                u16::try_from(value).map_err(|_| CoverError::InvalidPersistedValue {
+                    entity: "cover candidate",
+                    id: candidate_id,
+                    field: "last_http_status",
+                    value: value.to_string(),
+                })
+            })
+            .transpose()?,
+        last_error_code: model.last_error_code,
+        fetched_at: model.fetched_at.map(timestamp),
+        row_version: parse_row_version("cover candidate", candidate_id, model.row_version)?,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+async fn selection_to_snapshot<C: ConnectionTrait>(
+    connection: &C,
+    release_id: Uuid,
+    model: cover_selection::Model,
+) -> Result<CoverSelectionSnapshot, CoverError> {
+    let selection_id = model.selection_id;
+    let candidate = cover_candidate::Entity::find_by_id(model.candidate_db_id)
+        .one(connection)
+        .await?
+        .ok_or_else(|| missing_reference("cover selection", selection_id, "candidate"))?;
+    let asset: CoverAssetSnapshot = cover_asset::Entity::find_by_id(model.asset_db_id)
+        .one(connection)
+        .await?
+        .ok_or_else(|| missing_reference("cover selection", selection_id, "asset"))?
+        .try_into()?;
+    Ok(CoverSelectionSnapshot {
+        selection_id,
+        release_id,
+        disc_number: load_disc_number(selection_id, model.disc_number)?,
+        candidate_id: candidate.candidate_id,
+        asset,
+        row_version: parse_row_version("cover selection", selection_id, model.row_version)?,
+        selected_at: timestamp(model.selected_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+impl TryFrom<cover_asset::Model> for CoverAssetSnapshot {
+    type Error = CoverError;
+
+    fn try_from(model: cover_asset::Model) -> Result<Self, Self::Error> {
+        let asset_id = model.asset_id;
+        let digest = digest_from_bytes(asset_id, model.content_sha256)?;
+        let media_type = CoverMediaType::from_str(&model.media_type).map_err(|_| {
+            CoverError::InvalidPersistedValue {
+                entity: "cover asset",
+                id: asset_id,
+                field: "media_type",
+                value: model.media_type.clone(),
+            }
+        })?;
+        let expected_key = cover_asset_storage_key(digest.as_bytes(), media_type);
+        if model.storage_key != expected_key {
+            return Err(CoverError::InvalidPersistedValue {
+                entity: "cover asset",
+                id: asset_id,
+                field: "storage_key",
+                value: "does not match digest and media type".to_owned(),
+            });
+        }
+        Ok(Self {
+            asset_id,
+            content_sha256: digest,
+            storage_key: model.storage_key,
+            media_type,
+            width: positive_i32(asset_id, "width", model.width)?,
+            height: positive_i32(asset_id, "height", model.height)?,
+            byte_length: positive_i64(asset_id, "byte_length", model.byte_length)?,
+            fetched_at: timestamp(model.fetched_at),
+            verified_at: timestamp(model.verified_at),
+            created_at: timestamp(model.created_at),
+        })
+    }
+}
+
+async fn get_or_insert_asset<C: ConnectionTrait>(
+    connection: &C,
+    verified: &VerifiedCoverAsset,
+) -> Result<cover_asset::Model, CoverError> {
+    let digest = verified.content_sha256;
+    let digest_bytes = digest.as_bytes().to_vec();
+    let storage_key = cover_asset_storage_key(digest.as_bytes(), verified.media_type);
+    let width = i32::try_from(verified.width.get()).map_err(|_| CoverError::NumericOutOfRange {
+        entity: "cover asset",
+        id: Uuid::nil(),
+        field: "width",
+    })?;
+    let height =
+        i32::try_from(verified.height.get()).map_err(|_| CoverError::NumericOutOfRange {
+            entity: "cover asset",
+            id: Uuid::nil(),
+            field: "height",
+        })?;
+    let byte_length =
+        i64::try_from(verified.byte_length).map_err(|_| CoverError::NumericOutOfRange {
+            entity: "cover asset",
+            id: Uuid::nil(),
+            field: "byte_length",
+        })?;
+
+    if let Some(existing) = cover_asset::Entity::find()
+        .filter(cover_asset::Column::ContentSha256.eq(digest_bytes.clone()))
+        .one(connection)
+        .await?
+    {
+        ensure_asset_identity(
+            &existing,
+            digest,
+            &storage_key,
+            verified.media_type,
+            width,
+            height,
+            byte_length,
+        )?;
+        return Ok(existing);
+    }
+
+    let asset_id = Uuid::new_v4();
+    let inserted = cover_asset::Entity::insert(cover_asset::ActiveModel {
+        id: NotSet,
+        asset_id: Set(asset_id),
+        content_sha256: Set(digest_bytes.clone()),
+        storage_key: Set(storage_key.clone()),
+        media_type: Set(verified.media_type.as_str().to_owned()),
+        width: Set(width),
+        height: Set(height),
+        byte_length: Set(byte_length),
+        fetched_at: Set(now()),
+        verified_at: Set(now()),
+        created_at: NotSet,
+    })
+    .on_conflict(
+        OnConflict::column(cover_asset::Column::ContentSha256)
+            .do_nothing()
+            .to_owned(),
+    )
+    .do_nothing()
+    .exec_without_returning(connection)
+    .await?;
+    match inserted {
+        TryInsertResult::Inserted(1)
+        | TryInsertResult::Inserted(0)
+        | TryInsertResult::Conflicted => {
+            let existing = cover_asset::Entity::find()
+                .filter(cover_asset::Column::ContentSha256.eq(digest_bytes))
+                .one(connection)
+                .await?
+                .ok_or_else(|| {
+                    CoverError::Database(DbErr::Custom(
+                        "content-addressed cover insert completed without a readable row".into(),
+                    ))
+                })?;
+            ensure_asset_identity(
+                &existing,
+                digest,
+                &storage_key,
+                verified.media_type,
+                width,
+                height,
+                byte_length,
+            )?;
+            Ok(existing)
+        }
+        TryInsertResult::Inserted(_) | TryInsertResult::Empty => Err(CoverError::Database(
+            DbErr::Custom("cover asset insert affected an unexpected row count".into()),
+        )),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+fn ensure_asset_identity(
+    model: &cover_asset::Model,
+    digest: Digest,
+    storage_key: &str,
+    media_type: CoverMediaType,
+    width: i32,
+    height: i32,
+    byte_length: i64,
+) -> Result<(), CoverError> {
+    if model.storage_key != storage_key
+        || model.media_type != media_type.as_str()
+        || model.width != width
+        || model.height != height
+        || model.byte_length != byte_length
+    {
+        Err(CoverError::AssetDigestConflict { digest })
+    } else {
+        Ok(())
+    }
+}
+
+fn preferred_url(source: CoverSourceKind, submitted: &str) -> Result<String, CoverError> {
+    match source {
+        CoverSourceKind::Amazon => preferred_amazon_artwork_url(submitted),
+        CoverSourceKind::AppleMusic => preferred_apple_artwork_url(submitted),
+        CoverSourceKind::RecordLabel
+        | CoverSourceKind::ArtistWebsite
+        | CoverSourceKind::Vgmdb
+        | CoverSourceKind::Manual => canonicalize_cover_url(submitted),
+    }
+    .map_err(CoverError::InvalidUrl)
+}
+
+fn ensure_candidate_version(
+    model: &cover_candidate::Model,
+    expected: CoverRowVersion,
+) -> Result<(), CoverError> {
+    let actual = parse_row_version("cover candidate", model.candidate_id, model.row_version)?;
+    if actual == expected {
+        Ok(())
+    } else {
+        Err(CoverError::CandidateConflict {
+            candidate_id: model.candidate_id,
+            expected,
+            actual,
+        })
+    }
+}
+
+fn ensure_worker_lease(
+    model: &cover_candidate::Model,
+    expected: CoverRowVersion,
+    lease_token: Uuid,
+    target: CoverCandidateState,
+) -> Result<(), CoverError> {
+    ensure_candidate_version(model, expected)?;
+    let state = parse_candidate_state(model.candidate_id, &model.state)?;
+    if state != CoverCandidateState::Fetching {
+        return Err(CoverError::InvalidCandidateTransition {
+            candidate_id: model.candidate_id,
+            from: state,
+            to: target,
+        });
+    }
+    if model.lease_token != Some(lease_token) {
+        return Err(CoverError::LeaseMismatch {
+            candidate_id: model.candidate_id,
+        });
+    }
+    let lease_is_current = model
+        .lease_expires_at
+        .as_ref()
+        .is_some_and(|expires_at| timestamp(expires_at.to_owned()) > chrono::Utc::now());
+    if !lease_is_current {
+        return Err(CoverError::LeaseMismatch {
+            candidate_id: model.candidate_id,
+        });
+    }
+    Ok(())
+}
+
+fn validate_failure(failure: &CoverFetchFailure) -> Result<(), CoverError> {
+    validate_failure_code(&failure.code)?;
+    if failure.http_status == Some(0) {
+        return Err(CoverError::InvalidInput {
+            field: "http_status",
+            message: "status must be positive when present",
+        });
+    }
+    Ok(())
+}
+
+fn validate_failure_code(code: &str) -> Result<(), CoverError> {
+    if code.is_empty()
+        || code.len() > MAX_FAILURE_CODE_BYTES
+        || !code
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-' | b'.'))
+    {
+        Err(CoverError::InvalidInput {
+            field: "failure_code",
+            message: "use 1-64 ASCII letters, digits, dot, dash, or underscore",
+        })
+    } else {
+        Ok(())
+    }
+}
+
+/// Avoid persisting URLs, credentials, or unbounded server responses. A
+/// message that looks like it contains a URL is discarded entirely; the
+/// bounded error code remains available to clients and metrics.
+fn sanitize_message(message: &str) -> Option<String> {
+    let lowercase = message.to_ascii_lowercase();
+    if message.contains("://")
+        || message.contains('?')
+        || [
+            "authorization",
+            "credential",
+            "password",
+            "secret",
+            "signature",
+            "token",
+        ]
+        .iter()
+        .any(|needle| lowercase.contains(needle))
+    {
+        return None;
+    }
+    let sanitized: String = message
+        .chars()
+        .filter(|character| !character.is_control())
+        .take(MAX_FAILURE_MESSAGE_CHARS)
+        .collect();
+    (!sanitized.is_empty()).then_some(sanitized)
+}
+
+fn parse_candidate_state(
+    candidate_id: Uuid,
+    value: &str,
+) -> Result<CoverCandidateState, CoverError> {
+    CoverCandidateState::from_str(value).map_err(|_| CoverError::InvalidPersistedValue {
+        entity: "cover candidate",
+        id: candidate_id,
+        field: "state",
+        value: value.to_owned(),
+    })
+}
+
+fn parse_source_kind(candidate_id: Uuid, value: &str) -> Result<CoverSourceKind, CoverError> {
+    CoverSourceKind::from_str(value).map_err(|_| CoverError::InvalidPersistedValue {
+        entity: "cover candidate",
+        id: candidate_id,
+        field: "source_kind",
+        value: value.to_owned(),
+    })
+}
+
+fn parse_row_version(
+    entity: &'static str,
+    id: Uuid,
+    value: i64,
+) -> Result<CoverRowVersion, CoverError> {
+    u64::try_from(value)
+        .ok()
+        .and_then(CoverRowVersion::new)
+        .ok_or(CoverError::InvalidPersistedValue {
+            entity,
+            id,
+            field: "row_version",
+            value: value.to_string(),
+        })
+}
+
+fn digest_from_bytes(asset_id: Uuid, bytes: Vec<u8>) -> Result<Digest, CoverError> {
+    bytes
+        .try_into()
+        .map(Digest::new)
+        .map_err(|bytes: Vec<u8>| CoverError::InvalidPersistedValue {
+            entity: "cover asset",
+            id: asset_id,
+            field: "content_sha256",
+            value: format!("{} bytes", bytes.len()),
+        })
+}
+
+fn positive_i32(id: Uuid, field: &'static str, value: i32) -> Result<NonZeroU32, CoverError> {
+    u32::try_from(value)
+        .ok()
+        .and_then(NonZeroU32::new)
+        .ok_or(CoverError::InvalidPersistedValue {
+            entity: "cover asset",
+            id,
+            field,
+            value: value.to_string(),
+        })
+}
+
+fn positive_i64(id: Uuid, field: &'static str, value: i64) -> Result<u64, CoverError> {
+    u64::try_from(value)
+        .ok()
+        .filter(|value| *value > 0)
+        .ok_or(CoverError::InvalidPersistedValue {
+            entity: "cover asset",
+            id,
+            field,
+            value: value.to_string(),
+        })
+}
+
+fn store_disc_number(value: u16, id: Uuid) -> Result<i16, CoverError> {
+    i16::try_from(value).map_err(|_| CoverError::NumericOutOfRange {
+        entity: "cover scope",
+        id,
+        field: "disc_number",
+    })
+}
+
+fn load_disc_number(id: Uuid, value: i16) -> Result<u16, CoverError> {
+    u16::try_from(value).map_err(|_| CoverError::InvalidPersistedValue {
+        entity: "cover scope",
+        id,
+        field: "disc_number",
+        value: value.to_string(),
+    })
+}
+
+fn missing_reference(entity: &'static str, id: Uuid, reference: &'static str) -> CoverError {
+    CoverError::Database(DbErr::Custom(format!(
+        "{entity} {id} references a missing {reference}"
+    )))
+}
+
+#[cfg(feature = "postgres")]
+type StoredTimestamp = chrono::NaiveDateTime;
+#[cfg(feature = "sqlite")]
+type StoredTimestamp = DateTimeUtc;
+
+#[cfg(feature = "postgres")]
+fn store_timestamp(value: DateTimeUtc) -> StoredTimestamp {
+    value.naive_utc()
+}
+
+#[cfg(feature = "sqlite")]
+fn store_timestamp(value: DateTimeUtc) -> StoredTimestamp {
+    value
+}
diff --git a/annim/src/cover_worker.rs b/annim/src/cover_worker.rs
new file mode 100644
index 00000000..59e821ea
--- /dev/null
+++ b/annim/src/cover_worker.rs
@@ -0,0 +1,760 @@
+//! Background orchestration for verified cover downloads.
+//!
+//! [`CoverService`] owns durable queue state while [`anni_cover_worker`]
+//! owns all network and filesystem access.  This module is the deliberately
+//! small seam between them: it claims one lease, fetches one image, then
+//! records exactly one terminal action for that lease.
+
+use std::{
+    future::Future,
+    num::{NonZeroU32, NonZeroU64},
+    pin::Pin,
+    time::Duration,
+};
+
+use anni_cover_worker::{
+    AssetStore, CoverDownloader, CoverWorkerError as DownloadError, VerifiedCoverDownload,
+};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+use thiserror::Error;
+
+use crate::cover::{
+    CoverError, CoverFetchFailure, CoverFetchLease, CoverRowVersion, CoverService,
+    VerifiedCoverAsset,
+};
+
+pub type CoverFetchFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<VerifiedCoverAsset, CoverFetchProblem>> + Send + 'a>>;
+type QueueFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, CoverError>> + Send + 'a>>;
+
+/// A replaceable acquisition boundary.
+///
+/// Production uses [`SafeCoverFetcher`]. Tests can supply an in-memory
+/// implementation without opening sockets or writing files.
+pub trait CoverFetcher: Send + Sync {
+    fn fetch<'a>(&'a self, request_url: &'a str) -> CoverFetchFuture<'a>;
+}
+
+/// Production fetcher backed by the SSRF-resistant downloader and a trusted
+/// content-addressed asset store.
+#[derive(Debug, Clone)]
+pub struct SafeCoverFetcher {
+    downloader: CoverDownloader,
+    asset_store: AssetStore,
+}
+
+impl SafeCoverFetcher {
+    pub const fn new(downloader: CoverDownloader, asset_store: AssetStore) -> Self {
+        Self {
+            downloader,
+            asset_store,
+        }
+    }
+}
+
+impl CoverFetcher for SafeCoverFetcher {
+    fn fetch<'a>(&'a self, request_url: &'a str) -> CoverFetchFuture<'a> {
+        Box::pin(async move {
+            let download = self
+                .downloader
+                .download(request_url, &self.asset_store)
+                .await
+                .map_err(CoverFetchProblem::from)?;
+            verified_download_to_asset(download)
+        })
+    }
+}
+
+/// Whether a failure can reasonably change when attempted again.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CoverFailureDisposition {
+    Permanent,
+    Retryable,
+}
+
+/// A bounded, persistence-safe description of a fetch failure.
+///
+/// It intentionally contains neither a URL nor an arbitrary error message.
+/// The downloader error is reduced to a stable code before it crosses into
+/// queue persistence or worker diagnostics.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub struct CoverFetchProblem {
+    code: &'static str,
+    disposition: CoverFailureDisposition,
+    http_status: Option<u16>,
+}
+
+impl CoverFetchProblem {
+    pub const fn code(self) -> &'static str {
+        self.code
+    }
+
+    pub const fn disposition(self) -> CoverFailureDisposition {
+        self.disposition
+    }
+
+    pub const fn http_status(self) -> Option<u16> {
+        self.http_status
+    }
+
+    const fn permanent(code: &'static str, http_status: Option<u16>) -> Self {
+        Self {
+            code,
+            disposition: CoverFailureDisposition::Permanent,
+            http_status,
+        }
+    }
+
+    const fn retryable(code: &'static str, http_status: Option<u16>) -> Self {
+        Self {
+            code,
+            disposition: CoverFailureDisposition::Retryable,
+            http_status,
+        }
+    }
+
+    const fn is_retryable(self) -> bool {
+        matches!(self.disposition, CoverFailureDisposition::Retryable)
+    }
+
+    fn persisted(self) -> CoverFetchFailure {
+        CoverFetchFailure {
+            code: self.code.to_owned(),
+            message: None,
+            http_status: self.http_status,
+        }
+    }
+}
+
+impl std::fmt::Debug for CoverFetchProblem {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("CoverFetchProblem")
+            .field("code", &self.code)
+            .field("disposition", &self.disposition)
+            .field("http_status", &self.http_status)
+            .finish()
+    }
+}
+
+impl From<DownloadError> for CoverFetchProblem {
+    fn from(error: DownloadError) -> Self {
+        match error {
+            DownloadError::InvalidUrl(_)
+            | DownloadError::HttpsRequired
+            | DownloadError::MissingHost
+            | DownloadError::EmbeddedCredentials => Self::permanent("invalid_url", None),
+            DownloadError::ForbiddenAddress { .. } => Self::permanent("forbidden_address", None),
+            DownloadError::Resolve { .. } | DownloadError::NoAddresses { .. } => {
+                Self::retryable("dns_failure", None)
+            }
+            DownloadError::Client(_) => Self::retryable("http_client_failure", None),
+            DownloadError::Request { .. } => Self::retryable("request_failure", None),
+            DownloadError::HttpStatus { status, .. } => {
+                if is_retryable_http_status(status) {
+                    Self::retryable("http_status", Some(status))
+                } else {
+                    Self::permanent("http_status", Some(status))
+                }
+            }
+            DownloadError::RedirectWithoutLocation
+            | DownloadError::InvalidRedirectLocation
+            | DownloadError::TooManyRedirects => Self::permanent("invalid_redirect", None),
+            DownloadError::BodyTooLarge { .. } | DownloadError::ImageTooLarge => {
+                Self::permanent("image_too_large", None)
+            }
+            DownloadError::EmptyBody => Self::retryable("empty_body", None),
+            DownloadError::UnsupportedImageFormat => Self::permanent("unsupported_image", None),
+            DownloadError::Image(_) => Self::permanent("invalid_image", None),
+            DownloadError::InvalidStorageKey(_) => Self::permanent("invalid_storage_key", None),
+            // Retrying either condition would repeatedly touch an integrity
+            // boundary with the same immutable bytes/path. An operator must
+            // inspect and explicitly requeue the candidate after remediation.
+            DownloadError::DigestCollision { .. } => Self::permanent("digest_collision", None),
+            DownloadError::AssetPathEscapesRoot { .. } => {
+                Self::permanent("asset_path_rejected", None)
+            }
+            DownloadError::AssetRootNotDirectory { .. } => {
+                Self::permanent("invalid_asset_root", None)
+            }
+            DownloadError::VerifierPanicked => Self::retryable("verifier_failure", None),
+            DownloadError::Io(_) => Self::retryable("io_failure", None),
+        }
+    }
+}
+
+fn is_retryable_http_status(status: u16) -> bool {
+    matches!(status, 408 | 425 | 429) || (500..=599).contains(&status)
+}
+
+fn verified_download_to_asset(
+    download: VerifiedCoverDownload,
+) -> Result<VerifiedCoverAsset, CoverFetchProblem> {
+    let width = NonZeroU32::new(download.width())
+        .ok_or_else(|| CoverFetchProblem::permanent("invalid_image", None))?;
+    let height = NonZeroU32::new(download.height())
+        .ok_or_else(|| CoverFetchProblem::permanent("invalid_image", None))?;
+    NonZeroU64::new(download.byte_length())
+        .ok_or_else(|| CoverFetchProblem::permanent("empty_body", None))?;
+
+    Ok(VerifiedCoverAsset {
+        content_sha256: download.digest(),
+        media_type: download.media_type(),
+        width,
+        height,
+        byte_length: download.byte_length(),
+        effective_url: Some(download.effective_url().to_owned()),
+    })
+}
+
+/// Worker timing and retry limits.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct CoverWorkerPolicy {
+    pub lease_for: Duration,
+    pub base_retry_delay: Duration,
+    pub max_retry_delay: Duration,
+    pub max_attempts: NonZeroU32,
+}
+
+impl CoverWorkerPolicy {
+    fn validate(self) -> Result<Self, CoverWorkerRunError> {
+        if self.lease_for.is_zero() {
+            return Err(CoverWorkerRunError::InvalidPolicy {
+                field: "lease_for",
+                message: "duration must be positive",
+            });
+        }
+        if self.base_retry_delay.is_zero() {
+            return Err(CoverWorkerRunError::InvalidPolicy {
+                field: "base_retry_delay",
+                message: "duration must be positive",
+            });
+        }
+        if self.max_retry_delay < self.base_retry_delay {
+            return Err(CoverWorkerRunError::InvalidPolicy {
+                field: "max_retry_delay",
+                message: "duration must not be shorter than base_retry_delay",
+            });
+        }
+        chrono::Duration::from_std(self.max_retry_delay).map_err(|_| {
+            CoverWorkerRunError::InvalidPolicy {
+                field: "max_retry_delay",
+                message: "duration cannot be represented as a timestamp delta",
+            }
+        })?;
+        Ok(self)
+    }
+
+    fn retry_delay(self, attempt_count: u32) -> Duration {
+        let exponent = attempt_count.saturating_sub(1).min(31);
+        let multiplier = 1_u32.checked_shl(exponent).unwrap_or(u32::MAX);
+        self.base_retry_delay
+            .saturating_mul(multiplier)
+            .min(self.max_retry_delay)
+    }
+}
+
+impl Default for CoverWorkerPolicy {
+    fn default() -> Self {
+        Self {
+            // One download can follow several separately timed redirects, so
+            // the lease is intentionally longer than a single HTTP timeout.
+            lease_for: Duration::from_secs(10 * 60),
+            base_retry_delay: Duration::from_secs(30),
+            max_retry_delay: Duration::from_secs(6 * 60 * 60),
+            max_attempts: NonZeroU32::new(5).expect("five is non-zero"),
+        }
+    }
+}
+
+/// Why a failed candidate was moved to the rejected state.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CoverRejectionReason {
+    PermanentFailure,
+    AttemptsExhausted,
+}
+
+/// Result of processing at most one queue item.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CoverWorkerOutcome {
+    Idle,
+    Verified {
+        candidate_id: Uuid,
+        attempt_count: u32,
+    },
+    RetryScheduled {
+        candidate_id: Uuid,
+        attempt_count: u32,
+        not_before: DateTime<Utc>,
+        problem: CoverFetchProblem,
+    },
+    Rejected {
+        candidate_id: Uuid,
+        attempt_count: u32,
+        reason: CoverRejectionReason,
+        problem: CoverFetchProblem,
+    },
+}
+
+#[derive(Debug, Error)]
+pub enum CoverWorkerRunError {
+    #[error("invalid cover worker policy {field}: {message}")]
+    InvalidPolicy {
+        field: &'static str,
+        message: &'static str,
+    },
+    #[error("cover queue operation failed")]
+    Queue(#[from] CoverError),
+    #[error("cover retry deadline exceeds the supported timestamp range")]
+    RetryDeadlineOverflow,
+}
+
+/// Processes queued cover candidates one at a time.
+pub struct CoverWorker<F> {
+    core: CoverWorkerCore<CoverService, F>,
+}
+
+impl<F> CoverWorker<F>
+where
+    F: CoverFetcher,
+{
+    pub fn new(
+        covers: CoverService,
+        fetcher: F,
+        policy: CoverWorkerPolicy,
+    ) -> Result<Self, CoverWorkerRunError> {
+        Ok(Self {
+            core: CoverWorkerCore::new(covers, fetcher, policy.validate()?),
+        })
+    }
+
+    /// Claims and processes no more than one candidate.
+    pub async fn run_once(&self) -> Result<CoverWorkerOutcome, CoverWorkerRunError> {
+        self.core.run_once_at(Utc::now()).await
+    }
+}
+
+trait CoverQueue: Send + Sync {
+    fn claim_next<'a>(&'a self, lease_for: Duration) -> QueueFuture<'a, Option<CoverFetchLease>>;
+
+    fn complete_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        verified: VerifiedCoverAsset,
+    ) -> QueueFuture<'a, ()>;
+
+    fn retry_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+        not_before: DateTime<Utc>,
+    ) -> QueueFuture<'a, ()>;
+
+    fn reject_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+    ) -> QueueFuture<'a, ()>;
+}
+
+impl CoverQueue for CoverService {
+    fn claim_next<'a>(&'a self, lease_for: Duration) -> QueueFuture<'a, Option<CoverFetchLease>> {
+        Box::pin(async move { CoverService::claim_next(self, lease_for).await })
+    }
+
+    fn complete_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        verified: VerifiedCoverAsset,
+    ) -> QueueFuture<'a, ()> {
+        Box::pin(async move {
+            CoverService::complete_fetch(self, candidate_id, expected, lease_token, verified)
+                .await
+                .map(|_| ())
+        })
+    }
+
+    fn retry_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+        not_before: DateTime<Utc>,
+    ) -> QueueFuture<'a, ()> {
+        Box::pin(async move {
+            CoverService::retry_fetch(
+                self,
+                candidate_id,
+                expected,
+                lease_token,
+                failure,
+                not_before,
+            )
+            .await
+            .map(|_| ())
+        })
+    }
+
+    fn reject_fetch<'a>(
+        &'a self,
+        candidate_id: Uuid,
+        expected: CoverRowVersion,
+        lease_token: Uuid,
+        failure: CoverFetchFailure,
+    ) -> QueueFuture<'a, ()> {
+        Box::pin(async move {
+            CoverService::reject_fetch(self, candidate_id, expected, lease_token, failure)
+                .await
+                .map(|_| ())
+        })
+    }
+}
+
+struct CoverWorkerCore<Q, F> {
+    covers: Q,
+    fetcher: F,
+    policy: CoverWorkerPolicy,
+}
+
+impl<Q, F> CoverWorkerCore<Q, F>
+where
+    Q: CoverQueue,
+    F: CoverFetcher,
+{
+    const fn new(covers: Q, fetcher: F, policy: CoverWorkerPolicy) -> Self {
+        Self {
+            covers,
+            fetcher,
+            policy,
+        }
+    }
+
+    async fn run_once_at(
+        &self,
+        now: DateTime<Utc>,
+    ) -> Result<CoverWorkerOutcome, CoverWorkerRunError> {
+        let Some(lease) = self.covers.claim_next(self.policy.lease_for).await? else {
+            return Ok(CoverWorkerOutcome::Idle);
+        };
+
+        match self.fetcher.fetch(&lease.request_url).await {
+            Ok(verified) => {
+                self.covers
+                    .complete_fetch(
+                        lease.candidate_id,
+                        lease.row_version,
+                        lease.lease_token,
+                        verified,
+                    )
+                    .await?;
+                Ok(CoverWorkerOutcome::Verified {
+                    candidate_id: lease.candidate_id,
+                    attempt_count: lease.attempt_count,
+                })
+            }
+            Err(problem)
+                if problem.is_retryable()
+                    && lease.attempt_count < self.policy.max_attempts.get() =>
+            {
+                let retry_delta =
+                    chrono::Duration::from_std(self.policy.retry_delay(lease.attempt_count))
+                        .map_err(|_| CoverWorkerRunError::RetryDeadlineOverflow)?;
+                let not_before = now
+                    .checked_add_signed(retry_delta)
+                    .ok_or(CoverWorkerRunError::RetryDeadlineOverflow)?;
+                self.covers
+                    .retry_fetch(
+                        lease.candidate_id,
+                        lease.row_version,
+                        lease.lease_token,
+                        problem.persisted(),
+                        not_before,
+                    )
+                    .await?;
+                Ok(CoverWorkerOutcome::RetryScheduled {
+                    candidate_id: lease.candidate_id,
+                    attempt_count: lease.attempt_count,
+                    not_before,
+                    problem,
+                })
+            }
+            Err(problem) => {
+                let reason = if problem.is_retryable() {
+                    CoverRejectionReason::AttemptsExhausted
+                } else {
+                    CoverRejectionReason::PermanentFailure
+                };
+                self.covers
+                    .reject_fetch(
+                        lease.candidate_id,
+                        lease.row_version,
+                        lease.lease_token,
+                        problem.persisted(),
+                    )
+                    .await?;
+                Ok(CoverWorkerOutcome::Rejected {
+                    candidate_id: lease.candidate_id,
+                    attempt_count: lease.attempt_count,
+                    reason,
+                    problem,
+                })
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+
+    use anni_catalog::{CoverMediaType, CoverSourceKind};
+    use anni_ingest::Digest;
+
+    use super::*;
+
+    #[derive(Debug, Clone)]
+    struct FakeFetcher {
+        result: Result<VerifiedCoverAsset, CoverFetchProblem>,
+    }
+
+    impl CoverFetcher for FakeFetcher {
+        fn fetch<'a>(&'a self, _request_url: &'a str) -> CoverFetchFuture<'a> {
+            let result = self.result.clone();
+            Box::pin(async move { result })
+        }
+    }
+
+    #[derive(Debug, Clone, PartialEq, Eq)]
+    enum QueueAction {
+        Completed(VerifiedCoverAsset),
+        Retried(CoverFetchFailure, DateTime<Utc>),
+        Rejected(CoverFetchFailure),
+    }
+
+    #[derive(Debug)]
+    struct FakeQueue {
+        lease: Mutex<Option<CoverFetchLease>>,
+        actions: Mutex<Vec<QueueAction>>,
+    }
+
+    impl FakeQueue {
+        fn new(lease: CoverFetchLease) -> Self {
+            Self {
+                lease: Mutex::new(Some(lease)),
+                actions: Mutex::new(Vec::new()),
+            }
+        }
+
+        fn actions(&self) -> Vec<QueueAction> {
+            self.actions.lock().unwrap().clone()
+        }
+    }
+
+    impl CoverQueue for FakeQueue {
+        fn claim_next<'a>(
+            &'a self,
+            _lease_for: Duration,
+        ) -> QueueFuture<'a, Option<CoverFetchLease>> {
+            let lease = self.lease.lock().unwrap().take();
+            Box::pin(async move { Ok(lease) })
+        }
+
+        fn complete_fetch<'a>(
+            &'a self,
+            _candidate_id: Uuid,
+            _expected: CoverRowVersion,
+            _lease_token: Uuid,
+            verified: VerifiedCoverAsset,
+        ) -> QueueFuture<'a, ()> {
+            self.actions
+                .lock()
+                .unwrap()
+                .push(QueueAction::Completed(verified));
+            Box::pin(async { Ok(()) })
+        }
+
+        fn retry_fetch<'a>(
+            &'a self,
+            _candidate_id: Uuid,
+            _expected: CoverRowVersion,
+            _lease_token: Uuid,
+            failure: CoverFetchFailure,
+            not_before: DateTime<Utc>,
+        ) -> QueueFuture<'a, ()> {
+            self.actions
+                .lock()
+                .unwrap()
+                .push(QueueAction::Retried(failure, not_before));
+            Box::pin(async { Ok(()) })
+        }
+
+        fn reject_fetch<'a>(
+            &'a self,
+            _candidate_id: Uuid,
+            _expected: CoverRowVersion,
+            _lease_token: Uuid,
+            failure: CoverFetchFailure,
+        ) -> QueueFuture<'a, ()> {
+            self.actions
+                .lock()
+                .unwrap()
+                .push(QueueAction::Rejected(failure));
+            Box::pin(async { Ok(()) })
+        }
+    }
+
+    fn lease(attempt_count: u32) -> CoverFetchLease {
+        CoverFetchLease {
+            candidate_id: Uuid::new_v4(),
+            release_id: Uuid::new_v4(),
+            disc_number: 0,
+            source_kind: CoverSourceKind::ArtistWebsite,
+            request_url: "https://artist.example/cover.jpg?token=must-not-leak".to_owned(),
+            lease_token: Uuid::new_v4(),
+            lease_expires_at: Utc::now() + chrono::Duration::minutes(10),
+            attempt_count,
+            row_version: CoverRowVersion::INITIAL,
+        }
+    }
+
+    fn asset() -> VerifiedCoverAsset {
+        VerifiedCoverAsset {
+            content_sha256: Digest::new([0x42; Digest::LENGTH]),
+            media_type: CoverMediaType::Png,
+            width: NonZeroU32::new(3_000).unwrap(),
+            height: NonZeroU32::new(3_000).unwrap(),
+            byte_length: 9_000_000,
+            effective_url: Some("https://cdn.example/final.png?signature=must-not-leak".to_owned()),
+        }
+    }
+
+    fn test_policy() -> CoverWorkerPolicy {
+        CoverWorkerPolicy {
+            lease_for: Duration::from_secs(60),
+            base_retry_delay: Duration::from_secs(10),
+            max_retry_delay: Duration::from_secs(40),
+            max_attempts: NonZeroU32::new(3).unwrap(),
+        }
+    }
+
+    #[tokio::test]
+    async fn successful_fetch_completes_the_claimed_lease() {
+        let lease = lease(1);
+        let candidate_id = lease.candidate_id;
+        let queue = FakeQueue::new(lease);
+        let expected_asset = asset();
+        let worker = CoverWorkerCore::new(
+            queue,
+            FakeFetcher {
+                result: Ok(expected_asset.clone()),
+            },
+            test_policy(),
+        );
+
+        let outcome = worker.run_once_at(Utc::now()).await.unwrap();
+
+        assert_eq!(
+            outcome,
+            CoverWorkerOutcome::Verified {
+                candidate_id,
+                attempt_count: 1
+            }
+        );
+        assert_eq!(
+            worker.covers.actions(),
+            vec![QueueAction::Completed(expected_asset)]
+        );
+        assert!(!format!("{outcome:?}").contains("must-not-leak"));
+    }
+
+    #[tokio::test]
+    async fn retryable_failure_uses_bounded_backoff_without_persisting_a_message() {
+        let lease = lease(3);
+        let candidate_id = lease.candidate_id;
+        let queue = FakeQueue::new(lease);
+        let worker = CoverWorkerCore::new(
+            queue,
+            FakeFetcher {
+                result: Err(CoverFetchProblem::retryable("request_failure", None)),
+            },
+            CoverWorkerPolicy {
+                max_attempts: NonZeroU32::new(4).unwrap(),
+                ..test_policy()
+            },
+        );
+        let now = DateTime::parse_from_rfc3339("2026-07-12T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc);
+
+        let outcome = worker.run_once_at(now).await.unwrap();
+
+        let expected_at = now + chrono::Duration::seconds(40);
+        assert_eq!(
+            outcome,
+            CoverWorkerOutcome::RetryScheduled {
+                candidate_id,
+                attempt_count: 3,
+                not_before: expected_at,
+                problem: CoverFetchProblem::retryable("request_failure", None),
+            }
+        );
+        assert_eq!(
+            worker.covers.actions(),
+            vec![QueueAction::Retried(
+                CoverFetchFailure {
+                    code: "request_failure".to_owned(),
+                    message: None,
+                    http_status: None,
+                },
+                expected_at,
+            )]
+        );
+    }
+
+    #[tokio::test]
+    async fn permanent_failure_rejects_immediately_with_only_a_safe_code() {
+        let lease = lease(1);
+        let candidate_id = lease.candidate_id;
+        let queue = FakeQueue::new(lease);
+        let problem = CoverFetchProblem::from(DownloadError::DigestCollision {
+            storage_key: "sha256/42/42/collision.png".to_owned(),
+        });
+        let worker = CoverWorkerCore::new(
+            queue,
+            FakeFetcher {
+                result: Err(problem),
+            },
+            test_policy(),
+        );
+
+        let outcome = worker.run_once_at(Utc::now()).await.unwrap();
+
+        assert_eq!(
+            outcome,
+            CoverWorkerOutcome::Rejected {
+                candidate_id,
+                attempt_count: 1,
+                reason: CoverRejectionReason::PermanentFailure,
+                problem,
+            }
+        );
+        assert_eq!(
+            worker.covers.actions(),
+            vec![QueueAction::Rejected(CoverFetchFailure {
+                code: "digest_collision".to_owned(),
+                message: None,
+                http_status: None,
+            })]
+        );
+    }
+}
diff --git a/annim/src/entities/postgres/catalog_artist.rs b/annim/src/entities/postgres/catalog_artist.rs
new file mode 100644
index 00000000..5c10d42a
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_artist.rs
@@ -0,0 +1,21 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_artist")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub artist_id: Uuid,
+    pub display_name: String,
+    pub sort_name: Option<String>,
+    pub notes: Option<String>,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/catalog_release.rs b/annim/src/entities/postgres/catalog_release.rs
new file mode 100644
index 00000000..24fa6b57
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_release.rs
@@ -0,0 +1,29 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_release")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub release_id: Uuid,
+    pub artist_db_id: i32,
+    pub title: String,
+    pub edition: Option<String>,
+    pub catalog: Option<String>,
+    pub release_date: Option<String>,
+    pub kind: String,
+    pub wanted: bool,
+    pub unavailable: bool,
+    pub matched_album_id: Option<Uuid>,
+    pub active_ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/catalog_source.rs b/annim/src/entities/postgres/catalog_source.rs
new file mode 100644
index 00000000..a3fd841e
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_source.rs
@@ -0,0 +1,26 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub source_id: Uuid,
+    pub artist_db_id: i32,
+    pub kind: String,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+    pub configuration_document: Option<String>,
+    pub secret_ref: Option<String>,
+    pub enabled: bool,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/catalog_source_release.rs b/annim/src/entities/postgres/catalog_source_release.rs
new file mode 100644
index 00000000..67ede300
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_source_release.rs
@@ -0,0 +1,23 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source_release")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub source_release_id: Uuid,
+    pub source_db_id: i32,
+    pub external_release_id: String,
+    pub source_url: String,
+    pub linked_release_db_id: Option<i32>,
+    pub first_seen_at: DateTime,
+    pub last_seen_at: DateTime,
+    pub not_seen_since: Option<DateTime>,
+    pub row_version: i64,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/catalog_source_release_revision.rs b/annim/src/entities/postgres/catalog_source_release_revision.rs
new file mode 100644
index 00000000..39bf1fa9
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_source_release_revision.rs
@@ -0,0 +1,20 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source_release_revision")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub source_release_db_id: i32,
+    pub revision: i64,
+    pub sync_run_id: Uuid,
+    pub raw_document: String,
+    pub parsed_document: String,
+    pub raw_sha256: Vec<u8>,
+    pub observed_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/catalog_sync_run.rs b/annim/src/entities/postgres/catalog_sync_run.rs
new file mode 100644
index 00000000..6af30013
--- /dev/null
+++ b/annim/src/entities/postgres/catalog_sync_run.rs
@@ -0,0 +1,32 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_sync_run")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub run_id: Uuid,
+    pub source_db_id: i32,
+    pub status: String,
+    pub requested_cursor: Option<String>,
+    pub result_cursor: Option<String>,
+    pub observed_count: i32,
+    pub error_message: Option<String>,
+    pub coverage: String,
+    pub started_from_root: bool,
+    pub snapshot_complete: bool,
+    pub lease_token: Option<Uuid>,
+    pub lease_expires_at: Option<DateTime>,
+    pub next_attempt_at: Option<DateTime>,
+    pub attempt_count: i32,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub started_at: Option<DateTime>,
+    pub finished_at: Option<DateTime>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/collection_copy.rs b/annim/src/entities/postgres/collection_copy.rs
new file mode 100644
index 00000000..5765307e
--- /dev/null
+++ b/annim/src/entities/postgres/collection_copy.rs
@@ -0,0 +1,32 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "collection_copy")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub copy_id: Uuid,
+    pub release_db_id: i32,
+    pub source_kind: String,
+    pub source_label: String,
+    pub private_locator: Option<String>,
+    pub codec: String,
+    pub sample_rate_hz: Option<i32>,
+    pub bit_depth: Option<i16>,
+    pub channels: Option<i16>,
+    pub track_count: Option<i32>,
+    pub byte_length: Option<i64>,
+    pub manifest_digest: Option<Vec<u8>>,
+    pub quality_verified: bool,
+    pub ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub acquired_at: DateTime,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/cover_asset.rs b/annim/src/entities/postgres/cover_asset.rs
new file mode 100644
index 00000000..1c13004a
--- /dev/null
+++ b/annim/src/entities/postgres/cover_asset.rs
@@ -0,0 +1,26 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_asset")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub asset_id: Uuid,
+    #[sea_orm(unique)]
+    pub content_sha256: Vec<u8>,
+    #[sea_orm(unique)]
+    pub storage_key: String,
+    pub media_type: String,
+    pub width: i32,
+    pub height: i32,
+    pub byte_length: i64,
+    pub fetched_at: DateTime,
+    pub verified_at: DateTime,
+    pub created_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/cover_candidate.rs b/annim/src/entities/postgres/cover_candidate.rs
new file mode 100644
index 00000000..47bc896d
--- /dev/null
+++ b/annim/src/entities/postgres/cover_candidate.rs
@@ -0,0 +1,35 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_candidate")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub candidate_id: Uuid,
+    pub release_db_id: i32,
+    pub disc_number: i16,
+    pub source_kind: String,
+    pub source_release_revision_db_id: Option<i32>,
+    pub submitted_url: Option<String>,
+    pub canonical_url: Option<String>,
+    pub effective_url: Option<String>,
+    pub state: String,
+    pub asset_db_id: Option<i32>,
+    pub attempt_count: i32,
+    pub lease_token: Option<Uuid>,
+    pub lease_expires_at: Option<DateTime>,
+    pub next_attempt_at: Option<DateTime>,
+    pub last_http_status: Option<i32>,
+    pub last_error_code: Option<String>,
+    pub last_error_message: Option<String>,
+    pub fetched_at: Option<DateTime>,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/cover_selection.rs b/annim/src/entities/postgres/cover_selection.rs
new file mode 100644
index 00000000..67cbff8d
--- /dev/null
+++ b/annim/src/entities/postgres/cover_selection.rs
@@ -0,0 +1,22 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_selection")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub selection_id: Uuid,
+    pub release_db_id: i32,
+    pub disc_number: i16,
+    pub candidate_db_id: i32,
+    pub asset_db_id: i32,
+    pub row_version: i64,
+    pub selected_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/ingest_job.rs b/annim/src/entities/postgres/ingest_job.rs
new file mode 100644
index 00000000..994ddc21
--- /dev/null
+++ b/annim/src/entities/postgres/ingest_job.rs
@@ -0,0 +1,26 @@
+//! SeaORM mapping for persisted audio-ingestion workflow state.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "ingest_job")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub job_id: Uuid,
+    pub state: String,
+    pub metadata_revision: i64,
+    pub approved_revision: Option<i64>,
+    pub manifest_digest: Option<Vec<u8>>,
+    pub plan_digest: Option<Vec<u8>>,
+    pub verification_digest: Option<Vec<u8>>,
+    pub row_version: i64,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/ingest_metadata_revision.rs b/annim/src/entities/postgres/ingest_metadata_revision.rs
new file mode 100644
index 00000000..3b52ba25
--- /dev/null
+++ b/annim/src/entities/postgres/ingest_metadata_revision.rs
@@ -0,0 +1,21 @@
+//! SeaORM mapping for versioned ingest metadata documents.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "ingest_metadata_revision")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub job_id: Uuid,
+    pub revision: i64,
+    pub document: String,
+    pub document_sha256: Vec<u8>,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/postgres/mod.rs b/annim/src/entities/postgres/mod.rs
index ce545dc9..adc2ac33 100644
--- a/annim/src/entities/postgres/mod.rs
+++ b/annim/src/entities/postgres/mod.rs
@@ -4,7 +4,19 @@ pub mod prelude;
 
 pub mod album;
 pub mod album_tag_relation;
+pub mod catalog_artist;
+pub mod catalog_release;
+pub mod catalog_source;
+pub mod catalog_source_release;
+pub mod catalog_source_release_revision;
+pub mod catalog_sync_run;
+pub mod collection_copy;
+pub mod cover_asset;
+pub mod cover_candidate;
+pub mod cover_selection;
 pub mod disc;
+pub mod ingest_job;
+pub mod ingest_metadata_revision;
 pub mod sea_orm_active_enums;
 pub mod tag_info;
 pub mod tag_relation;
diff --git a/annim/src/entities/postgres/prelude.rs b/annim/src/entities/postgres/prelude.rs
index aa6370e6..aa7b1a96 100644
--- a/annim/src/entities/postgres/prelude.rs
+++ b/annim/src/entities/postgres/prelude.rs
@@ -2,7 +2,19 @@
 
 pub use super::album::Entity as Album;
 pub use super::album_tag_relation::Entity as AlbumTagRelation;
+pub use super::catalog_artist::Entity as CatalogArtist;
+pub use super::catalog_release::Entity as CatalogRelease;
+pub use super::catalog_source::Entity as CatalogSource;
+pub use super::catalog_source_release::Entity as CatalogSourceRelease;
+pub use super::catalog_source_release_revision::Entity as CatalogSourceReleaseRevision;
+pub use super::catalog_sync_run::Entity as CatalogSyncRun;
+pub use super::collection_copy::Entity as CollectionCopy;
+pub use super::cover_asset::Entity as CoverAsset;
+pub use super::cover_candidate::Entity as CoverCandidate;
+pub use super::cover_selection::Entity as CoverSelection;
 pub use super::disc::Entity as Disc;
+pub use super::ingest_job::Entity as IngestJob;
+pub use super::ingest_metadata_revision::Entity as IngestMetadataRevision;
 pub use super::tag_info::Entity as TagInfo;
 pub use super::tag_relation::Entity as TagRelation;
 pub use super::track::Entity as Track;
diff --git a/annim/src/entities/sqlite/catalog_artist.rs b/annim/src/entities/sqlite/catalog_artist.rs
new file mode 100644
index 00000000..5071e533
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_artist.rs
@@ -0,0 +1,21 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_artist")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub artist_id: Uuid,
+    pub display_name: String,
+    pub sort_name: Option<String>,
+    pub notes: Option<String>,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/catalog_release.rs b/annim/src/entities/sqlite/catalog_release.rs
new file mode 100644
index 00000000..acff4f67
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_release.rs
@@ -0,0 +1,29 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_release")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub release_id: Uuid,
+    pub artist_db_id: i32,
+    pub title: String,
+    pub edition: Option<String>,
+    pub catalog: Option<String>,
+    pub release_date: Option<String>,
+    pub kind: String,
+    pub wanted: bool,
+    pub unavailable: bool,
+    pub matched_album_id: Option<Uuid>,
+    pub active_ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/catalog_source.rs b/annim/src/entities/sqlite/catalog_source.rs
new file mode 100644
index 00000000..b0e02f8d
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_source.rs
@@ -0,0 +1,26 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub source_id: Uuid,
+    pub artist_db_id: i32,
+    pub kind: String,
+    pub locator: String,
+    pub storefront: Option<String>,
+    pub locale: Option<String>,
+    pub configuration_document: Option<String>,
+    pub secret_ref: Option<String>,
+    pub enabled: bool,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/catalog_source_release.rs b/annim/src/entities/sqlite/catalog_source_release.rs
new file mode 100644
index 00000000..2b2575f7
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_source_release.rs
@@ -0,0 +1,23 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source_release")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub source_release_id: Uuid,
+    pub source_db_id: i32,
+    pub external_release_id: String,
+    pub source_url: String,
+    pub linked_release_db_id: Option<i32>,
+    pub first_seen_at: DateTimeUtc,
+    pub last_seen_at: DateTimeUtc,
+    pub not_seen_since: Option<DateTimeUtc>,
+    pub row_version: i64,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/catalog_source_release_revision.rs b/annim/src/entities/sqlite/catalog_source_release_revision.rs
new file mode 100644
index 00000000..6a169c60
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_source_release_revision.rs
@@ -0,0 +1,20 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_source_release_revision")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub source_release_db_id: i32,
+    pub revision: i64,
+    pub sync_run_id: Uuid,
+    pub raw_document: String,
+    pub parsed_document: String,
+    pub raw_sha256: Vec<u8>,
+    pub observed_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/catalog_sync_run.rs b/annim/src/entities/sqlite/catalog_sync_run.rs
new file mode 100644
index 00000000..75be7078
--- /dev/null
+++ b/annim/src/entities/sqlite/catalog_sync_run.rs
@@ -0,0 +1,32 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "catalog_sync_run")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub run_id: Uuid,
+    pub source_db_id: i32,
+    pub status: String,
+    pub requested_cursor: Option<String>,
+    pub result_cursor: Option<String>,
+    pub observed_count: i32,
+    pub error_message: Option<String>,
+    pub coverage: String,
+    pub started_from_root: bool,
+    pub snapshot_complete: bool,
+    pub lease_token: Option<Uuid>,
+    pub lease_expires_at: Option<DateTimeUtc>,
+    pub next_attempt_at: Option<DateTimeUtc>,
+    pub attempt_count: i32,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub started_at: Option<DateTimeUtc>,
+    pub finished_at: Option<DateTimeUtc>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/collection_copy.rs b/annim/src/entities/sqlite/collection_copy.rs
new file mode 100644
index 00000000..3620c04e
--- /dev/null
+++ b/annim/src/entities/sqlite/collection_copy.rs
@@ -0,0 +1,32 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "collection_copy")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub copy_id: Uuid,
+    pub release_db_id: i32,
+    pub source_kind: String,
+    pub source_label: String,
+    pub private_locator: Option<String>,
+    pub codec: String,
+    pub sample_rate_hz: Option<i32>,
+    pub bit_depth: Option<i16>,
+    pub channels: Option<i16>,
+    pub track_count: Option<i32>,
+    pub byte_length: Option<i64>,
+    pub manifest_digest: Option<Vec<u8>>,
+    pub quality_verified: bool,
+    pub ingest_job_id: Option<Uuid>,
+    pub notes: Option<String>,
+    pub acquired_at: DateTimeUtc,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/cover_asset.rs b/annim/src/entities/sqlite/cover_asset.rs
new file mode 100644
index 00000000..712eae98
--- /dev/null
+++ b/annim/src/entities/sqlite/cover_asset.rs
@@ -0,0 +1,26 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_asset")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub asset_id: Uuid,
+    #[sea_orm(unique)]
+    pub content_sha256: Vec<u8>,
+    #[sea_orm(unique)]
+    pub storage_key: String,
+    pub media_type: String,
+    pub width: i32,
+    pub height: i32,
+    pub byte_length: i64,
+    pub fetched_at: DateTimeUtc,
+    pub verified_at: DateTimeUtc,
+    pub created_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/cover_candidate.rs b/annim/src/entities/sqlite/cover_candidate.rs
new file mode 100644
index 00000000..14afb706
--- /dev/null
+++ b/annim/src/entities/sqlite/cover_candidate.rs
@@ -0,0 +1,35 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_candidate")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub candidate_id: Uuid,
+    pub release_db_id: i32,
+    pub disc_number: i16,
+    pub source_kind: String,
+    pub source_release_revision_db_id: Option<i32>,
+    pub submitted_url: Option<String>,
+    pub canonical_url: Option<String>,
+    pub effective_url: Option<String>,
+    pub state: String,
+    pub asset_db_id: Option<i32>,
+    pub attempt_count: i32,
+    pub lease_token: Option<Uuid>,
+    pub lease_expires_at: Option<DateTimeUtc>,
+    pub next_attempt_at: Option<DateTimeUtc>,
+    pub last_http_status: Option<i32>,
+    pub last_error_code: Option<String>,
+    pub last_error_message: Option<String>,
+    pub fetched_at: Option<DateTimeUtc>,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/cover_selection.rs b/annim/src/entities/sqlite/cover_selection.rs
new file mode 100644
index 00000000..97db03c0
--- /dev/null
+++ b/annim/src/entities/sqlite/cover_selection.rs
@@ -0,0 +1,22 @@
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "cover_selection")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub selection_id: Uuid,
+    pub release_db_id: i32,
+    pub disc_number: i16,
+    pub candidate_db_id: i32,
+    pub asset_db_id: i32,
+    pub row_version: i64,
+    pub selected_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/ingest_job.rs b/annim/src/entities/sqlite/ingest_job.rs
new file mode 100644
index 00000000..2dfb0099
--- /dev/null
+++ b/annim/src/entities/sqlite/ingest_job.rs
@@ -0,0 +1,26 @@
+//! SeaORM mapping for persisted audio-ingestion workflow state.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "ingest_job")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    #[sea_orm(unique)]
+    pub job_id: Uuid,
+    pub state: String,
+    pub metadata_revision: i64,
+    pub approved_revision: Option<i64>,
+    pub manifest_digest: Option<Vec<u8>>,
+    pub plan_digest: Option<Vec<u8>>,
+    pub verification_digest: Option<Vec<u8>>,
+    pub row_version: i64,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/ingest_metadata_revision.rs b/annim/src/entities/sqlite/ingest_metadata_revision.rs
new file mode 100644
index 00000000..a00864ba
--- /dev/null
+++ b/annim/src/entities/sqlite/ingest_metadata_revision.rs
@@ -0,0 +1,21 @@
+//! SeaORM mapping for versioned ingest metadata documents.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq)]
+#[sea_orm(table_name = "ingest_metadata_revision")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub job_id: Uuid,
+    pub revision: i64,
+    pub document: String,
+    pub document_sha256: Vec<u8>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/annim/src/entities/sqlite/mod.rs b/annim/src/entities/sqlite/mod.rs
index e95d221f..8dc6aa0f 100644
--- a/annim/src/entities/sqlite/mod.rs
+++ b/annim/src/entities/sqlite/mod.rs
@@ -4,7 +4,19 @@ pub mod prelude;
 
 pub mod album;
 pub mod album_tag_relation;
+pub mod catalog_artist;
+pub mod catalog_release;
+pub mod catalog_source;
+pub mod catalog_source_release;
+pub mod catalog_source_release_revision;
+pub mod catalog_sync_run;
+pub mod collection_copy;
+pub mod cover_asset;
+pub mod cover_candidate;
+pub mod cover_selection;
 pub mod disc;
+pub mod ingest_job;
+pub mod ingest_metadata_revision;
 pub mod tag_info;
 pub mod tag_relation;
 pub mod track;
diff --git a/annim/src/entities/sqlite/prelude.rs b/annim/src/entities/sqlite/prelude.rs
index aa6370e6..aa7b1a96 100644
--- a/annim/src/entities/sqlite/prelude.rs
+++ b/annim/src/entities/sqlite/prelude.rs
@@ -2,7 +2,19 @@
 
 pub use super::album::Entity as Album;
 pub use super::album_tag_relation::Entity as AlbumTagRelation;
+pub use super::catalog_artist::Entity as CatalogArtist;
+pub use super::catalog_release::Entity as CatalogRelease;
+pub use super::catalog_source::Entity as CatalogSource;
+pub use super::catalog_source_release::Entity as CatalogSourceRelease;
+pub use super::catalog_source_release_revision::Entity as CatalogSourceReleaseRevision;
+pub use super::catalog_sync_run::Entity as CatalogSyncRun;
+pub use super::collection_copy::Entity as CollectionCopy;
+pub use super::cover_asset::Entity as CoverAsset;
+pub use super::cover_candidate::Entity as CoverCandidate;
+pub use super::cover_selection::Entity as CoverSelection;
 pub use super::disc::Entity as Disc;
+pub use super::ingest_job::Entity as IngestJob;
+pub use super::ingest_metadata_revision::Entity as IngestMetadataRevision;
 pub use super::tag_info::Entity as TagInfo;
 pub use super::tag_relation::Entity as TagRelation;
 pub use super::track::Entity as Track;
diff --git a/annim/src/graphql/catalog.rs b/annim/src/graphql/catalog.rs
new file mode 100644
index 00000000..4d12a368
--- /dev/null
+++ b/annim/src/graphql/catalog.rs
@@ -0,0 +1,808 @@
+use std::num::NonZeroU32;
+
+use anni_catalog::{AcquisitionSourceKind, AudioCodec, CollectionState, QualityTier, ReleaseKind};
+use anni_ingest::Digest;
+use async_graphql::{
+    Context, Enum, Error, ErrorExtensions, InputObject, OneofObject, Result, SimpleObject,
+};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+
+use crate::catalog::{
+    CatalogArtistCollection, CatalogArtistSnapshot, CatalogCollectionSummary, CatalogError,
+    CatalogReleaseCommand, CatalogReleaseSnapshot, CatalogRowVersion, CatalogService,
+    CollectionCopySnapshot, NewCatalogArtist, NewCatalogRelease, NewCollectionCopy,
+    UpdateCatalogArtist, UpdateCatalogRelease,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogCollectionState {
+    Missing,
+    Wanted,
+    Acquired,
+    Ingesting,
+    Published,
+    Unavailable,
+}
+
+impl From<CollectionState> for CatalogCollectionState {
+    fn from(value: CollectionState) -> Self {
+        match value {
+            CollectionState::Missing => Self::Missing,
+            CollectionState::Wanted => Self::Wanted,
+            CollectionState::Acquired => Self::Acquired,
+            CollectionState::Ingesting => Self::Ingesting,
+            CollectionState::Published => Self::Published,
+            CollectionState::Unavailable => Self::Unavailable,
+        }
+    }
+}
+
+impl From<CatalogCollectionState> for CollectionState {
+    fn from(value: CatalogCollectionState) -> Self {
+        match value {
+            CatalogCollectionState::Missing => Self::Missing,
+            CatalogCollectionState::Wanted => Self::Wanted,
+            CatalogCollectionState::Acquired => Self::Acquired,
+            CatalogCollectionState::Ingesting => Self::Ingesting,
+            CatalogCollectionState::Published => Self::Published,
+            CatalogCollectionState::Unavailable => Self::Unavailable,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogReleaseKind {
+    Album,
+    Single,
+    Ep,
+    Soundtrack,
+    Compilation,
+    Other,
+}
+
+impl From<ReleaseKind> for CatalogReleaseKind {
+    fn from(value: ReleaseKind) -> Self {
+        match value {
+            ReleaseKind::Album => Self::Album,
+            ReleaseKind::Single => Self::Single,
+            ReleaseKind::Ep => Self::Ep,
+            ReleaseKind::Soundtrack => Self::Soundtrack,
+            ReleaseKind::Compilation => Self::Compilation,
+            ReleaseKind::Other => Self::Other,
+        }
+    }
+}
+
+impl From<CatalogReleaseKind> for ReleaseKind {
+    fn from(value: CatalogReleaseKind) -> Self {
+        match value {
+            CatalogReleaseKind::Album => Self::Album,
+            CatalogReleaseKind::Single => Self::Single,
+            CatalogReleaseKind::Ep => Self::Ep,
+            CatalogReleaseKind::Soundtrack => Self::Soundtrack,
+            CatalogReleaseKind::Compilation => Self::Compilation,
+            CatalogReleaseKind::Other => Self::Other,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogAcquisitionSourceKind {
+    OwnedCd,
+    AngelAnime,
+    PrivateTracker,
+    BitTorrent,
+    FriendShare,
+    Streaming,
+    Other,
+}
+
+impl From<AcquisitionSourceKind> for CatalogAcquisitionSourceKind {
+    fn from(value: AcquisitionSourceKind) -> Self {
+        match value {
+            AcquisitionSourceKind::OwnedCd => Self::OwnedCd,
+            AcquisitionSourceKind::AngelAnime => Self::AngelAnime,
+            AcquisitionSourceKind::PrivateTracker => Self::PrivateTracker,
+            AcquisitionSourceKind::BitTorrent => Self::BitTorrent,
+            AcquisitionSourceKind::FriendShare => Self::FriendShare,
+            AcquisitionSourceKind::Streaming => Self::Streaming,
+            AcquisitionSourceKind::Other => Self::Other,
+        }
+    }
+}
+
+impl From<CatalogAcquisitionSourceKind> for AcquisitionSourceKind {
+    fn from(value: CatalogAcquisitionSourceKind) -> Self {
+        match value {
+            CatalogAcquisitionSourceKind::OwnedCd => Self::OwnedCd,
+            CatalogAcquisitionSourceKind::AngelAnime => Self::AngelAnime,
+            CatalogAcquisitionSourceKind::PrivateTracker => Self::PrivateTracker,
+            CatalogAcquisitionSourceKind::BitTorrent => Self::BitTorrent,
+            CatalogAcquisitionSourceKind::FriendShare => Self::FriendShare,
+            CatalogAcquisitionSourceKind::Streaming => Self::Streaming,
+            CatalogAcquisitionSourceKind::Other => Self::Other,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogAudioCodec {
+    Flac,
+    Wav,
+    Alac,
+    Aac,
+    Mp3,
+    Opus,
+    Other,
+}
+
+impl From<AudioCodec> for CatalogAudioCodec {
+    fn from(value: AudioCodec) -> Self {
+        match value {
+            AudioCodec::Flac => Self::Flac,
+            AudioCodec::Wav => Self::Wav,
+            AudioCodec::Alac => Self::Alac,
+            AudioCodec::Aac => Self::Aac,
+            AudioCodec::Mp3 => Self::Mp3,
+            AudioCodec::Opus => Self::Opus,
+            AudioCodec::Other => Self::Other,
+        }
+    }
+}
+
+impl From<CatalogAudioCodec> for AudioCodec {
+    fn from(value: CatalogAudioCodec) -> Self {
+        match value {
+            CatalogAudioCodec::Flac => Self::Flac,
+            CatalogAudioCodec::Wav => Self::Wav,
+            CatalogAudioCodec::Alac => Self::Alac,
+            CatalogAudioCodec::Aac => Self::Aac,
+            CatalogAudioCodec::Mp3 => Self::Mp3,
+            CatalogAudioCodec::Opus => Self::Opus,
+            CatalogAudioCodec::Other => Self::Other,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogAudioQualityTier {
+    Unknown,
+    Lossy,
+    Lossless,
+    HiResLossless,
+}
+
+impl From<QualityTier> for CatalogAudioQualityTier {
+    fn from(value: QualityTier) -> Self {
+        match value {
+            QualityTier::Unknown => Self::Unknown,
+            QualityTier::Lossy => Self::Lossy,
+            QualityTier::Lossless => Self::Lossless,
+            QualityTier::HiResLossless => Self::HiResLossless,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogArtistInfo {
+    artist_id: Uuid,
+    display_name: String,
+    sort_name: Option<String>,
+    notes: Option<String>,
+    row_version: String,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<CatalogArtistSnapshot> for CatalogArtistInfo {
+    fn from(value: CatalogArtistSnapshot) -> Self {
+        Self {
+            artist_id: value.artist_id,
+            display_name: value.display_name,
+            sort_name: value.sort_name,
+            notes: value.notes,
+            row_version: value.row_version.to_string(),
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CollectionCopyInfo {
+    copy_id: Uuid,
+    source_kind: CatalogAcquisitionSourceKind,
+    source_label: String,
+    codec: CatalogAudioCodec,
+    quality_tier: CatalogAudioQualityTier,
+    sample_rate_hz: Option<i32>,
+    bit_depth: Option<i32>,
+    channels: Option<i32>,
+    track_count: Option<i32>,
+    byte_length: Option<String>,
+    manifest_digest: Option<String>,
+    quality_verified: bool,
+    ingest_job_id: Option<Uuid>,
+    notes: Option<String>,
+    acquired_at: DateTime<Utc>,
+}
+
+impl From<CollectionCopySnapshot> for CollectionCopyInfo {
+    fn from(value: CollectionCopySnapshot) -> Self {
+        let quality_tier = value.quality_tier().into();
+        Self {
+            copy_id: value.copy_id,
+            source_kind: value.source_kind.into(),
+            source_label: value.source_label,
+            codec: value.codec.into(),
+            quality_tier,
+            sample_rate_hz: value.sample_rate_hz.map(|value| value.get() as i32),
+            bit_depth: value.bit_depth.map(i32::from),
+            channels: value.channels.map(i32::from),
+            track_count: value.track_count.map(|value| value as i32),
+            byte_length: value.byte_length.map(|value| value.to_string()),
+            manifest_digest: value.manifest_digest.map(|value| value.to_string()),
+            quality_verified: value.quality_verified,
+            ingest_job_id: value.ingest_job_id,
+            notes: value.notes,
+            acquired_at: value.acquired_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogReleaseInfo {
+    release_id: Uuid,
+    artist_id: Uuid,
+    title: String,
+    edition: Option<String>,
+    catalog: Option<String>,
+    release_date: Option<String>,
+    kind: CatalogReleaseKind,
+    collection_state: CatalogCollectionState,
+    wanted: bool,
+    unavailable: bool,
+    matched_album_id: Option<Uuid>,
+    active_ingest_job_id: Option<Uuid>,
+    notes: Option<String>,
+    row_version: String,
+    copies: Vec<CollectionCopyInfo>,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<CatalogReleaseSnapshot> for CatalogReleaseInfo {
+    fn from(value: CatalogReleaseSnapshot) -> Self {
+        let collection_state = value.collection_state().into();
+        Self {
+            release_id: value.release_id,
+            artist_id: value.artist_id,
+            title: value.title,
+            edition: value.edition,
+            catalog: value.catalog,
+            release_date: value.release_date,
+            kind: value.kind.into(),
+            collection_state,
+            wanted: value.wanted,
+            unavailable: value.unavailable,
+            matched_album_id: value.matched_album_id,
+            active_ingest_job_id: value.active_ingest_job_id,
+            notes: value.notes,
+            row_version: value.row_version.to_string(),
+            copies: value.copies.into_iter().map(Into::into).collect(),
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogCollectionSummaryInfo {
+    total: String,
+    missing: String,
+    wanted: String,
+    acquired: String,
+    ingesting: String,
+    published: String,
+    unavailable: String,
+    collected: String,
+}
+
+impl From<CatalogCollectionSummary> for CatalogCollectionSummaryInfo {
+    fn from(value: CatalogCollectionSummary) -> Self {
+        Self {
+            total: value.total.to_string(),
+            missing: value.missing.to_string(),
+            wanted: value.wanted.to_string(),
+            acquired: value.acquired.to_string(),
+            ingesting: value.ingesting.to_string(),
+            published: value.published.to_string(),
+            unavailable: value.unavailable.to_string(),
+            collected: value.collected.to_string(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogArtistCollectionInfo {
+    artist: CatalogArtistInfo,
+    summary: CatalogCollectionSummaryInfo,
+    release_total_count: String,
+    releases: Vec<CatalogReleaseInfo>,
+}
+
+impl CatalogArtistCollectionInfo {
+    fn from_snapshot(value: CatalogArtistCollection, limit: usize, offset: usize) -> Self {
+        let release_total_count = value.releases.len();
+        Self {
+            artist: value.artist.into(),
+            summary: value.summary.into(),
+            release_total_count: release_total_count.to_string(),
+            releases: value
+                .releases
+                .into_iter()
+                .skip(offset)
+                .take(limit)
+                .map(Into::into)
+                .collect(),
+        }
+    }
+}
+
+#[derive(Debug, InputObject)]
+pub struct CreateCatalogArtistInput {
+    artist_id: Option<Uuid>,
+    display_name: String,
+    sort_name: Option<String>,
+    notes: Option<String>,
+}
+
+#[derive(Debug, InputObject)]
+pub struct UpdateCatalogArtistInput {
+    artist_id: Uuid,
+    expected_row_version: String,
+    display_name: String,
+    sort_name: Option<String>,
+    notes: Option<String>,
+}
+
+#[derive(Debug, InputObject)]
+pub struct CreateCatalogReleaseInput {
+    release_id: Option<Uuid>,
+    artist_id: Uuid,
+    title: String,
+    edition: Option<String>,
+    catalog: Option<String>,
+    release_date: Option<String>,
+    kind: CatalogReleaseKind,
+    notes: Option<String>,
+}
+
+#[derive(Debug, InputObject)]
+pub struct UpdateCatalogReleaseInput {
+    release_id: Uuid,
+    expected_row_version: String,
+    title: String,
+    edition: Option<String>,
+    catalog: Option<String>,
+    release_date: Option<String>,
+    kind: CatalogReleaseKind,
+    notes: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogCommandSignal {
+    Execute,
+}
+
+#[derive(Debug, InputObject)]
+pub struct RecordCollectionCopyInput {
+    copy_id: Option<Uuid>,
+    source_kind: CatalogAcquisitionSourceKind,
+    source_label: String,
+    private_locator: Option<String>,
+    codec: CatalogAudioCodec,
+    sample_rate_hz: Option<i32>,
+    bit_depth: Option<i32>,
+    channels: Option<i32>,
+    track_count: Option<i32>,
+    byte_length: Option<String>,
+    manifest_digest: Option<String>,
+    #[graphql(default = false)]
+    quality_verified: bool,
+    ingest_job_id: Option<Uuid>,
+    notes: Option<String>,
+}
+
+#[derive(Debug, InputObject)]
+pub struct BeginCatalogIngestInput {
+    job_id: Uuid,
+}
+
+#[derive(Debug, InputObject)]
+pub struct PublishCatalogReleaseInput {
+    album_id: Uuid,
+}
+
+#[derive(Debug, OneofObject)]
+pub enum CatalogReleaseCommandInput {
+    MarkMissing(CatalogCommandSignal),
+    MarkWanted(CatalogCommandSignal),
+    MarkUnavailable(CatalogCommandSignal),
+    RecordCopy(RecordCollectionCopyInput),
+    BeginIngest(BeginCatalogIngestInput),
+    Publish(PublishCatalogReleaseInput),
+    ReturnToAcquired(CatalogCommandSignal),
+}
+
+#[derive(Debug, InputObject)]
+pub struct ExecuteCatalogReleaseCommandInput {
+    release_id: Uuid,
+    expected_row_version: String,
+    command: CatalogReleaseCommandInput,
+}
+
+pub async fn query_artists(
+    ctx: &Context<'_>,
+    search: Option<String>,
+    limit: i32,
+    offset: i32,
+) -> Result<Vec<CatalogArtistInfo>> {
+    validate_pagination(limit, offset)?;
+    ctx.data::<CatalogService>()?
+        .list_artists(
+            search.as_deref(),
+            u64::try_from(limit).expect("validated positive i32"),
+            u64::try_from(offset).expect("validated non-negative i32"),
+        )
+        .await
+        .map(|values| values.into_iter().map(Into::into).collect())
+        .map_err(catalog_error)
+}
+
+pub async fn query_artist_collection(
+    ctx: &Context<'_>,
+    artist_id: Uuid,
+    state: Option<CatalogCollectionState>,
+    limit: i32,
+    offset: i32,
+) -> Result<Option<CatalogArtistCollectionInfo>> {
+    validate_pagination(limit, offset)?;
+    ctx.data::<CatalogService>()?
+        .artist_collection(artist_id, state.map(Into::into))
+        .await
+        .map(|value| {
+            value.map(|value| {
+                CatalogArtistCollectionInfo::from_snapshot(
+                    value,
+                    usize::try_from(limit).expect("validated positive i32"),
+                    usize::try_from(offset).expect("validated non-negative i32"),
+                )
+            })
+        })
+        .map_err(catalog_error)
+}
+
+pub async fn create_artist(
+    ctx: &Context<'_>,
+    input: CreateCatalogArtistInput,
+) -> Result<CatalogArtistInfo> {
+    ctx.data::<CatalogService>()?
+        .create_artist(NewCatalogArtist {
+            artist_id: input.artist_id,
+            display_name: input.display_name,
+            sort_name: input.sort_name,
+            notes: input.notes,
+        })
+        .await
+        .map(Into::into)
+        .map_err(catalog_error)
+}
+
+pub async fn update_artist(
+    ctx: &Context<'_>,
+    input: UpdateCatalogArtistInput,
+) -> Result<CatalogArtistInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    ctx.data::<CatalogService>()?
+        .update_artist(
+            input.artist_id,
+            expected,
+            UpdateCatalogArtist {
+                display_name: input.display_name,
+                sort_name: input.sort_name,
+                notes: input.notes,
+            },
+        )
+        .await
+        .map(Into::into)
+        .map_err(catalog_error)
+}
+
+pub async fn create_release(
+    ctx: &Context<'_>,
+    input: CreateCatalogReleaseInput,
+) -> Result<CatalogReleaseInfo> {
+    ctx.data::<CatalogService>()?
+        .create_release(NewCatalogRelease {
+            release_id: input.release_id,
+            artist_id: input.artist_id,
+            title: input.title,
+            edition: input.edition,
+            catalog: input.catalog,
+            release_date: input.release_date,
+            kind: input.kind.into(),
+            notes: input.notes,
+        })
+        .await
+        .map(Into::into)
+        .map_err(catalog_error)
+}
+
+pub async fn update_release(
+    ctx: &Context<'_>,
+    input: UpdateCatalogReleaseInput,
+) -> Result<CatalogReleaseInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    ctx.data::<CatalogService>()?
+        .update_release(
+            input.release_id,
+            expected,
+            UpdateCatalogRelease {
+                title: input.title,
+                edition: input.edition,
+                catalog: input.catalog,
+                release_date: input.release_date,
+                kind: input.kind.into(),
+                notes: input.notes,
+            },
+        )
+        .await
+        .map(Into::into)
+        .map_err(catalog_error)
+}
+
+pub async fn execute_release_command(
+    ctx: &Context<'_>,
+    input: ExecuteCatalogReleaseCommandInput,
+) -> Result<CatalogReleaseInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    let command = command_from_input(input.command)?;
+    ctx.data::<CatalogService>()?
+        .execute_release_command(input.release_id, expected, command)
+        .await
+        .map(Into::into)
+        .map_err(catalog_error)
+}
+
+fn command_from_input(input: CatalogReleaseCommandInput) -> Result<CatalogReleaseCommand> {
+    match input {
+        CatalogReleaseCommandInput::MarkMissing(_) => Ok(CatalogReleaseCommand::MarkMissing),
+        CatalogReleaseCommandInput::MarkWanted(_) => Ok(CatalogReleaseCommand::MarkWanted),
+        CatalogReleaseCommandInput::MarkUnavailable(_) => {
+            Ok(CatalogReleaseCommand::MarkUnavailable)
+        }
+        CatalogReleaseCommandInput::RecordCopy(input) => {
+            Ok(CatalogReleaseCommand::RecordCopy(NewCollectionCopy {
+                copy_id: input.copy_id,
+                source_kind: input.source_kind.into(),
+                source_label: input.source_label,
+                private_locator: input.private_locator,
+                codec: input.codec.into(),
+                sample_rate_hz: parse_nonzero_u32("sampleRateHz", input.sample_rate_hz)?,
+                bit_depth: parse_u8("bitDepth", input.bit_depth)?,
+                channels: parse_u8("channels", input.channels)?,
+                track_count: parse_u32("trackCount", input.track_count)?,
+                byte_length: input
+                    .byte_length
+                    .as_deref()
+                    .map(|value| parse_u64("byteLength", value))
+                    .transpose()?,
+                manifest_digest: input
+                    .manifest_digest
+                    .as_deref()
+                    .map(parse_digest)
+                    .transpose()?,
+                quality_verified: input.quality_verified,
+                ingest_job_id: input.ingest_job_id,
+                notes: input.notes,
+            }))
+        }
+        CatalogReleaseCommandInput::BeginIngest(input) => Ok(CatalogReleaseCommand::BeginIngest {
+            job_id: input.job_id,
+        }),
+        CatalogReleaseCommandInput::Publish(input) => Ok(CatalogReleaseCommand::Publish {
+            album_id: input.album_id,
+        }),
+        CatalogReleaseCommandInput::ReturnToAcquired(_) => {
+            Ok(CatalogReleaseCommand::ReturnToAcquired)
+        }
+    }
+}
+
+fn validate_pagination(limit: i32, offset: i32) -> Result<()> {
+    if !(1..=500).contains(&limit) || offset < 0 {
+        return Err(input_error(
+            "CATALOG_INVALID_PAGINATION",
+            "limit must be between 1 and 500 and offset must be non-negative",
+        ));
+    }
+    Ok(())
+}
+
+fn parse_row_version(value: &str) -> Result<CatalogRowVersion> {
+    value
+        .parse::<u64>()
+        .ok()
+        .and_then(CatalogRowVersion::new)
+        .ok_or_else(|| {
+            input_error(
+                "CATALOG_INVALID_ROW_VERSION",
+                "row version must be a positive base-10 integer",
+            )
+        })
+}
+
+fn parse_nonzero_u32(field: &'static str, value: Option<i32>) -> Result<Option<NonZeroU32>> {
+    value
+        .map(|value| {
+            u32::try_from(value)
+                .ok()
+                .and_then(NonZeroU32::new)
+                .ok_or_else(|| numeric_input_error(field))
+        })
+        .transpose()
+}
+
+fn parse_u8(field: &'static str, value: Option<i32>) -> Result<Option<u8>> {
+    value
+        .map(|value| {
+            u8::try_from(value)
+                .ok()
+                .filter(|value| *value > 0)
+                .ok_or_else(|| numeric_input_error(field))
+        })
+        .transpose()
+}
+
+fn parse_u32(field: &'static str, value: Option<i32>) -> Result<Option<u32>> {
+    value
+        .map(|value| {
+            u32::try_from(value)
+                .ok()
+                .filter(|value| *value > 0)
+                .ok_or_else(|| numeric_input_error(field))
+        })
+        .transpose()
+}
+
+fn parse_u64(field: &'static str, value: &str) -> Result<u64> {
+    value
+        .parse::<u64>()
+        .ok()
+        .filter(|value| *value > 0)
+        .ok_or_else(|| numeric_input_error(field))
+}
+
+fn parse_digest(value: &str) -> Result<Digest> {
+    value.parse().map_err(|error| {
+        input_error(
+            "CATALOG_INVALID_DIGEST",
+            format!("invalid manifest digest: {error}"),
+        )
+    })
+}
+
+fn numeric_input_error(field: &'static str) -> Error {
+    input_error(
+        "CATALOG_INVALID_NUMBER",
+        format!("{field} must be a positive integer in range"),
+    )
+}
+
+fn input_error(code: &'static str, message: impl Into<String>) -> Error {
+    Error::new(message).extend_with(|_, extensions| extensions.set("code", code))
+}
+
+fn catalog_error(error: CatalogError) -> Error {
+    match error {
+        CatalogError::ArtistAlreadyExists { artist_id } => {
+            entity_error("CATALOG_ARTIST_ALREADY_EXISTS", "artistId", artist_id)
+        }
+        CatalogError::ArtistNotFound { artist_id } => {
+            entity_error("CATALOG_ARTIST_NOT_FOUND", "artistId", artist_id)
+        }
+        CatalogError::ArtistConflict {
+            artist_id,
+            expected,
+            actual,
+        } => conflict_error(
+            "CATALOG_ARTIST_CONFLICT",
+            "artistId",
+            artist_id,
+            expected,
+            actual,
+        ),
+        CatalogError::ReleaseAlreadyExists { release_id } => {
+            entity_error("CATALOG_RELEASE_ALREADY_EXISTS", "releaseId", release_id)
+        }
+        CatalogError::ReleaseNotFound { release_id } => {
+            entity_error("CATALOG_RELEASE_NOT_FOUND", "releaseId", release_id)
+        }
+        CatalogError::ReleaseConflict {
+            release_id,
+            expected,
+            actual,
+        } => conflict_error(
+            "CATALOG_RELEASE_CONFLICT",
+            "releaseId",
+            release_id,
+            expected,
+            actual,
+        ),
+        CatalogError::CopyAlreadyExists { copy_id } => {
+            entity_error("CATALOG_COPY_ALREADY_EXISTS", "copyId", copy_id)
+        }
+        CatalogError::InvalidTransition {
+            release_id,
+            from,
+            to,
+        } => Error::new(format!(
+            "catalog release {release_id} cannot transition from {from} to {to}"
+        ))
+        .extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_INVALID_TRANSITION");
+            extensions.set("releaseId", release_id.to_string());
+            extensions.set("from", from.as_str());
+            extensions.set("to", to.as_str());
+        }),
+        CatalogError::NoAcquiredCopy { release_id } => {
+            entity_error("CATALOG_NO_ACQUIRED_COPY", "releaseId", release_id)
+        }
+        CatalogError::InvalidInput { field, message } => {
+            Error::new(message).extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_INVALID_INPUT");
+                extensions.set("field", field);
+            })
+        }
+        CatalogError::NumericOutOfRange { field, .. } => {
+            Error::new("numeric value is out of range").extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_INVALID_NUMBER");
+                extensions.set("field", field);
+            })
+        }
+        error @ CatalogError::InvalidPersistedValue { .. } => {
+            tracing::error!(error = ?error, "persisted catalog data is corrupt");
+            Error::new("persisted catalog data is corrupt")
+                .extend_with(|_, extensions| extensions.set("code", "CATALOG_CORRUPT"))
+        }
+        CatalogError::Database(error) => {
+            tracing::error!(error = ?error, "catalog database operation failed");
+            Error::new("catalog operation failed")
+                .extend_with(|_, extensions| extensions.set("code", "CATALOG_INTERNAL"))
+        }
+    }
+}
+
+fn entity_error(code: &'static str, id_field: &'static str, id: Uuid) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set(id_field, id.to_string());
+    })
+}
+
+fn conflict_error(
+    code: &'static str,
+    id_field: &'static str,
+    id: Uuid,
+    expected: CatalogRowVersion,
+    actual: CatalogRowVersion,
+) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set(id_field, id.to_string());
+        extensions.set("expectedRowVersion", expected.to_string());
+        extensions.set("actualRowVersion", actual.to_string());
+    })
+}
diff --git a/annim/src/graphql/catalog_sync.rs b/annim/src/graphql/catalog_sync.rs
new file mode 100644
index 00000000..60517599
--- /dev/null
+++ b/annim/src/graphql/catalog_sync.rs
@@ -0,0 +1,568 @@
+//! Browser-safe administration of external catalog synchronization.
+//!
+//! This module intentionally exposes only control-plane operations. Source
+//! locators, adapter configuration, secret references, cursors, raw responses,
+//! parsed responses, and worker lifecycle commands stay outside the Web API.
+
+use std::fmt;
+
+use anni_catalog::{
+    CatalogSourceKind as DomainCatalogSourceKind, SyncCoverage as DomainSyncCoverage,
+    SyncRunStatus as DomainSyncRunStatus,
+};
+use async_graphql::{Context, Enum, Error, ErrorExtensions, InputObject, Result, SimpleObject};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+
+use crate::catalog::{
+    CatalogRowVersion, CatalogSourceProvisioningState as DomainCatalogSourceProvisioningState,
+    CatalogSourceSnapshot, CatalogSyncError, CatalogSyncRunSnapshot, CatalogSyncService,
+    NewCatalogSyncRun, NewManagedCatalogSource,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogSyncSourceKind {
+    AppleMusic,
+    RecordLabel,
+    ArtistWebsite,
+    Vgmdb,
+    Manual,
+}
+
+impl From<DomainCatalogSourceKind> for CatalogSyncSourceKind {
+    fn from(value: DomainCatalogSourceKind) -> Self {
+        match value {
+            DomainCatalogSourceKind::AppleMusic => Self::AppleMusic,
+            DomainCatalogSourceKind::RecordLabel => Self::RecordLabel,
+            DomainCatalogSourceKind::ArtistWebsite => Self::ArtistWebsite,
+            DomainCatalogSourceKind::Vgmdb => Self::Vgmdb,
+            DomainCatalogSourceKind::Manual => Self::Manual,
+        }
+    }
+}
+
+impl From<CatalogSyncSourceKind> for DomainCatalogSourceKind {
+    fn from(value: CatalogSyncSourceKind) -> Self {
+        match value {
+            CatalogSyncSourceKind::AppleMusic => Self::AppleMusic,
+            CatalogSyncSourceKind::RecordLabel => Self::RecordLabel,
+            CatalogSyncSourceKind::ArtistWebsite => Self::ArtistWebsite,
+            CatalogSyncSourceKind::Vgmdb => Self::Vgmdb,
+            CatalogSyncSourceKind::Manual => Self::Manual,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogSyncRunStatus {
+    Queued,
+    Running,
+    Succeeded,
+    Failed,
+    Cancelled,
+}
+
+impl From<DomainSyncRunStatus> for CatalogSyncRunStatus {
+    fn from(value: DomainSyncRunStatus) -> Self {
+        match value {
+            DomainSyncRunStatus::Queued => Self::Queued,
+            DomainSyncRunStatus::Running => Self::Running,
+            DomainSyncRunStatus::Succeeded => Self::Succeeded,
+            DomainSyncRunStatus::Failed => Self::Failed,
+            DomainSyncRunStatus::Cancelled => Self::Cancelled,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogSyncCoverage {
+    FullSnapshot,
+    Incremental,
+    DiscoveryOnly,
+}
+
+/// Whether this server can safely queue work for a source.
+///
+/// This reports deployment capability without exposing the credential
+/// reference or assuming that the referenced token itself is valid.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CatalogSyncProvisioningState {
+    ReadyToQueue,
+    Disabled,
+    CredentialNotConfigured,
+    CredentialBindingInvalid,
+    AdapterUnavailable,
+}
+
+impl From<DomainCatalogSourceProvisioningState> for CatalogSyncProvisioningState {
+    fn from(value: DomainCatalogSourceProvisioningState) -> Self {
+        match value {
+            DomainCatalogSourceProvisioningState::ReadyToQueue => Self::ReadyToQueue,
+            DomainCatalogSourceProvisioningState::Disabled => Self::Disabled,
+            DomainCatalogSourceProvisioningState::CredentialNotConfigured => {
+                Self::CredentialNotConfigured
+            }
+            DomainCatalogSourceProvisioningState::CredentialBindingInvalid => {
+                Self::CredentialBindingInvalid
+            }
+            DomainCatalogSourceProvisioningState::AdapterUnavailable => Self::AdapterUnavailable,
+        }
+    }
+}
+
+impl From<DomainSyncCoverage> for CatalogSyncCoverage {
+    fn from(value: DomainSyncCoverage) -> Self {
+        match value {
+            DomainSyncCoverage::FullSnapshot => Self::FullSnapshot,
+            DomainSyncCoverage::Incremental => Self::Incremental,
+            DomainSyncCoverage::DiscoveryOnly => Self::DiscoveryOnly,
+        }
+    }
+}
+
+/// Source metadata safe for an authenticated browser administrator.
+///
+/// The source locator is deliberately not represented. It may be a signed URL
+/// or otherwise contain credentials even when the source kind is public.
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogSyncSourceInfo {
+    source_id: Uuid,
+    artist_id: Uuid,
+    kind: CatalogSyncSourceKind,
+    storefront: Option<String>,
+    locale: Option<String>,
+    enabled: bool,
+    provisioning_state: CatalogSyncProvisioningState,
+    row_version: String,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<CatalogSourceSnapshot> for CatalogSyncSourceInfo {
+    fn from(value: CatalogSourceSnapshot) -> Self {
+        Self {
+            source_id: value.source_id,
+            artist_id: value.artist_id,
+            kind: value.kind.into(),
+            storefront: value.storefront,
+            locale: value.locale,
+            enabled: value.enabled,
+            provisioning_state: value.provisioning_state.into(),
+            row_version: value.row_version.to_string(),
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+/// Run progress safe for polling from the browser.
+///
+/// Cursors and adapter error text are deliberately omitted. Counters and row
+/// versions use base-10 strings to avoid GraphQL and JavaScript integer loss.
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CatalogSyncRunInfo {
+    run_id: Uuid,
+    source_id: Uuid,
+    status: CatalogSyncRunStatus,
+    coverage: CatalogSyncCoverage,
+    started_from_root: bool,
+    snapshot_complete: bool,
+    observed_count: String,
+    attempt_count: String,
+    next_attempt_at: Option<DateTime<Utc>>,
+    row_version: String,
+    created_at: DateTime<Utc>,
+    started_at: Option<DateTime<Utc>>,
+    finished_at: Option<DateTime<Utc>>,
+}
+
+impl From<CatalogSyncRunSnapshot> for CatalogSyncRunInfo {
+    fn from(value: CatalogSyncRunSnapshot) -> Self {
+        Self {
+            run_id: value.run_id,
+            source_id: value.source_id,
+            status: value.status.into(),
+            coverage: value.coverage.into(),
+            started_from_root: value.started_from_root,
+            snapshot_complete: value.snapshot_complete,
+            observed_count: value.observed_count.to_string(),
+            attempt_count: value.attempt_count.to_string(),
+            next_attempt_at: value.next_attempt_at,
+            row_version: value.row_version.to_string(),
+            created_at: value.created_at,
+            started_at: value.started_at,
+            finished_at: value.finished_at,
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, InputObject)]
+pub struct CreateCatalogSyncSourceInput {
+    source_id: Option<Uuid>,
+    artist_id: Uuid,
+    kind: CatalogSyncSourceKind,
+    locator: String,
+    storefront: Option<String>,
+    locale: Option<String>,
+}
+
+impl fmt::Debug for CreateCatalogSyncSourceInput {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("CreateCatalogSyncSourceInput")
+            .field("source_id", &self.source_id)
+            .field("artist_id", &self.artist_id)
+            .field("kind", &self.kind)
+            .field("locator", &"[REDACTED]")
+            .field("storefront", &self.storefront)
+            .field("locale", &self.locale)
+            .finish()
+    }
+}
+
+impl CreateCatalogSyncSourceInput {
+    fn into_command(self) -> NewManagedCatalogSource {
+        NewManagedCatalogSource {
+            source_id: self.source_id,
+            artist_id: self.artist_id,
+            kind: self.kind.into(),
+            locator: self.locator,
+            storefront: self.storefront,
+            locale: self.locale,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct StartCatalogSyncRunInput {
+    run_id: Option<Uuid>,
+    source_id: Uuid,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct SetCatalogSyncSourceEnabledInput {
+    source_id: Uuid,
+    expected_row_version: String,
+    enabled: bool,
+}
+
+impl StartCatalogSyncRunInput {
+    fn into_command(self) -> NewCatalogSyncRun {
+        NewCatalogSyncRun {
+            run_id: self.run_id,
+            source_id: self.source_id,
+            requested_cursor: None,
+        }
+    }
+}
+
+pub async fn query_source(
+    ctx: &Context<'_>,
+    source_id: Uuid,
+) -> Result<Option<CatalogSyncSourceInfo>> {
+    ctx.data::<CatalogSyncService>()?
+        .get_source(source_id)
+        .await
+        .map(|value| value.map(Into::into))
+        .map_err(catalog_sync_error)
+}
+
+pub async fn query_sources(
+    ctx: &Context<'_>,
+    artist_id: Uuid,
+) -> Result<Vec<CatalogSyncSourceInfo>> {
+    ctx.data::<CatalogSyncService>()?
+        .list_sources_for_artist(artist_id)
+        .await
+        .map(|sources| sources.into_iter().map(Into::into).collect())
+        .map_err(catalog_sync_error)
+}
+
+pub async fn query_run(ctx: &Context<'_>, run_id: Uuid) -> Result<Option<CatalogSyncRunInfo>> {
+    ctx.data::<CatalogSyncService>()?
+        .get_run(run_id)
+        .await
+        .map(|value| value.map(Into::into))
+        .map_err(catalog_sync_error)
+}
+
+pub async fn query_runs(
+    ctx: &Context<'_>,
+    source_id: Uuid,
+    limit: i32,
+    offset: i32,
+) -> Result<Vec<CatalogSyncRunInfo>> {
+    validate_pagination(limit, offset)?;
+    ctx.data::<CatalogSyncService>()?
+        .list_runs_for_source(
+            source_id,
+            u64::try_from(limit).expect("validated positive i32"),
+            u64::try_from(offset).expect("validated non-negative i32"),
+        )
+        .await
+        .map(|runs| runs.into_iter().map(Into::into).collect())
+        .map_err(catalog_sync_error)
+}
+
+pub async fn create_source(
+    ctx: &Context<'_>,
+    input: CreateCatalogSyncSourceInput,
+) -> Result<CatalogSyncSourceInfo> {
+    ctx.data::<CatalogSyncService>()?
+        .create_managed_source(input.into_command())
+        .await
+        .map(Into::into)
+        .map_err(catalog_sync_error)
+}
+
+pub async fn start_run(
+    ctx: &Context<'_>,
+    input: StartCatalogSyncRunInput,
+) -> Result<CatalogSyncRunInfo> {
+    ctx.data::<CatalogSyncService>()?
+        .start_managed_run(input.into_command())
+        .await
+        .map(Into::into)
+        .map_err(catalog_sync_error)
+}
+
+pub async fn set_source_enabled(
+    ctx: &Context<'_>,
+    input: SetCatalogSyncSourceEnabledInput,
+) -> Result<CatalogSyncSourceInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    ctx.data::<CatalogSyncService>()?
+        .set_source_enabled(input.source_id, expected, input.enabled)
+        .await
+        .map(Into::into)
+        .map_err(catalog_sync_error)
+}
+
+fn validate_pagination(limit: i32, offset: i32) -> Result<()> {
+    if !(1..=500).contains(&limit) || offset < 0 {
+        return Err(
+            Error::new("limit must be between 1 and 500 and offset must be non-negative")
+                .extend_with(|_, extensions| {
+                    extensions.set("code", "CATALOG_SYNC_INVALID_PAGINATION");
+                }),
+        );
+    }
+    Ok(())
+}
+
+fn parse_row_version(value: &str) -> Result<CatalogRowVersion> {
+    value
+        .parse::<u64>()
+        .ok()
+        .and_then(CatalogRowVersion::new)
+        .ok_or_else(|| {
+            Error::new("row version must be a positive base-10 integer").extend_with(
+                |_, extensions| {
+                    extensions.set("code", "CATALOG_SYNC_INVALID_ROW_VERSION");
+                },
+            )
+        })
+}
+
+fn catalog_sync_error(error: CatalogSyncError) -> Error {
+    match error {
+        CatalogSyncError::ArtistNotFound { artist_id } => {
+            entity_error("CATALOG_SYNC_ARTIST_NOT_FOUND", "artistId", artist_id)
+        }
+        CatalogSyncError::SourceAlreadyExists { source_id } => {
+            entity_error("CATALOG_SYNC_SOURCE_ALREADY_EXISTS", "sourceId", source_id)
+        }
+        CatalogSyncError::SourceIdentityAlreadyExists { artist_id, kind } => {
+            Error::new("catalog source identity already exists").extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_SYNC_SOURCE_IDENTITY_EXISTS");
+                extensions.set("artistId", artist_id.to_string());
+                extensions.set("kind", kind.as_str());
+            })
+        }
+        CatalogSyncError::SourceNotFound { source_id } => {
+            entity_error("CATALOG_SYNC_SOURCE_NOT_FOUND", "sourceId", source_id)
+        }
+        CatalogSyncError::SourceConflict {
+            source_id,
+            expected,
+            actual,
+        } => Error::new("catalog sync source changed concurrently").extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_SYNC_SOURCE_CONFLICT");
+            extensions.set("sourceId", source_id.to_string());
+            extensions.set("expectedRowVersion", expected.to_string());
+            extensions.set("actualRowVersion", actual.to_string());
+        }),
+        CatalogSyncError::SourceDisabled { source_id } => {
+            entity_error("CATALOG_SYNC_SOURCE_DISABLED", "sourceId", source_id)
+        }
+        CatalogSyncError::CredentialNotConfigured { kind } => Error::new(
+            "catalog sync credential is not configured on this server",
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_SYNC_CREDENTIAL_NOT_CONFIGURED");
+            extensions.set("kind", kind.as_str());
+        }),
+        CatalogSyncError::CredentialBindingInvalid { kind } => {
+            Error::new("catalog sync credential binding is invalid").extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_SYNC_CREDENTIAL_BINDING_INVALID");
+                extensions.set("kind", kind.as_str());
+            })
+        }
+        CatalogSyncError::AdapterUnavailable { kind } => Error::new(
+            "catalog sync adapter is not available in this deployment",
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_SYNC_ADAPTER_UNAVAILABLE");
+            extensions.set("kind", kind.as_str());
+        }),
+        CatalogSyncError::SourceBusy { source_id } => {
+            entity_error("CATALOG_SYNC_SOURCE_BUSY", "sourceId", source_id)
+        }
+        CatalogSyncError::RunAlreadyExists { run_id } => {
+            entity_error("CATALOG_SYNC_RUN_ALREADY_EXISTS", "runId", run_id)
+        }
+        CatalogSyncError::RunNotFound { run_id } => {
+            entity_error("CATALOG_SYNC_RUN_NOT_FOUND", "runId", run_id)
+        }
+        CatalogSyncError::RunConflict {
+            run_id,
+            expected,
+            actual,
+        } => Error::new("catalog sync run changed concurrently").extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_SYNC_RUN_CONFLICT");
+            extensions.set("runId", run_id.to_string());
+            extensions.set("expectedRowVersion", expected.to_string());
+            extensions.set("actualRowVersion", actual.to_string());
+        }),
+        CatalogSyncError::InvalidRunTransition { run_id, from, to } => Error::new(
+            "catalog sync run cannot make that transition",
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "CATALOG_SYNC_INVALID_TRANSITION");
+            extensions.set("runId", run_id.to_string());
+            extensions.set("from", from.as_str());
+            extensions.set("to", to.as_str());
+        }),
+        CatalogSyncError::RunNotRunning { run_id, status } => {
+            Error::new("catalog sync run is not running").extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_SYNC_RUN_NOT_RUNNING");
+                extensions.set("runId", run_id.to_string());
+                extensions.set("status", status.as_str());
+            })
+        }
+        CatalogSyncError::InvalidInput { field, message } => {
+            Error::new(message).extend_with(|_, extensions| {
+                extensions.set("code", "CATALOG_SYNC_INVALID_INPUT");
+                extensions.set("field", field);
+            })
+        }
+        CatalogSyncError::RunNotClaimable { .. }
+        | CatalogSyncError::LeaseMismatch { .. }
+        | CatalogSyncError::ObservationConflict { .. }
+        | CatalogSyncError::InvalidPersistedValue { .. }
+        | CatalogSyncError::MissingObservationRevision { .. }
+        | CatalogSyncError::InvalidObservationDigestLength { .. }
+        | CatalogSyncError::ObservationDigestMismatch { .. }
+        | CatalogSyncError::NumericOutOfRange { .. }
+        | CatalogSyncError::Database(_) => {
+            tracing::error!("catalog sync operation failed internally");
+            Error::new("catalog sync operation failed")
+                .extend_with(|_, extensions| extensions.set("code", "CATALOG_SYNC_INTERNAL"))
+        }
+    }
+}
+
+fn entity_error(code: &'static str, id_field: &'static str, id: Uuid) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set(id_field, id.to_string());
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::catalog::CatalogRowVersion;
+
+    #[test]
+    fn browser_snapshots_drop_private_source_and_run_fields_losslessly() {
+        let timestamp = DateTime::<Utc>::from_timestamp(1_700_000_000, 0).unwrap();
+        let locator = "https://example.invalid/releases?token=source-secret".to_owned();
+        let source = CatalogSyncSourceInfo::from(CatalogSourceSnapshot {
+            source_id: Uuid::new_v4(),
+            artist_id: Uuid::new_v4(),
+            kind: DomainCatalogSourceKind::ArtistWebsite,
+            locator: locator.clone(),
+            storefront: Some("jp".to_owned()),
+            locale: Some("ja-JP".to_owned()),
+            enabled: true,
+            provisioning_state: DomainCatalogSourceProvisioningState::AdapterUnavailable,
+            row_version: CatalogRowVersion::new(u64::MAX).unwrap(),
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        let source_debug = format!("{source:?}");
+        assert_eq!(source.row_version, u64::MAX.to_string());
+        assert_eq!(
+            source.provisioning_state,
+            CatalogSyncProvisioningState::AdapterUnavailable
+        );
+        assert!(!source_debug.contains(&locator));
+        assert!(!source_debug.contains("token=source-secret"));
+
+        let run = CatalogSyncRunInfo::from(CatalogSyncRunSnapshot {
+            run_id: Uuid::new_v4(),
+            source_id: source.source_id,
+            status: DomainSyncRunStatus::Running,
+            requested_cursor: Some("requested-secret".to_owned()),
+            result_cursor: Some("result-secret".to_owned()),
+            observed_count: u32::MAX,
+            error_message: Some("adapter-secret".to_owned()),
+            coverage: DomainSyncCoverage::Incremental,
+            started_from_root: false,
+            snapshot_complete: true,
+            attempt_count: u32::MAX,
+            next_attempt_at: Some(timestamp),
+            row_version: CatalogRowVersion::new(u64::MAX).unwrap(),
+            created_at: timestamp,
+            started_at: Some(timestamp),
+            finished_at: None,
+        });
+        let run_debug = format!("{run:?}");
+        assert_eq!(run.observed_count, u32::MAX.to_string());
+        assert_eq!(run.attempt_count, u32::MAX.to_string());
+        assert_eq!(run.coverage, CatalogSyncCoverage::Incremental);
+        assert_eq!(run.row_version, u64::MAX.to_string());
+        assert!(!run_debug.contains("requested-secret"));
+        assert!(!run_debug.contains("result-secret"));
+        assert!(!run_debug.contains("adapter-secret"));
+    }
+
+    #[test]
+    fn browser_write_inputs_redact_locators_and_build_managed_commands() {
+        let locator = "https://example.invalid/api?signature=secret".to_owned();
+        let input = CreateCatalogSyncSourceInput {
+            source_id: None,
+            artist_id: Uuid::new_v4(),
+            kind: CatalogSyncSourceKind::RecordLabel,
+            locator: locator.clone(),
+            storefront: None,
+            locale: None,
+        };
+        let debug = format!("{input:?}");
+        assert!(!debug.contains(&locator));
+        assert!(!debug.contains("signature=secret"));
+        assert!(debug.contains("[REDACTED]"));
+
+        let command = input.into_command();
+        assert_eq!(command.locator, locator);
+        assert_eq!(command.kind, DomainCatalogSourceKind::RecordLabel);
+
+        let run = StartCatalogSyncRunInput {
+            run_id: None,
+            source_id: Uuid::new_v4(),
+        }
+        .into_command();
+        assert!(run.requested_cursor.is_none());
+    }
+}
diff --git a/annim/src/graphql/cover.rs b/annim/src/graphql/cover.rs
new file mode 100644
index 00000000..9e78c98b
--- /dev/null
+++ b/annim/src/graphql/cover.rs
@@ -0,0 +1,592 @@
+use anni_catalog::{CoverCandidateState, CoverMediaType, CoverSourceKind};
+use async_graphql::{Context, Enum, Error, ErrorExtensions, InputObject, Result, SimpleObject};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+
+use crate::cover::{
+    CoverAssetSnapshot, CoverCandidateSnapshot, CoverError, CoverRowVersion,
+    CoverSelectionSnapshot, CoverService, NewCoverCandidate, SelectCover,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CoverSource {
+    AppleMusic,
+    Amazon,
+    RecordLabel,
+    ArtistWebsite,
+    Vgmdb,
+    Manual,
+}
+
+impl From<CoverSourceKind> for CoverSource {
+    fn from(value: CoverSourceKind) -> Self {
+        match value {
+            CoverSourceKind::AppleMusic => Self::AppleMusic,
+            CoverSourceKind::Amazon => Self::Amazon,
+            CoverSourceKind::RecordLabel => Self::RecordLabel,
+            CoverSourceKind::ArtistWebsite => Self::ArtistWebsite,
+            CoverSourceKind::Vgmdb => Self::Vgmdb,
+            CoverSourceKind::Manual => Self::Manual,
+        }
+    }
+}
+
+impl From<CoverSource> for CoverSourceKind {
+    fn from(value: CoverSource) -> Self {
+        match value {
+            CoverSource::AppleMusic => Self::AppleMusic,
+            CoverSource::Amazon => Self::Amazon,
+            CoverSource::RecordLabel => Self::RecordLabel,
+            CoverSource::ArtistWebsite => Self::ArtistWebsite,
+            CoverSource::Vgmdb => Self::Vgmdb,
+            CoverSource::Manual => Self::Manual,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CoverCandidateStatus {
+    Discovered,
+    Queued,
+    Fetching,
+    Verified,
+    Rejected,
+}
+
+impl From<CoverCandidateState> for CoverCandidateStatus {
+    fn from(value: CoverCandidateState) -> Self {
+        match value {
+            CoverCandidateState::Discovered => Self::Discovered,
+            CoverCandidateState::Queued => Self::Queued,
+            CoverCandidateState::Fetching => Self::Fetching,
+            CoverCandidateState::Verified => Self::Verified,
+            CoverCandidateState::Rejected => Self::Rejected,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum CoverAssetMediaType {
+    Jpeg,
+    Png,
+    Webp,
+}
+
+impl From<CoverMediaType> for CoverAssetMediaType {
+    fn from(value: CoverMediaType) -> Self {
+        match value {
+            CoverMediaType::Jpeg => Self::Jpeg,
+            CoverMediaType::Png => Self::Png,
+            CoverMediaType::Webp => Self::Webp,
+        }
+    }
+}
+
+/// Verified image metadata safe to return to the browser.
+///
+/// Storage locators are deliberately omitted. Integer values which do not fit
+/// GraphQL's signed 32-bit `Int` are represented as base-10 strings.
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CoverAssetInfo {
+    asset_id: Uuid,
+    content_sha256: String,
+    media_type: CoverAssetMediaType,
+    width: String,
+    height: String,
+    byte_length: String,
+    fetched_at: DateTime<Utc>,
+    verified_at: DateTime<Utc>,
+    created_at: DateTime<Utc>,
+}
+
+impl From<CoverAssetSnapshot> for CoverAssetInfo {
+    fn from(value: CoverAssetSnapshot) -> Self {
+        Self {
+            asset_id: value.asset_id,
+            content_sha256: value.content_sha256.to_string(),
+            media_type: value.media_type.into(),
+            width: value.width.to_string(),
+            height: value.height.to_string(),
+            byte_length: value.byte_length.to_string(),
+            fetched_at: value.fetched_at,
+            verified_at: value.verified_at,
+            created_at: value.created_at,
+        }
+    }
+}
+
+/// Browser-safe candidate information. It contains URL presence only, never
+/// the submitted, canonical, effective, or worker request URL.
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CoverCandidateInfo {
+    candidate_id: Uuid,
+    release_id: Uuid,
+    disc_number: i32,
+    source_kind: CoverSource,
+    source_release_revision_db_id: Option<i32>,
+    state: CoverCandidateStatus,
+    asset: Option<CoverAssetInfo>,
+    has_remote_url: bool,
+    attempt_count: String,
+    next_attempt_at: Option<DateTime<Utc>>,
+    last_http_status: Option<i32>,
+    last_error_code: Option<String>,
+    fetched_at: Option<DateTime<Utc>>,
+    row_version: String,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<CoverCandidateSnapshot> for CoverCandidateInfo {
+    fn from(value: CoverCandidateSnapshot) -> Self {
+        Self {
+            candidate_id: value.candidate_id,
+            release_id: value.release_id,
+            disc_number: i32::from(value.disc_number),
+            source_kind: value.source_kind.into(),
+            source_release_revision_db_id: value.source_release_revision_db_id,
+            state: value.state.into(),
+            asset: value.asset.map(Into::into),
+            has_remote_url: value.has_remote_url,
+            attempt_count: value.attempt_count.to_string(),
+            next_attempt_at: value.next_attempt_at,
+            last_http_status: value.last_http_status.map(i32::from),
+            last_error_code: value.last_error_code,
+            fetched_at: value.fetched_at,
+            row_version: value.row_version.to_string(),
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct CoverSelectionInfo {
+    selection_id: Uuid,
+    release_id: Uuid,
+    disc_number: i32,
+    candidate_id: Uuid,
+    asset: CoverAssetInfo,
+    row_version: String,
+    selected_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<CoverSelectionSnapshot> for CoverSelectionInfo {
+    fn from(value: CoverSelectionSnapshot) -> Self {
+        Self {
+            selection_id: value.selection_id,
+            release_id: value.release_id,
+            disc_number: i32::from(value.disc_number),
+            candidate_id: value.candidate_id,
+            asset: value.asset.into(),
+            row_version: value.row_version.to_string(),
+            selected_at: value.selected_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, InputObject)]
+pub struct AddCoverCandidateInput {
+    candidate_id: Option<Uuid>,
+    release_id: Uuid,
+    /// Zero means release-level artwork; positive values identify discs.
+    disc_number: i32,
+    source_kind: CoverSource,
+    source_release_revision_db_id: Option<i32>,
+    submitted_url: String,
+}
+
+impl std::fmt::Debug for AddCoverCandidateInput {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("AddCoverCandidateInput")
+            .field("candidate_id", &self.candidate_id)
+            .field("release_id", &self.release_id)
+            .field("disc_number", &self.disc_number)
+            .field("source_kind", &self.source_kind)
+            .field(
+                "source_release_revision_db_id",
+                &self.source_release_revision_db_id,
+            )
+            .field("submitted_url", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Debug, InputObject)]
+pub struct QueueCoverCandidateInput {
+    candidate_id: Uuid,
+    expected_row_version: String,
+    not_before: Option<DateTime<Utc>>,
+}
+
+#[derive(InputObject)]
+pub struct RejectCoverCandidateInput {
+    candidate_id: Uuid,
+    expected_row_version: String,
+    reason_code: String,
+}
+
+impl std::fmt::Debug for RejectCoverCandidateInput {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RejectCoverCandidateInput")
+            .field("candidate_id", &self.candidate_id)
+            .field("expected_row_version", &self.expected_row_version)
+            .field("reason_code", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Debug, InputObject)]
+pub struct SelectCoverInput {
+    release_id: Uuid,
+    disc_number: i32,
+    candidate_id: Uuid,
+    /// Omit when creating the first selection. Supply the current version when
+    /// replacing an existing selection.
+    expected_row_version: Option<String>,
+}
+
+pub async fn query_candidates(
+    ctx: &Context<'_>,
+    release_id: Uuid,
+    disc_number: Option<i32>,
+) -> Result<Vec<CoverCandidateInfo>> {
+    let disc_number = disc_number.map(parse_disc_number).transpose()?;
+    ctx.data::<CoverService>()?
+        .list_candidates(release_id, disc_number)
+        .await
+        .map(|values| values.into_iter().map(Into::into).collect())
+        .map_err(cover_error)
+}
+
+pub async fn query_selection(
+    ctx: &Context<'_>,
+    release_id: Uuid,
+    disc_number: i32,
+) -> Result<Option<CoverSelectionInfo>> {
+    ctx.data::<CoverService>()?
+        .get_selection(release_id, parse_disc_number(disc_number)?)
+        .await
+        .map(|value| value.map(Into::into))
+        .map_err(cover_error)
+}
+
+pub async fn add_candidate(
+    ctx: &Context<'_>,
+    input: AddCoverCandidateInput,
+) -> Result<CoverCandidateInfo> {
+    let disc_number = parse_disc_number(input.disc_number)?;
+    let source_release_revision_db_id = input
+        .source_release_revision_db_id
+        .map(parse_source_revision_id)
+        .transpose()?;
+    ctx.data::<CoverService>()?
+        .create_candidate(NewCoverCandidate {
+            candidate_id: input.candidate_id,
+            release_id: input.release_id,
+            disc_number,
+            source_kind: input.source_kind.into(),
+            source_release_revision_db_id,
+            submitted_url: input.submitted_url,
+        })
+        .await
+        .map(Into::into)
+        .map_err(cover_error)
+}
+
+pub async fn queue_candidate(
+    ctx: &Context<'_>,
+    input: QueueCoverCandidateInput,
+) -> Result<CoverCandidateInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    ctx.data::<CoverService>()?
+        .queue_candidate(input.candidate_id, expected, input.not_before)
+        .await
+        .map(Into::into)
+        .map_err(cover_error)
+}
+
+pub async fn reject_candidate(
+    ctx: &Context<'_>,
+    input: RejectCoverCandidateInput,
+) -> Result<CoverCandidateInfo> {
+    let expected = parse_row_version(&input.expected_row_version)?;
+    ctx.data::<CoverService>()?
+        .reject_candidate(input.candidate_id, expected, input.reason_code)
+        .await
+        .map(Into::into)
+        .map_err(cover_error)
+}
+
+pub async fn select_cover(
+    ctx: &Context<'_>,
+    input: SelectCoverInput,
+) -> Result<CoverSelectionInfo> {
+    let disc_number = parse_disc_number(input.disc_number)?;
+    let expected_row_version = input
+        .expected_row_version
+        .as_deref()
+        .map(parse_row_version)
+        .transpose()?;
+    ctx.data::<CoverService>()?
+        .select_cover(SelectCover {
+            release_id: input.release_id,
+            disc_number,
+            candidate_id: input.candidate_id,
+            expected_row_version,
+        })
+        .await
+        .map(Into::into)
+        .map_err(cover_error)
+}
+
+fn parse_disc_number(value: i32) -> Result<u16> {
+    u16::try_from(value)
+        .ok()
+        .filter(|value| *value <= i16::MAX as u16)
+        .ok_or_else(|| {
+            input_error(
+                "COVER_INVALID_DISC_NUMBER",
+                "disc number must be between 0 and 32767",
+            )
+        })
+}
+
+fn parse_source_revision_id(value: i32) -> Result<i32> {
+    (value > 0).then_some(value).ok_or_else(|| {
+        input_error(
+            "COVER_INVALID_SOURCE_REVISION",
+            "source release revision id must be positive",
+        )
+    })
+}
+
+fn parse_row_version(value: &str) -> Result<CoverRowVersion> {
+    value
+        .parse::<u64>()
+        .ok()
+        .and_then(CoverRowVersion::new)
+        .ok_or_else(|| {
+            input_error(
+                "COVER_INVALID_ROW_VERSION",
+                "row version must be a positive base-10 integer",
+            )
+        })
+}
+
+fn input_error(code: &'static str, message: impl Into<String>) -> Error {
+    Error::new(message).extend_with(|_, extensions| extensions.set("code", code))
+}
+
+fn cover_error(error: CoverError) -> Error {
+    match error {
+        CoverError::ReleaseNotFound { release_id } => {
+            entity_error("COVER_RELEASE_NOT_FOUND", "releaseId", release_id)
+        }
+        CoverError::CandidateAlreadyExists { candidate_id } => entity_error(
+            "COVER_CANDIDATE_ALREADY_EXISTS",
+            "candidateId",
+            candidate_id,
+        ),
+        CoverError::CandidateNotFound { candidate_id } => {
+            entity_error("COVER_CANDIDATE_NOT_FOUND", "candidateId", candidate_id)
+        }
+        CoverError::CandidateConflict {
+            candidate_id,
+            expected,
+            actual,
+        } => conflict_error(
+            "COVER_CANDIDATE_CONFLICT",
+            "candidateId",
+            candidate_id,
+            expected,
+            actual,
+        ),
+        CoverError::InvalidCandidateTransition {
+            candidate_id,
+            from,
+            to,
+        } => Error::new(format!(
+            "cover candidate {candidate_id} cannot transition from {from} to {to}"
+        ))
+        .extend_with(|_, extensions| {
+            extensions.set("code", "COVER_INVALID_TRANSITION");
+            extensions.set("candidateId", candidate_id.to_string());
+            extensions.set("from", from.as_str());
+            extensions.set("to", to.as_str());
+        }),
+        CoverError::CandidateNotVerified { candidate_id } => {
+            entity_error("COVER_CANDIDATE_NOT_VERIFIED", "candidateId", candidate_id)
+        }
+        CoverError::CandidateScopeMismatch {
+            candidate_id,
+            expected_release_id,
+            expected_disc_number,
+            actual_release_id,
+            actual_disc_number,
+        } => Error::new("cover candidate belongs to a different release or disc").extend_with(
+            |_, extensions| {
+                extensions.set("code", "COVER_CANDIDATE_SCOPE_MISMATCH");
+                extensions.set("candidateId", candidate_id.to_string());
+                extensions.set("expectedReleaseId", expected_release_id.to_string());
+                extensions.set("expectedDiscNumber", i32::from(expected_disc_number));
+                extensions.set("actualReleaseId", actual_release_id.to_string());
+                extensions.set("actualDiscNumber", i32::from(actual_disc_number));
+            },
+        ),
+        CoverError::SelectionAlreadyExists {
+            release_id,
+            disc_number,
+        } => selection_error("COVER_SELECTION_ALREADY_EXISTS", release_id, disc_number),
+        CoverError::SelectionNotFound {
+            release_id,
+            disc_number,
+        } => selection_error("COVER_SELECTION_NOT_FOUND", release_id, disc_number),
+        CoverError::SelectionConflict {
+            release_id,
+            disc_number,
+            expected,
+            actual,
+        } => Error::new("COVER_SELECTION_CONFLICT").extend_with(|_, extensions| {
+            extensions.set("code", "COVER_SELECTION_CONFLICT");
+            extensions.set("releaseId", release_id.to_string());
+            extensions.set("discNumber", i32::from(disc_number));
+            extensions.set("expectedRowVersion", expected.to_string());
+            extensions.set("actualRowVersion", actual.to_string());
+        }),
+        CoverError::InvalidUrl(_) => input_error("COVER_INVALID_URL", "cover URL is invalid"),
+        CoverError::InvalidInput { field, message } => {
+            Error::new(message).extend_with(|_, extensions| {
+                extensions.set("code", "COVER_INVALID_INPUT");
+                extensions.set("field", field);
+            })
+        }
+        CoverError::NumericOutOfRange { field, .. } => Error::new("numeric value is out of range")
+            .extend_with(|_, extensions| {
+                extensions.set("code", "COVER_INVALID_NUMBER");
+                extensions.set("field", field);
+            }),
+        error @ (CoverError::LeaseMismatch { .. }
+        | CoverError::CandidateAssetMissing { .. }
+        | CoverError::InvalidPersistedValue { .. }
+        | CoverError::AssetDigestConflict { .. }
+        | CoverError::Database(_)) => {
+            tracing::error!(error = ?error, "cover operation failed internally");
+            Error::new("cover operation failed")
+                .extend_with(|_, extensions| extensions.set("code", "COVER_INTERNAL"))
+        }
+    }
+}
+
+fn entity_error(code: &'static str, id_field: &'static str, id: Uuid) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set(id_field, id.to_string());
+    })
+}
+
+fn conflict_error(
+    code: &'static str,
+    id_field: &'static str,
+    id: Uuid,
+    expected: CoverRowVersion,
+    actual: CoverRowVersion,
+) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set(id_field, id.to_string());
+        extensions.set("expectedRowVersion", expected.to_string());
+        extensions.set("actualRowVersion", actual.to_string());
+    })
+}
+
+fn selection_error(code: &'static str, release_id: Uuid, disc_number: u16) -> Error {
+    Error::new(code).extend_with(|_, extensions| {
+        extensions.set("code", code);
+        extensions.set("releaseId", release_id.to_string());
+        extensions.set("discNumber", i32::from(disc_number));
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::num::NonZeroU32;
+
+    use anni_ingest::Digest;
+
+    use super::*;
+
+    #[test]
+    fn browser_types_are_lossless_without_leaking_the_submitted_url() {
+        let timestamp = DateTime::<Utc>::from_timestamp(1_700_000_000, 0).unwrap();
+        let digest = Digest::new([0xab; 32]);
+        let asset = CoverAssetSnapshot {
+            asset_id: Uuid::new_v4(),
+            content_sha256: digest,
+            storage_key: "private/storage/key.jpg".to_owned(),
+            media_type: CoverMediaType::Jpeg,
+            width: NonZeroU32::new(u32::MAX).unwrap(),
+            height: NonZeroU32::new(1).unwrap(),
+            byte_length: u64::MAX,
+            fetched_at: timestamp,
+            verified_at: timestamp,
+            created_at: timestamp,
+        };
+        let candidate = CoverCandidateInfo::from(CoverCandidateSnapshot {
+            candidate_id: Uuid::new_v4(),
+            release_id: Uuid::new_v4(),
+            disc_number: 1,
+            source_kind: CoverSourceKind::ArtistWebsite,
+            source_release_revision_db_id: Some(7),
+            state: CoverCandidateState::Verified,
+            asset: Some(asset),
+            has_remote_url: true,
+            attempt_count: u32::MAX,
+            next_attempt_at: None,
+            last_http_status: Some(200),
+            last_error_code: None,
+            fetched_at: Some(timestamp),
+            row_version: CoverRowVersion::new(u64::MAX).unwrap(),
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+
+        let asset = candidate.asset.unwrap();
+        assert_eq!(asset.content_sha256, "ab".repeat(32));
+        assert_eq!(asset.width, u32::MAX.to_string());
+        assert_eq!(asset.byte_length, u64::MAX.to_string());
+        assert_eq!(candidate.attempt_count, u32::MAX.to_string());
+        assert_eq!(candidate.row_version, u64::MAX.to_string());
+        assert!(!format!("{asset:?}").contains("private/storage"));
+
+        let submitted_url = "https://example.invalid/cover.jpg?token=secret".to_owned();
+        let input = AddCoverCandidateInput {
+            candidate_id: None,
+            release_id: Uuid::new_v4(),
+            disc_number: 0,
+            source_kind: CoverSource::Manual,
+            source_release_revision_db_id: None,
+            submitted_url: submitted_url.clone(),
+        };
+        let debug = format!("{input:?}");
+        assert!(!debug.contains(&submitted_url));
+        assert!(!debug.contains("token=secret"));
+        assert!(debug.contains("[REDACTED]"));
+    }
+
+    #[test]
+    fn graphql_number_parsers_reject_lossy_or_invalid_values() {
+        assert_eq!(parse_disc_number(0).unwrap(), 0);
+        assert_eq!(parse_disc_number(i16::MAX.into()).unwrap(), i16::MAX as u16);
+        assert!(parse_disc_number(-1).is_err());
+        assert!(parse_disc_number(i32::from(i16::MAX) + 1).is_err());
+        assert!(parse_source_revision_id(0).is_err());
+        assert!(parse_row_version("18446744073709551615").is_ok());
+        assert!(parse_row_version("0").is_err());
+        assert!(parse_row_version("01x").is_err());
+    }
+}
diff --git a/annim/src/graphql/ingest.rs b/annim/src/graphql/ingest.rs
new file mode 100644
index 00000000..6ef76c0a
--- /dev/null
+++ b/annim/src/graphql/ingest.rs
@@ -0,0 +1,457 @@
+use anni_ingest::{Digest, JobError, JobState, MetadataError, MetadataRevision};
+use async_graphql::{
+    Context, Enum, Error, ErrorExtensions, InputObject, OneofObject, Result, SimpleObject,
+};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+use tokio_stream::{
+    wrappers::{errors::BroadcastStreamRecvError, BroadcastStream},
+    Stream, StreamExt,
+};
+
+use crate::ingest::{
+    IngestCommand, IngestRepositoryError, IngestService, IngestServiceError, RowVersion,
+    VersionedIngestJob,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestJobState {
+    Created,
+    Reviewing,
+    Planned,
+    Executing,
+    Verifying,
+    ReadyToCommit,
+    Committing,
+    Published,
+    Quarantined,
+    Cancelled,
+}
+
+impl From<JobState> for IngestJobState {
+    fn from(state: JobState) -> Self {
+        match state {
+            JobState::Created => Self::Created,
+            JobState::Reviewing => Self::Reviewing,
+            JobState::Planned => Self::Planned,
+            JobState::Executing => Self::Executing,
+            JobState::Verifying => Self::Verifying,
+            JobState::ReadyToCommit => Self::ReadyToCommit,
+            JobState::Committing => Self::Committing,
+            JobState::Published => Self::Published,
+            JobState::Quarantined => Self::Quarantined,
+            JobState::Cancelled => Self::Cancelled,
+        }
+    }
+}
+
+impl From<IngestJobState> for JobState {
+    fn from(state: IngestJobState) -> Self {
+        match state {
+            IngestJobState::Created => Self::Created,
+            IngestJobState::Reviewing => Self::Reviewing,
+            IngestJobState::Planned => Self::Planned,
+            IngestJobState::Executing => Self::Executing,
+            IngestJobState::Verifying => Self::Verifying,
+            IngestJobState::ReadyToCommit => Self::ReadyToCommit,
+            IngestJobState::Committing => Self::Committing,
+            IngestJobState::Published => Self::Published,
+            IngestJobState::Quarantined => Self::Quarantined,
+            IngestJobState::Cancelled => Self::Cancelled,
+        }
+    }
+}
+
+/// String-encoded counters avoid JavaScript's integer precision limit.
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestJobInfo {
+    job_id: Uuid,
+    state: IngestJobState,
+    metadata_revision: String,
+    approved_revision: Option<String>,
+    manifest_digest: Option<String>,
+    plan_digest: Option<String>,
+    verification_digest: Option<String>,
+    row_version: String,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<VersionedIngestJob> for IngestJobInfo {
+    fn from(versioned: VersionedIngestJob) -> Self {
+        let snapshot = versioned.job().snapshot();
+        Self {
+            job_id: snapshot.id(),
+            state: snapshot.state().into(),
+            metadata_revision: snapshot.metadata_revision().to_string(),
+            approved_revision: snapshot
+                .approved_revision()
+                .map(|revision| revision.to_string()),
+            manifest_digest: snapshot.manifest_digest().map(|digest| digest.to_string()),
+            plan_digest: snapshot.plan_digest().map(|digest| digest.to_string()),
+            verification_digest: snapshot
+                .verification_digest()
+                .map(|digest| digest.to_string()),
+            row_version: versioned.row_version().to_string(),
+            created_at: versioned.created_at(),
+            updated_at: versioned.updated_at(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestCommandSignal {
+    Execute,
+}
+
+#[derive(Debug, InputObject)]
+pub struct IngestRevisionCommandInput {
+    expected_revision: String,
+}
+
+#[derive(Debug, InputObject)]
+pub struct IngestCreatePlanCommandInput {
+    expected_revision: String,
+    manifest_digest: String,
+    plan_digest: String,
+}
+
+#[derive(Debug, InputObject)]
+pub struct IngestPlanCommandInput {
+    plan_digest: String,
+}
+
+#[derive(Debug, InputObject)]
+pub struct IngestVerificationCommandInput {
+    plan_digest: String,
+    verification_digest: String,
+}
+
+#[derive(Debug, OneofObject)]
+pub enum IngestJobCommandInput {
+    BeginReview(IngestCommandSignal),
+    ApproveRevision(IngestRevisionCommandInput),
+    ReviseMetadata(IngestRevisionCommandInput),
+    CreatePlan(IngestCreatePlanCommandInput),
+    BeginExecution(IngestPlanCommandInput),
+    BeginVerification(IngestPlanCommandInput),
+    AcceptVerification(IngestVerificationCommandInput),
+    BeginCommit(IngestVerificationCommandInput),
+    Publish(IngestVerificationCommandInput),
+    Quarantine(IngestCommandSignal),
+    Cancel(IngestCommandSignal),
+}
+
+#[derive(Debug, InputObject)]
+pub struct ExecuteIngestJobCommandInput {
+    job_id: Uuid,
+    expected_row_version: String,
+    command: IngestJobCommandInput,
+}
+
+impl TryFrom<IngestJobCommandInput> for IngestCommand {
+    type Error = Error;
+
+    fn try_from(input: IngestJobCommandInput) -> Result<Self> {
+        match input {
+            IngestJobCommandInput::BeginReview(_) => Ok(Self::BeginReview),
+            IngestJobCommandInput::ApproveRevision(input) => Ok(Self::ApproveRevision {
+                expected_revision: parse_revision(&input.expected_revision)?,
+            }),
+            IngestJobCommandInput::ReviseMetadata(input) => Ok(Self::ReviseMetadata {
+                expected_revision: parse_revision(&input.expected_revision)?,
+            }),
+            IngestJobCommandInput::CreatePlan(input) => Ok(Self::CreatePlan {
+                expected_revision: parse_revision(&input.expected_revision)?,
+                manifest_digest: parse_digest(&input.manifest_digest)?,
+                plan_digest: parse_digest(&input.plan_digest)?,
+            }),
+            IngestJobCommandInput::BeginExecution(input) => Ok(Self::BeginExecution {
+                plan_digest: parse_digest(&input.plan_digest)?,
+            }),
+            IngestJobCommandInput::BeginVerification(input) => Ok(Self::BeginVerification {
+                plan_digest: parse_digest(&input.plan_digest)?,
+            }),
+            IngestJobCommandInput::AcceptVerification(input) => Ok(Self::AcceptVerification {
+                plan_digest: parse_digest(&input.plan_digest)?,
+                verification_digest: parse_digest(&input.verification_digest)?,
+            }),
+            IngestJobCommandInput::BeginCommit(input) => Ok(Self::BeginCommit {
+                plan_digest: parse_digest(&input.plan_digest)?,
+                verification_digest: parse_digest(&input.verification_digest)?,
+            }),
+            IngestJobCommandInput::Publish(input) => Ok(Self::Publish {
+                plan_digest: parse_digest(&input.plan_digest)?,
+                verification_digest: parse_digest(&input.verification_digest)?,
+            }),
+            IngestJobCommandInput::Quarantine(_) => Ok(Self::Quarantine),
+            IngestJobCommandInput::Cancel(_) => Ok(Self::Cancel),
+        }
+    }
+}
+
+pub async fn query_job(ctx: &Context<'_>, job_id: Uuid) -> Result<Option<IngestJobInfo>> {
+    let service = ctx.data::<IngestService>()?;
+    service
+        .get(job_id)
+        .await
+        .map(|job| job.map(Into::into))
+        .map_err(service_error)
+}
+
+pub async fn query_jobs(
+    ctx: &Context<'_>,
+    state: Option<IngestJobState>,
+    limit: i32,
+    offset: i32,
+) -> Result<Vec<IngestJobInfo>> {
+    if !(1..=200).contains(&limit) || offset < 0 {
+        return Err(input_error(
+            "INGEST_INVALID_PAGINATION",
+            "limit must be between 1 and 200 and offset must be non-negative",
+        ));
+    }
+
+    let service = ctx.data::<IngestService>()?;
+    service
+        .list(
+            state.map(Into::into),
+            u64::try_from(limit).expect("positive i32 fits u64"),
+            u64::try_from(offset).expect("non-negative i32 fits u64"),
+        )
+        .await
+        .map(|jobs| jobs.into_iter().map(Into::into).collect())
+        .map_err(service_error)
+}
+
+pub async fn create_job(ctx: &Context<'_>, job_id: Option<Uuid>) -> Result<IngestJobInfo> {
+    let service = ctx.data::<IngestService>()?;
+    service
+        .create(job_id)
+        .await
+        .map(Into::into)
+        .map_err(service_error)
+}
+
+pub async fn execute_command(
+    ctx: &Context<'_>,
+    input: ExecuteIngestJobCommandInput,
+) -> Result<IngestJobInfo> {
+    let row_version = parse_row_version(&input.expected_row_version)?;
+    let command = input.command.try_into()?;
+    let service = ctx.data::<IngestService>()?;
+    service
+        .execute(input.job_id, row_version, command)
+        .await
+        .map(Into::into)
+        .map_err(service_error)
+}
+
+pub fn subscribe_jobs(
+    ctx: &Context<'_>,
+    job_id: Option<Uuid>,
+    after_row_version: Option<String>,
+) -> Result<impl Stream<Item = Result<IngestJobInfo>> + use<>> {
+    let after_row_version = after_row_version
+        .as_deref()
+        .map(parse_row_version)
+        .transpose()?;
+    let receiver = ctx.data::<IngestService>()?.subscribe();
+
+    Ok(
+        BroadcastStream::new(receiver).filter_map(move |event| match event {
+            Ok(event) => {
+                let versioned = event.job();
+                let matches_job = job_id.is_none_or(|job_id| versioned.job().id() == job_id);
+                let is_newer = after_row_version
+                    .is_none_or(|row_version| versioned.row_version() > row_version);
+                (matches_job && is_newer).then(|| Ok(versioned.clone().into()))
+            }
+            Err(BroadcastStreamRecvError::Lagged(skipped)) => Some(Err(Error::new(format!(
+            "ingest event stream fell behind by {skipped} updates; query the current job snapshot"
+        ))
+            .extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_EVENT_LAGGED");
+                extensions.set("skipped", skipped.to_string());
+            }))),
+        }),
+    )
+}
+
+pub(super) fn parse_revision(value: &str) -> Result<MetadataRevision> {
+    let revision = value.parse::<u64>().map_err(|_| {
+        input_error(
+            "INGEST_INVALID_REVISION",
+            "metadata revision must be a positive base-10 integer",
+        )
+    })?;
+    MetadataRevision::new(revision).ok_or_else(|| {
+        input_error(
+            "INGEST_INVALID_REVISION",
+            "metadata revision must be greater than zero",
+        )
+    })
+}
+
+pub(super) fn parse_row_version(value: &str) -> Result<RowVersion> {
+    let version = value.parse::<u64>().map_err(|_| {
+        input_error(
+            "INGEST_INVALID_ROW_VERSION",
+            "row version must be a positive base-10 integer",
+        )
+    })?;
+    RowVersion::new(version).ok_or_else(|| {
+        input_error(
+            "INGEST_INVALID_ROW_VERSION",
+            "row version must be greater than zero",
+        )
+    })
+}
+
+fn parse_digest(value: &str) -> Result<Digest> {
+    value.parse().map_err(|error| {
+        input_error(
+            "INGEST_INVALID_DIGEST",
+            format!("invalid content digest: {error}"),
+        )
+    })
+}
+
+pub(super) fn input_error(code: &'static str, message: impl Into<String>) -> Error {
+    Error::new(message).extend_with(|_, extensions| extensions.set("code", code))
+}
+
+pub(super) fn service_error(error: IngestServiceError) -> Error {
+    match error {
+        IngestServiceError::Repository(IngestRepositoryError::AlreadyExists { job_id }) => {
+            Error::new(format!("ingest job {job_id} already exists")).extend_with(
+                |_, extensions| {
+                    extensions.set("code", "INGEST_JOB_ALREADY_EXISTS");
+                    extensions.set("jobId", job_id.to_string());
+                },
+            )
+        }
+        IngestServiceError::Repository(IngestRepositoryError::NotFound { job_id }) => {
+            Error::new(format!("ingest job {job_id} was not found")).extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_JOB_NOT_FOUND");
+                extensions.set("jobId", job_id.to_string());
+            })
+        }
+        IngestServiceError::Repository(IngestRepositoryError::ConcurrentModification {
+            job_id,
+            expected,
+            actual,
+        }) => Error::new(format!("ingest job {job_id} changed concurrently")).extend_with(
+            |_, extensions| {
+                extensions.set("code", "INGEST_JOB_CONFLICT");
+                extensions.set("jobId", job_id.to_string());
+                extensions.set("expectedRowVersion", expected.to_string());
+                extensions.set("actualRowVersion", actual.to_string());
+            },
+        ),
+        IngestServiceError::Repository(IngestRepositoryError::MetadataFrozen {
+            job_id,
+            revision,
+        }) => Error::new(format!(
+            "metadata revision {revision} for ingest job {job_id} is frozen"
+        ))
+        .extend_with(|_, extensions| {
+            extensions.set("code", "INGEST_METADATA_FROZEN");
+            extensions.set("jobId", job_id.to_string());
+            extensions.set("revision", revision.to_string());
+        }),
+        IngestServiceError::Repository(IngestRepositoryError::MetadataNotFound {
+            job_id,
+            revision,
+        }) => Error::new(format!(
+            "metadata revision {revision} for ingest job {job_id} was not found"
+        ))
+        .extend_with(|_, extensions| {
+            extensions.set("code", "INGEST_METADATA_NOT_FOUND");
+            extensions.set("jobId", job_id.to_string());
+            extensions.set("revision", revision.to_string());
+        }),
+        IngestServiceError::Repository(
+            error @ (IngestRepositoryError::InvalidMetadataDigestLength { .. }
+            | IngestRepositoryError::MetadataDigestMismatch { .. }
+            | IngestRepositoryError::InvalidMetadataDocument { .. }
+            | IngestRepositoryError::InvalidPersistedMetadata { .. }
+            | IngestRepositoryError::MetadataDocumentRevisionMismatch { .. }),
+        ) => {
+            tracing::error!(error = ?error, "persisted ingest metadata is corrupt");
+            Error::new("persisted ingest metadata is corrupt")
+                .extend_with(|_, extensions| extensions.set("code", "INGEST_METADATA_CORRUPT"))
+        }
+        IngestServiceError::Domain(JobError::InvalidTransition { state, operation }) => Error::new(
+            format!("cannot {operation} while ingest job is {state}"),
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "INGEST_INVALID_TRANSITION");
+            extensions.set("state", state.as_str());
+            extensions.set("operation", operation.to_string());
+        }),
+        IngestServiceError::Domain(JobError::RevisionConflict { expected, actual }) => Error::new(
+            format!("metadata revision conflict: expected {expected}, actual {actual}"),
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "INGEST_METADATA_REVISION_CONFLICT");
+            extensions.set("expectedRevision", expected.to_string());
+            extensions.set("actualRevision", actual.to_string());
+        }),
+        IngestServiceError::Metadata(MetadataError::UnknownCandidate { id }) => Error::new(
+            format!("metadata candidate {id} was not found"),
+        )
+        .extend_with(|_, extensions| {
+            extensions.set("code", "INGEST_METADATA_CANDIDATE_NOT_FOUND");
+            extensions.set("candidateId", id.to_string());
+        }),
+        IngestServiceError::Metadata(MetadataError::FieldOutsideAlbumLayout { field }) => {
+            Error::new(format!(
+                "metadata field {field:?} falls outside the configured album layout"
+            ))
+            .extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_METADATA_INVALID_FIELD");
+                extensions.set("field", format!("{field:?}"));
+            })
+        }
+        IngestServiceError::Metadata(error @ MetadataError::ValueKindMismatch { .. }) => {
+            Error::new(error.to_string()).extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_METADATA_INVALID_VALUE")
+            })
+        }
+        IngestServiceError::Metadata(error @ MetadataError::EvidenceMethodMismatch { .. }) => {
+            Error::new(error.to_string()).extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_METADATA_INVALID_EVIDENCE")
+            })
+        }
+        IngestServiceError::Metadata(MetadataError::ReviewContextMissing) => Error::new(
+            "metadata review context has not been configured",
+        )
+        .extend_with(|_, extensions| extensions.set("code", "INGEST_METADATA_CONTEXT_REQUIRED")),
+        IngestServiceError::Metadata(error) => Error::new(error.to_string())
+            .extend_with(|_, extensions| extensions.set("code", "INGEST_METADATA_INVALID")),
+        IngestServiceError::MetadataIncomplete { missing } => {
+            let missing_fields = missing
+                .iter()
+                .map(|field| format!("{field:?}"))
+                .collect::<Vec<_>>()
+                .join(",");
+            Error::new(format!(
+                "metadata revision is incomplete: {} required fields are missing",
+                missing.len()
+            ))
+            .extend_with(|_, extensions| {
+                extensions.set("code", "INGEST_METADATA_INCOMPLETE");
+                extensions.set("missingCount", missing.len().to_string());
+                extensions.set("missingFields", missing_fields);
+            })
+        }
+        IngestServiceError::Domain(error) => Error::new(error.to_string())
+            .extend_with(|_, extensions| extensions.set("code", "INGEST_INVALID_COMMAND")),
+        internal => {
+            tracing::error!(error = ?internal, "ingest service request failed");
+            Error::new("internal ingest service error")
+                .extend_with(|_, extensions| extensions.set("code", "INTERNAL"))
+        }
+    }
+}
diff --git a/annim/src/graphql/ingest_metadata.rs b/annim/src/graphql/ingest_metadata.rs
new file mode 100644
index 00000000..a547efae
--- /dev/null
+++ b/annim/src/graphql/ingest_metadata.rs
@@ -0,0 +1,913 @@
+//! Strongly typed GraphQL boundary for metadata evidence and review.
+//!
+//! Inputs are converted into `anni-ingest` domain values before persistence.
+//! Metadata text is copied exactly; validation never trims or normalizes it.
+
+use std::{collections::BTreeMap, num::NonZeroU16, str::FromStr};
+
+use anni_ingest::{
+    AlbumField, AlbumLayout, Confidence, DiscField, Evidence, EvidenceMethod, EvidenceSourceKind,
+    FieldPath, MetadataCandidate, MetadataDecision, MetadataDraft, MetadataError, MetadataProfile,
+    MetadataReviewContext, MetadataValue, TrackField,
+};
+use anni_metadata::model::{AnniDate, TrackType};
+use async_graphql::{
+    Context, Enum, Error, ErrorExtensions, InputObject, OneofObject, Result, SimpleObject,
+};
+use chrono::{DateTime, Utc};
+use sea_orm::prelude::Uuid;
+
+use crate::ingest::{
+    IngestCommand, IngestMetadataReview, IngestService, MetadataEdit, PersistedMetadataDraft,
+};
+
+use super::ingest::{input_error, parse_revision, parse_row_version, service_error, IngestJobInfo};
+
+const MAX_DISCS_PER_REVIEW: usize = 100;
+const MAX_TOTAL_TRACKS_PER_REVIEW: u32 = 10_000;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataProfile {
+    Cd,
+    Streaming,
+}
+
+impl From<IngestMetadataProfile> for MetadataProfile {
+    fn from(value: IngestMetadataProfile) -> Self {
+        match value {
+            IngestMetadataProfile::Cd => Self::Cd,
+            IngestMetadataProfile::Streaming => Self::Streaming,
+        }
+    }
+}
+
+impl From<MetadataProfile> for IngestMetadataProfile {
+    fn from(value: MetadataProfile) -> Self {
+        match value {
+            MetadataProfile::Cd => Self::Cd,
+            MetadataProfile::Streaming => Self::Streaming,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataFieldScope {
+    Album,
+    Disc,
+    Track,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataFieldName {
+    Title,
+    Edition,
+    Artist,
+    Artists,
+    ReleaseDate,
+    TrackType,
+    Catalog,
+    Tags,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestMetadataFieldInput {
+    scope: IngestMetadataFieldScope,
+    disc: Option<i32>,
+    track: Option<i32>,
+    field: IngestMetadataFieldName,
+}
+
+impl TryFrom<IngestMetadataFieldInput> for FieldPath {
+    type Error = Error;
+
+    fn try_from(input: IngestMetadataFieldInput) -> Result<Self> {
+        match input.scope {
+            IngestMetadataFieldScope::Album => {
+                if input.disc.is_some() || input.track.is_some() {
+                    return Err(invalid_field("album fields cannot include disc or track"));
+                }
+                album_field(input.field)
+                    .map(FieldPath::Album)
+                    .ok_or_else(|| invalid_field("field is not valid at album scope"))
+            }
+            IngestMetadataFieldScope::Disc => {
+                if input.track.is_some() {
+                    return Err(invalid_field("disc fields cannot include a track"));
+                }
+                let disc = parse_position("disc", input.disc)?;
+                let field = disc_field(input.field)
+                    .ok_or_else(|| invalid_field("field is not valid at disc scope"))?;
+                Ok(FieldPath::Disc { disc, field })
+            }
+            IngestMetadataFieldScope::Track => {
+                let disc = parse_position("disc", input.disc)?;
+                let track = parse_position("track", input.track)?;
+                let field = track_field(input.field)
+                    .ok_or_else(|| invalid_field("field is not valid at track scope"))?;
+                Ok(FieldPath::Track { disc, track, field })
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataFieldInfo {
+    scope: IngestMetadataFieldScope,
+    disc: Option<i32>,
+    track: Option<i32>,
+    field: IngestMetadataFieldName,
+}
+
+impl From<FieldPath> for IngestMetadataFieldInfo {
+    fn from(value: FieldPath) -> Self {
+        match value {
+            FieldPath::Album(field) => Self {
+                scope: IngestMetadataFieldScope::Album,
+                disc: None,
+                track: None,
+                field: album_field_name(field),
+            },
+            FieldPath::Disc { disc, field } => Self {
+                scope: IngestMetadataFieldScope::Disc,
+                disc: Some(i32::from(disc.get())),
+                track: None,
+                field: disc_field_name(field),
+            },
+            FieldPath::Track { disc, track, field } => Self {
+                scope: IngestMetadataFieldScope::Track,
+                disc: Some(i32::from(disc.get())),
+                track: Some(i32::from(track.get())),
+                field: track_field_name(field),
+            },
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataTrackType {
+    Normal,
+    Instrumental,
+    Absolute,
+    Drama,
+    Radio,
+    Vocal,
+}
+
+impl From<IngestMetadataTrackType> for TrackType {
+    fn from(value: IngestMetadataTrackType) -> Self {
+        match value {
+            IngestMetadataTrackType::Normal => Self::Normal,
+            IngestMetadataTrackType::Instrumental => Self::Instrumental,
+            IngestMetadataTrackType::Absolute => Self::Absolute,
+            IngestMetadataTrackType::Drama => Self::Drama,
+            IngestMetadataTrackType::Radio => Self::Radio,
+            IngestMetadataTrackType::Vocal => Self::Vocal,
+        }
+    }
+}
+
+impl From<&TrackType> for IngestMetadataTrackType {
+    fn from(value: &TrackType) -> Self {
+        match value {
+            TrackType::Normal => Self::Normal,
+            TrackType::Instrumental => Self::Instrumental,
+            TrackType::Absolute => Self::Absolute,
+            TrackType::Drama => Self::Drama,
+            TrackType::Radio => Self::Radio,
+            TrackType::Vocal => Self::Vocal,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestMetadataTextListInput {
+    values: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestMetadataTextMapEntryInput {
+    key: String,
+    value: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestMetadataTextMapInput {
+    entries: Vec<IngestMetadataTextMapEntryInput>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataAbsentSignal {
+    Use,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, OneofObject)]
+pub enum IngestMetadataValueInput {
+    Text(String),
+    Date(String),
+    TrackType(IngestMetadataTrackType),
+    TextList(IngestMetadataTextListInput),
+    TextMap(IngestMetadataTextMapInput),
+    Absent(IngestMetadataAbsentSignal),
+}
+
+impl TryFrom<IngestMetadataValueInput> for MetadataValue {
+    type Error = Error;
+
+    fn try_from(input: IngestMetadataValueInput) -> Result<Self> {
+        match input {
+            IngestMetadataValueInput::Text(value) => Ok(Self::Text(value)),
+            IngestMetadataValueInput::Date(value) => {
+                let valid_shape = matches!(value.len(), 4 | 7 | 10)
+                    && value.split('-').enumerate().all(|(index, part)| {
+                        part.len() == if index == 0 { 4 } else { 2 }
+                            && part.bytes().all(|byte| byte.is_ascii_digit())
+                    })
+                    && value.as_bytes().get(4).is_none_or(|byte| *byte == b'-')
+                    && value.as_bytes().get(7).is_none_or(|byte| *byte == b'-');
+                if !valid_shape {
+                    return Err(input_error(
+                        "INGEST_METADATA_INVALID_VALUE",
+                        "date must use YYYY, YYYY-MM, or YYYY-MM-DD",
+                    ));
+                }
+                let date = AnniDate::from_str(&value).map_err(|_| {
+                    input_error(
+                        "INGEST_METADATA_INVALID_VALUE",
+                        "date must use YYYY, YYYY-MM, or YYYY-MM-DD",
+                    )
+                })?;
+                validate_date(&date)?;
+                Ok(Self::Date(date))
+            }
+            IngestMetadataValueInput::TrackType(value) => Ok(Self::TrackType(value.into())),
+            IngestMetadataValueInput::TextList(input) => Ok(Self::TextList(input.values)),
+            IngestMetadataValueInput::TextMap(input) => {
+                let mut values = BTreeMap::new();
+                for entry in input.entries {
+                    if values.insert(entry.key.clone(), entry.value).is_some() {
+                        return Err(input_error(
+                            "INGEST_METADATA_INVALID_VALUE",
+                            format!("text map contains duplicate key {:?}", entry.key),
+                        ));
+                    }
+                }
+                Ok(Self::TextMap(values))
+            }
+            IngestMetadataValueInput::Absent(_) => Ok(Self::Absent),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataValueKind {
+    Text,
+    Date,
+    TrackType,
+    TextList,
+    TextMap,
+    Absent,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataTextMapEntry {
+    key: String,
+    value: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataValueInfo {
+    kind: IngestMetadataValueKind,
+    text: Option<String>,
+    date: Option<String>,
+    track_type: Option<IngestMetadataTrackType>,
+    text_list: Vec<String>,
+    text_map: Vec<IngestMetadataTextMapEntry>,
+}
+
+impl From<&MetadataValue> for IngestMetadataValueInfo {
+    fn from(value: &MetadataValue) -> Self {
+        let mut result = Self {
+            kind: IngestMetadataValueKind::Absent,
+            text: None,
+            date: None,
+            track_type: None,
+            text_list: Vec::new(),
+            text_map: Vec::new(),
+        };
+        match value {
+            MetadataValue::Text(value) => {
+                result.kind = IngestMetadataValueKind::Text;
+                result.text = Some(value.clone());
+            }
+            MetadataValue::Date(value) => {
+                result.kind = IngestMetadataValueKind::Date;
+                result.date = Some(value.to_string());
+            }
+            MetadataValue::TrackType(value) => {
+                result.kind = IngestMetadataValueKind::TrackType;
+                result.track_type = Some(value.into());
+            }
+            MetadataValue::TextList(values) => {
+                result.kind = IngestMetadataValueKind::TextList;
+                result.text_list.clone_from(values);
+            }
+            MetadataValue::TextMap(values) => {
+                result.kind = IngestMetadataValueKind::TextMap;
+                result.text_map = values
+                    .iter()
+                    .map(|(key, value)| IngestMetadataTextMapEntry {
+                        key: key.clone(),
+                        value: value.clone(),
+                    })
+                    .collect();
+            }
+            MetadataValue::Absent => {}
+        }
+        result
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestEvidenceSourceKind {
+    CdBooklet,
+    CdPackaging,
+    OfficialLabel,
+    OfficialArtist,
+    OfficialStore,
+    StreamingService,
+    Vgmdb,
+    CommunitySource,
+    Filename,
+    DerivedInference,
+}
+
+impl From<IngestEvidenceSourceKind> for EvidenceSourceKind {
+    fn from(value: IngestEvidenceSourceKind) -> Self {
+        match value {
+            IngestEvidenceSourceKind::CdBooklet => Self::CdBooklet,
+            IngestEvidenceSourceKind::CdPackaging => Self::CdPackaging,
+            IngestEvidenceSourceKind::OfficialLabel => Self::OfficialLabel,
+            IngestEvidenceSourceKind::OfficialArtist => Self::OfficialArtist,
+            IngestEvidenceSourceKind::OfficialStore => Self::OfficialStore,
+            IngestEvidenceSourceKind::StreamingService => Self::StreamingService,
+            IngestEvidenceSourceKind::Vgmdb => Self::Vgmdb,
+            IngestEvidenceSourceKind::CommunitySource => Self::CommunitySource,
+            IngestEvidenceSourceKind::Filename => Self::Filename,
+            IngestEvidenceSourceKind::DerivedInference => Self::DerivedInference,
+        }
+    }
+}
+
+impl From<EvidenceSourceKind> for IngestEvidenceSourceKind {
+    fn from(value: EvidenceSourceKind) -> Self {
+        match value {
+            EvidenceSourceKind::CdBooklet => Self::CdBooklet,
+            EvidenceSourceKind::CdPackaging => Self::CdPackaging,
+            EvidenceSourceKind::OfficialLabel => Self::OfficialLabel,
+            EvidenceSourceKind::OfficialArtist => Self::OfficialArtist,
+            EvidenceSourceKind::OfficialStore => Self::OfficialStore,
+            EvidenceSourceKind::StreamingService => Self::StreamingService,
+            EvidenceSourceKind::Vgmdb => Self::Vgmdb,
+            EvidenceSourceKind::CommunitySource => Self::CommunitySource,
+            EvidenceSourceKind::Filename => Self::Filename,
+            EvidenceSourceKind::DerivedInference => Self::DerivedInference,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestEvidenceMethod {
+    ManualTranscription,
+    AutomatedExtraction,
+    WebImport,
+    Inference,
+}
+
+impl From<IngestEvidenceMethod> for EvidenceMethod {
+    fn from(value: IngestEvidenceMethod) -> Self {
+        match value {
+            IngestEvidenceMethod::ManualTranscription => Self::ManualTranscription,
+            IngestEvidenceMethod::AutomatedExtraction => Self::AutomatedExtraction,
+            IngestEvidenceMethod::WebImport => Self::WebImport,
+            IngestEvidenceMethod::Inference => Self::Inference,
+        }
+    }
+}
+
+impl From<EvidenceMethod> for IngestEvidenceMethod {
+    fn from(value: EvidenceMethod) -> Self {
+        match value {
+            EvidenceMethod::ManualTranscription => Self::ManualTranscription,
+            EvidenceMethod::AutomatedExtraction => Self::AutomatedExtraction,
+            EvidenceMethod::WebImport => Self::WebImport,
+            EvidenceMethod::Inference => Self::Inference,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestEvidenceInput {
+    source_kind: IngestEvidenceSourceKind,
+    locator: String,
+    detail: Option<String>,
+    method: IngestEvidenceMethod,
+}
+
+impl TryFrom<IngestEvidenceInput> for Evidence {
+    type Error = Error;
+
+    fn try_from(input: IngestEvidenceInput) -> Result<Self> {
+        if input.locator.trim().is_empty() {
+            return Err(input_error(
+                "INGEST_METADATA_INVALID_EVIDENCE",
+                "evidence locator cannot be empty",
+            ));
+        }
+        Ok(Self::new(
+            input.source_kind.into(),
+            input.locator,
+            input.detail,
+            input.method.into(),
+        ))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestEvidenceInfo {
+    source_kind: IngestEvidenceSourceKind,
+    locator: String,
+    detail: Option<String>,
+    method: IngestEvidenceMethod,
+}
+
+impl From<&Evidence> for IngestEvidenceInfo {
+    fn from(value: &Evidence) -> Self {
+        Self {
+            source_kind: value.source_kind().into(),
+            locator: value.locator().to_owned(),
+            detail: value.detail().map(str::to_owned),
+            method: value.method().into(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Enum)]
+pub enum IngestMetadataDecision {
+    Pending,
+    Accepted,
+    Rejected,
+}
+
+impl From<MetadataDecision> for IngestMetadataDecision {
+    fn from(value: MetadataDecision) -> Self {
+        match value {
+            MetadataDecision::Pending => Self::Pending,
+            MetadataDecision::Accepted => Self::Accepted,
+            MetadataDecision::Rejected => Self::Rejected,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataCandidateInfo {
+    candidate_id: Uuid,
+    field: IngestMetadataFieldInfo,
+    value: IngestMetadataValueInfo,
+    evidence: IngestEvidenceInfo,
+    confidence_basis_points: i32,
+    decision: IngestMetadataDecision,
+    recommended: bool,
+}
+
+impl IngestMetadataCandidateInfo {
+    fn from_candidate(candidate: &MetadataCandidate, draft: &MetadataDraft) -> Self {
+        Self {
+            candidate_id: candidate.id(),
+            field: candidate.field().into(),
+            value: candidate.value().into(),
+            evidence: candidate.evidence().into(),
+            confidence_basis_points: i32::from(candidate.confidence().basis_points()),
+            decision: draft
+                .decision(candidate.id())
+                .expect("candidate belongs to draft")
+                .into(),
+            recommended: draft
+                .recommendation(candidate.field())
+                .is_some_and(|recommended| recommended.id() == candidate.id()),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataDraftInfo {
+    revision: String,
+    profile: Option<IngestMetadataProfile>,
+    track_counts: Vec<i32>,
+    candidates: Vec<IngestMetadataCandidateInfo>,
+    requirements_configured: bool,
+    total_required: Option<String>,
+    accepted_required: Option<String>,
+    missing_fields: Vec<IngestMetadataFieldInfo>,
+    complete: bool,
+    created_at: DateTime<Utc>,
+    updated_at: DateTime<Utc>,
+}
+
+impl From<&PersistedMetadataDraft> for IngestMetadataDraftInfo {
+    fn from(value: &PersistedMetadataDraft) -> Self {
+        let draft = value.draft();
+        let (profile, track_counts) = draft
+            .review_context()
+            .map(|context| {
+                (
+                    Some(context.profile().into()),
+                    context
+                        .layout()
+                        .track_counts()
+                        .iter()
+                        .map(|count| i32::from(count.get()))
+                        .collect(),
+                )
+            })
+            .unwrap_or_else(|| (None, Vec::new()));
+        let completeness = draft.review_context().map(|context| {
+            let requirements = context.requirements();
+            draft.completeness(&requirements)
+        });
+        let (total_required, accepted_required, missing_fields, complete) = completeness
+            .map(|report| {
+                (
+                    Some(report.total_required().to_string()),
+                    Some(report.accepted_required().to_string()),
+                    report.missing().iter().copied().map(Into::into).collect(),
+                    report.is_complete(),
+                )
+            })
+            .unwrap_or_else(|| (None, None, Vec::new(), false));
+
+        Self {
+            revision: draft.revision().to_string(),
+            profile,
+            track_counts,
+            candidates: draft
+                .candidates()
+                .iter()
+                .map(|candidate| IngestMetadataCandidateInfo::from_candidate(candidate, draft))
+                .collect(),
+            requirements_configured: draft.review_context().is_some(),
+            total_required,
+            accepted_required,
+            missing_fields,
+            complete,
+            created_at: value.created_at(),
+            updated_at: value.updated_at(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, SimpleObject)]
+pub struct IngestMetadataReviewPayload {
+    job: IngestJobInfo,
+    draft: IngestMetadataDraftInfo,
+}
+
+impl From<&IngestMetadataReview> for IngestMetadataReviewPayload {
+    fn from(value: &IngestMetadataReview) -> Self {
+        Self {
+            job: value.job().clone().into(),
+            draft: value.metadata().into(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct ConfigureIngestMetadataReviewInput {
+    profile: IngestMetadataProfile,
+    track_counts: Vec<i32>,
+}
+
+impl TryFrom<ConfigureIngestMetadataReviewInput> for MetadataReviewContext {
+    type Error = Error;
+
+    fn try_from(input: ConfigureIngestMetadataReviewInput) -> Result<Self> {
+        if input.track_counts.is_empty() || input.track_counts.len() > MAX_DISCS_PER_REVIEW {
+            return Err(input_error(
+                "INGEST_METADATA_INVALID_LAYOUT",
+                format!("trackCounts must contain between 1 and {MAX_DISCS_PER_REVIEW} discs"),
+            ));
+        }
+        let mut total_tracks = 0_u32;
+        let mut track_counts = Vec::with_capacity(input.track_counts.len());
+        for count in input.track_counts {
+            let count = u16::try_from(count)
+                .ok()
+                .and_then(NonZeroU16::new)
+                .ok_or_else(|| {
+                    input_error(
+                        "INGEST_METADATA_INVALID_LAYOUT",
+                        "every track count must be between 1 and 65535",
+                    )
+                })?;
+            total_tracks += u32::from(count.get());
+            track_counts.push(count);
+        }
+        if total_tracks > MAX_TOTAL_TRACKS_PER_REVIEW {
+            return Err(input_error(
+                "INGEST_METADATA_INVALID_LAYOUT",
+                format!("album layout cannot exceed {MAX_TOTAL_TRACKS_PER_REVIEW} tracks"),
+            ));
+        }
+        let layout = AlbumLayout::new(track_counts)
+            .map_err(|error| input_error("INGEST_METADATA_INVALID_LAYOUT", error.to_string()))?;
+        Ok(Self::new(input.profile.into(), layout))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct AddIngestMetadataCandidateInput {
+    candidate_id: Option<Uuid>,
+    field: IngestMetadataFieldInput,
+    value: IngestMetadataValueInput,
+    evidence: IngestEvidenceInput,
+    confidence_basis_points: i32,
+}
+
+impl TryFrom<AddIngestMetadataCandidateInput> for MetadataCandidate {
+    type Error = Error;
+
+    fn try_from(input: AddIngestMetadataCandidateInput) -> Result<Self> {
+        let confidence = u16::try_from(input.confidence_basis_points)
+            .ok()
+            .and_then(Confidence::new)
+            .ok_or_else(|| {
+                input_error(
+                    "INGEST_METADATA_INVALID_CONFIDENCE",
+                    "confidenceBasisPoints must be between 0 and 10000",
+                )
+            })?;
+        MetadataCandidate::new(
+            input.candidate_id.unwrap_or_else(Uuid::new_v4),
+            input.field.try_into()?,
+            input.value.try_into()?,
+            input.evidence.try_into()?,
+            confidence,
+        )
+        .map_err(|error| {
+            let code = if matches!(error, MetadataError::EvidenceMethodMismatch { .. }) {
+                "INGEST_METADATA_INVALID_EVIDENCE"
+            } else {
+                "INGEST_METADATA_INVALID_VALUE"
+            };
+            input_error(code, error.to_string())
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, InputObject)]
+pub struct DecideIngestMetadataCandidateInput {
+    candidate_id: Uuid,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, OneofObject)]
+pub enum IngestMetadataEditInput {
+    ConfigureReview(ConfigureIngestMetadataReviewInput),
+    AddCandidate(AddIngestMetadataCandidateInput),
+    AcceptCandidate(DecideIngestMetadataCandidateInput),
+    RejectCandidate(DecideIngestMetadataCandidateInput),
+}
+
+impl TryFrom<IngestMetadataEditInput> for MetadataEdit {
+    type Error = Error;
+
+    fn try_from(input: IngestMetadataEditInput) -> Result<Self> {
+        match input {
+            IngestMetadataEditInput::ConfigureReview(input) => {
+                Ok(Self::ConfigureReview(input.try_into()?))
+            }
+            IngestMetadataEditInput::AddCandidate(input) => {
+                Ok(Self::AddCandidate(input.try_into()?))
+            }
+            IngestMetadataEditInput::AcceptCandidate(input) => {
+                Ok(Self::AcceptCandidate(input.candidate_id))
+            }
+            IngestMetadataEditInput::RejectCandidate(input) => {
+                Ok(Self::RejectCandidate(input.candidate_id))
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct EditIngestMetadataInput {
+    job_id: Uuid,
+    expected_row_version: String,
+    expected_revision: String,
+    edit: IngestMetadataEditInput,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, InputObject)]
+pub struct IngestMetadataRevisionActionInput {
+    job_id: Uuid,
+    expected_row_version: String,
+    expected_revision: String,
+}
+
+pub async fn query_draft(
+    ctx: &Context<'_>,
+    job_id: Uuid,
+    revision: Option<String>,
+) -> Result<Option<IngestMetadataReviewPayload>> {
+    let revision = revision.as_deref().map(parse_revision).transpose()?;
+    let service = ctx.data::<IngestService>()?;
+    service
+        .metadata(job_id, revision)
+        .await
+        .map(|review| review.as_ref().map(Into::into))
+        .map_err(service_error)
+}
+
+pub async fn query_revisions(
+    ctx: &Context<'_>,
+    job_id: Uuid,
+) -> Result<Vec<IngestMetadataDraftInfo>> {
+    let service = ctx.data::<IngestService>()?;
+    service
+        .metadata_revisions(job_id)
+        .await
+        .map(|revisions| revisions.iter().map(Into::into).collect())
+        .map_err(service_error)
+}
+
+pub async fn edit_metadata(
+    ctx: &Context<'_>,
+    input: EditIngestMetadataInput,
+) -> Result<IngestMetadataReviewPayload> {
+    let row_version = parse_row_version(&input.expected_row_version)?;
+    let revision = parse_revision(&input.expected_revision)?;
+    let edit = input.edit.try_into()?;
+    let service = ctx.data::<IngestService>()?;
+    let review = service
+        .edit_metadata(input.job_id, row_version, revision, edit)
+        .await
+        .map_err(service_error)?;
+    Ok((&review).into())
+}
+
+pub async fn approve_metadata(
+    ctx: &Context<'_>,
+    input: IngestMetadataRevisionActionInput,
+) -> Result<IngestMetadataReviewPayload> {
+    execute_revision_action(ctx, input, RevisionAction::Approve).await
+}
+
+pub async fn revise_metadata(
+    ctx: &Context<'_>,
+    input: IngestMetadataRevisionActionInput,
+) -> Result<IngestMetadataReviewPayload> {
+    execute_revision_action(ctx, input, RevisionAction::Revise).await
+}
+
+#[derive(Debug, Clone, Copy)]
+enum RevisionAction {
+    Approve,
+    Revise,
+}
+
+async fn execute_revision_action(
+    ctx: &Context<'_>,
+    input: IngestMetadataRevisionActionInput,
+    action: RevisionAction,
+) -> Result<IngestMetadataReviewPayload> {
+    let row_version = parse_row_version(&input.expected_row_version)?;
+    let revision = parse_revision(&input.expected_revision)?;
+    let command = match action {
+        RevisionAction::Approve => IngestCommand::ApproveRevision {
+            expected_revision: revision,
+        },
+        RevisionAction::Revise => IngestCommand::ReviseMetadata {
+            expected_revision: revision,
+        },
+    };
+    let service = ctx.data::<IngestService>()?;
+    service
+        .execute(input.job_id, row_version, command)
+        .await
+        .map_err(service_error)?;
+    let review = service
+        .metadata(input.job_id, None)
+        .await
+        .map_err(service_error)?
+        .ok_or_else(|| {
+            Error::new("committed metadata revision could not be read back")
+                .extend_with(|_, extensions| extensions.set("code", "INTERNAL"))
+        })?;
+    Ok((&review).into())
+}
+
+fn parse_position(name: &'static str, value: Option<i32>) -> Result<NonZeroU16> {
+    value
+        .and_then(|value| u16::try_from(value).ok())
+        .and_then(NonZeroU16::new)
+        .ok_or_else(|| invalid_field(format!("{name} must be an integer between 1 and 65535")))
+}
+
+fn invalid_field(message: impl Into<String>) -> Error {
+    input_error("INGEST_METADATA_INVALID_FIELD", message)
+}
+
+fn validate_date(date: &AnniDate) -> Result<()> {
+    if let Some(month) = date.month() {
+        if !(1..=12).contains(&month) {
+            return Err(input_error(
+                "INGEST_METADATA_INVALID_VALUE",
+                "date month must be between 1 and 12",
+            ));
+        }
+        if let Some(day) = date.day()
+            && chrono::NaiveDate::from_ymd_opt(
+                i32::from(date.year()),
+                u32::from(month),
+                u32::from(day),
+            )
+            .is_none()
+        {
+            return Err(input_error(
+                "INGEST_METADATA_INVALID_VALUE",
+                "date is not a valid calendar day",
+            ));
+        }
+    }
+    Ok(())
+}
+
+fn album_field(value: IngestMetadataFieldName) -> Option<AlbumField> {
+    Some(match value {
+        IngestMetadataFieldName::Title => AlbumField::Title,
+        IngestMetadataFieldName::Edition => AlbumField::Edition,
+        IngestMetadataFieldName::Artist => AlbumField::Artist,
+        IngestMetadataFieldName::Artists => AlbumField::Artists,
+        IngestMetadataFieldName::ReleaseDate => AlbumField::ReleaseDate,
+        IngestMetadataFieldName::TrackType => AlbumField::TrackType,
+        IngestMetadataFieldName::Catalog => AlbumField::Catalog,
+        IngestMetadataFieldName::Tags => AlbumField::Tags,
+    })
+}
+
+fn disc_field(value: IngestMetadataFieldName) -> Option<DiscField> {
+    match value {
+        IngestMetadataFieldName::Title => Some(DiscField::Title),
+        IngestMetadataFieldName::Artist => Some(DiscField::Artist),
+        IngestMetadataFieldName::Artists => Some(DiscField::Artists),
+        IngestMetadataFieldName::TrackType => Some(DiscField::TrackType),
+        IngestMetadataFieldName::Catalog => Some(DiscField::Catalog),
+        IngestMetadataFieldName::Tags => Some(DiscField::Tags),
+        IngestMetadataFieldName::Edition | IngestMetadataFieldName::ReleaseDate => None,
+    }
+}
+
+fn track_field(value: IngestMetadataFieldName) -> Option<TrackField> {
+    match value {
+        IngestMetadataFieldName::Title => Some(TrackField::Title),
+        IngestMetadataFieldName::Artist => Some(TrackField::Artist),
+        IngestMetadataFieldName::Artists => Some(TrackField::Artists),
+        IngestMetadataFieldName::TrackType => Some(TrackField::TrackType),
+        IngestMetadataFieldName::Tags => Some(TrackField::Tags),
+        IngestMetadataFieldName::Edition
+        | IngestMetadataFieldName::ReleaseDate
+        | IngestMetadataFieldName::Catalog => None,
+    }
+}
+
+const fn album_field_name(value: AlbumField) -> IngestMetadataFieldName {
+    match value {
+        AlbumField::Title => IngestMetadataFieldName::Title,
+        AlbumField::Edition => IngestMetadataFieldName::Edition,
+        AlbumField::Artist => IngestMetadataFieldName::Artist,
+        AlbumField::Artists => IngestMetadataFieldName::Artists,
+        AlbumField::ReleaseDate => IngestMetadataFieldName::ReleaseDate,
+        AlbumField::TrackType => IngestMetadataFieldName::TrackType,
+        AlbumField::Catalog => IngestMetadataFieldName::Catalog,
+        AlbumField::Tags => IngestMetadataFieldName::Tags,
+    }
+}
+
+const fn disc_field_name(value: DiscField) -> IngestMetadataFieldName {
+    match value {
+        DiscField::Title => IngestMetadataFieldName::Title,
+        DiscField::Catalog => IngestMetadataFieldName::Catalog,
+        DiscField::Artist => IngestMetadataFieldName::Artist,
+        DiscField::Artists => IngestMetadataFieldName::Artists,
+        DiscField::TrackType => IngestMetadataFieldName::TrackType,
+        DiscField::Tags => IngestMetadataFieldName::Tags,
+    }
+}
+
+const fn track_field_name(value: TrackField) -> IngestMetadataFieldName {
+    match value {
+        TrackField::Title => IngestMetadataFieldName::Title,
+        TrackField::Artist => IngestMetadataFieldName::Artist,
+        TrackField::Artists => IngestMetadataFieldName::Artists,
+        TrackField::TrackType => IngestMetadataFieldName::TrackType,
+        TrackField::Tags => IngestMetadataFieldName::Tags,
+    }
+}
diff --git a/annim/src/graphql/mod.rs b/annim/src/graphql/mod.rs
index 7d777471..78f8e6b6 100644
--- a/annim/src/graphql/mod.rs
+++ b/annim/src/graphql/mod.rs
@@ -1,4 +1,9 @@
+mod catalog;
+mod catalog_sync;
+mod cover;
 mod cursor;
+mod ingest;
+mod ingest_metadata;
 mod input;
 pub mod types;
 
@@ -7,7 +12,7 @@ use std::{i64, str::FromStr};
 use anyhow::Ok;
 use async_graphql::{
     connection::{Connection, Edge},
-    Context, EmptySubscription, Object, Schema, ID,
+    Context, Object, Schema, SchemaBuilder, Subscription, ID,
 };
 use cursor::Cursor;
 use input::{AlbumsBy, MetadataIDInput};
@@ -28,22 +33,120 @@ use types::{
 
 use crate::{
     auth::AdminGuard,
+    catalog::{CatalogRepository, CatalogService, CatalogSyncService},
+    cover::{CoverRepository, CoverService},
     entities::{album, album_tag_relation, disc, helper::now, tag_info, tag_relation, track},
+    ingest::{IngestJobRepository, IngestService},
     search::RepositorySearchManager,
 };
 
-pub type MetadataSchema = Schema<MetadataQuery, MetadataMutation, EmptySubscription>;
+pub type MetadataSchema = Schema<MetadataQuery, MetadataMutation, MetadataSubscription>;
 
-pub fn build_schema(db: DatabaseConnection) -> MetadataSchema {
-    Schema::build(MetadataQuery, MetadataMutation, EmptySubscription)
+pub fn schema_builder(
+    db: DatabaseConnection,
+) -> SchemaBuilder<MetadataQuery, MetadataMutation, MetadataSubscription> {
+    let catalog_sync_service = CatalogSyncService::new(db.clone());
+    schema_builder_with_catalog_sync_service(db, catalog_sync_service)
+}
+
+pub fn schema_builder_with_catalog_sync_service(
+    db: DatabaseConnection,
+    catalog_sync_service: CatalogSyncService,
+) -> SchemaBuilder<MetadataQuery, MetadataMutation, MetadataSubscription> {
+    let ingest_service = IngestService::new(IngestJobRepository::new(db.clone()));
+    let catalog_service = CatalogService::new(CatalogRepository::new(db.clone()));
+    let cover_service = CoverService::new(CoverRepository::new(db.clone()));
+    Schema::build(MetadataQuery, MetadataMutation, MetadataSubscription)
         .data(db)
-        .finish()
+        .data(ingest_service)
+        .data(catalog_service)
+        .data(catalog_sync_service)
+        .data(cover_service)
+}
+
+pub fn build_schema(db: DatabaseConnection) -> MetadataSchema {
+    schema_builder(db).finish()
 }
 
 pub struct MetadataQuery;
 
-#[Object]
+#[Object(guard = "AdminGuard")]
 impl MetadataQuery {
+    async fn catalog_sync_sources(
+        &self,
+        ctx: &Context<'_>,
+        artist_id: Uuid,
+    ) -> async_graphql::Result<Vec<catalog_sync::CatalogSyncSourceInfo>> {
+        catalog_sync::query_sources(ctx, artist_id).await
+    }
+
+    async fn catalog_sync_source(
+        &self,
+        ctx: &Context<'_>,
+        source_id: Uuid,
+    ) -> async_graphql::Result<Option<catalog_sync::CatalogSyncSourceInfo>> {
+        catalog_sync::query_source(ctx, source_id).await
+    }
+
+    async fn catalog_sync_run(
+        &self,
+        ctx: &Context<'_>,
+        run_id: Uuid,
+    ) -> async_graphql::Result<Option<catalog_sync::CatalogSyncRunInfo>> {
+        catalog_sync::query_run(ctx, run_id).await
+    }
+
+    async fn catalog_sync_runs(
+        &self,
+        ctx: &Context<'_>,
+        source_id: Uuid,
+        #[graphql(default = 50)] limit: i32,
+        #[graphql(default = 0)] offset: i32,
+    ) -> async_graphql::Result<Vec<catalog_sync::CatalogSyncRunInfo>> {
+        catalog_sync::query_runs(ctx, source_id, limit, offset).await
+    }
+
+    async fn cover_candidates(
+        &self,
+        ctx: &Context<'_>,
+        release_id: Uuid,
+        disc_number: Option<i32>,
+    ) -> async_graphql::Result<Vec<cover::CoverCandidateInfo>> {
+        cover::query_candidates(ctx, release_id, disc_number).await
+    }
+
+    async fn cover_selection(
+        &self,
+        ctx: &Context<'_>,
+        release_id: Uuid,
+        disc_number: i32,
+    ) -> async_graphql::Result<Option<cover::CoverSelectionInfo>> {
+        cover::query_selection(ctx, release_id, disc_number).await
+    }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn catalog_artists(
+        &self,
+        ctx: &Context<'_>,
+        search: Option<String>,
+        #[graphql(default = 50)] limit: i32,
+        #[graphql(default = 0)] offset: i32,
+    ) -> async_graphql::Result<Vec<catalog::CatalogArtistInfo>> {
+        catalog::query_artists(ctx, search, limit, offset).await
+    }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn catalog_artist_collection(
+        &self,
+        ctx: &Context<'_>,
+        artist_id: Uuid,
+        state: Option<catalog::CatalogCollectionState>,
+        #[graphql(default = 500)] limit: i32,
+        #[graphql(default = 0)] offset: i32,
+    ) -> async_graphql::Result<Option<catalog::CatalogArtistCollectionInfo>> {
+        catalog::query_artist_collection(ctx, artist_id, state, limit, offset).await
+    }
+
     async fn album<'ctx>(
         &self,
         ctx: &Context<'ctx>,
@@ -217,12 +320,204 @@ impl MetadataQuery {
             .await?;
         Ok(model.into_iter().map(|model| TagInfo(model)).collect())
     }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn ingest_job(
+        &self,
+        ctx: &Context<'_>,
+        job_id: Uuid,
+    ) -> async_graphql::Result<Option<ingest::IngestJobInfo>> {
+        ingest::query_job(ctx, job_id).await
+    }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn ingest_jobs(
+        &self,
+        ctx: &Context<'_>,
+        state: Option<ingest::IngestJobState>,
+        #[graphql(default = 50)] limit: i32,
+        #[graphql(default = 0)] offset: i32,
+    ) -> async_graphql::Result<Vec<ingest::IngestJobInfo>> {
+        ingest::query_jobs(ctx, state, limit, offset).await
+    }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn ingest_metadata_draft(
+        &self,
+        ctx: &Context<'_>,
+        job_id: Uuid,
+        revision: Option<String>,
+    ) -> async_graphql::Result<Option<ingest_metadata::IngestMetadataReviewPayload>> {
+        ingest_metadata::query_draft(ctx, job_id, revision).await
+    }
+
+    #[graphql(guard = "AdminGuard")]
+    async fn ingest_metadata_revisions(
+        &self,
+        ctx: &Context<'_>,
+        job_id: Uuid,
+    ) -> async_graphql::Result<Vec<ingest_metadata::IngestMetadataDraftInfo>> {
+        ingest_metadata::query_revisions(ctx, job_id).await
+    }
 }
 
 pub struct MetadataMutation;
 
+pub struct MetadataSubscription;
+
+#[Subscription(guard = "AdminGuard")]
+impl MetadataSubscription {
+    #[graphql(guard = "AdminGuard")]
+    async fn ingest_job_changed(
+        &self,
+        ctx: &Context<'_>,
+        job_id: Option<Uuid>,
+        after_row_version: Option<String>,
+    ) -> async_graphql::Result<
+        impl tokio_stream::Stream<Item = async_graphql::Result<ingest::IngestJobInfo>> + use<>,
+    > {
+        ingest::subscribe_jobs(ctx, job_id, after_row_version)
+    }
+}
+
 #[Object(guard = "AdminGuard")]
 impl MetadataMutation {
+    async fn create_catalog_sync_source(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog_sync::CreateCatalogSyncSourceInput,
+    ) -> async_graphql::Result<catalog_sync::CatalogSyncSourceInfo> {
+        catalog_sync::create_source(ctx, input).await
+    }
+
+    async fn start_catalog_sync_run(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog_sync::StartCatalogSyncRunInput,
+    ) -> async_graphql::Result<catalog_sync::CatalogSyncRunInfo> {
+        catalog_sync::start_run(ctx, input).await
+    }
+
+    async fn set_catalog_sync_source_enabled(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog_sync::SetCatalogSyncSourceEnabledInput,
+    ) -> async_graphql::Result<catalog_sync::CatalogSyncSourceInfo> {
+        catalog_sync::set_source_enabled(ctx, input).await
+    }
+
+    async fn add_cover_candidate(
+        &self,
+        ctx: &Context<'_>,
+        input: cover::AddCoverCandidateInput,
+    ) -> async_graphql::Result<cover::CoverCandidateInfo> {
+        cover::add_candidate(ctx, input).await
+    }
+
+    async fn queue_cover_candidate(
+        &self,
+        ctx: &Context<'_>,
+        input: cover::QueueCoverCandidateInput,
+    ) -> async_graphql::Result<cover::CoverCandidateInfo> {
+        cover::queue_candidate(ctx, input).await
+    }
+
+    async fn reject_cover_candidate(
+        &self,
+        ctx: &Context<'_>,
+        input: cover::RejectCoverCandidateInput,
+    ) -> async_graphql::Result<cover::CoverCandidateInfo> {
+        cover::reject_candidate(ctx, input).await
+    }
+
+    async fn select_cover(
+        &self,
+        ctx: &Context<'_>,
+        input: cover::SelectCoverInput,
+    ) -> async_graphql::Result<cover::CoverSelectionInfo> {
+        cover::select_cover(ctx, input).await
+    }
+
+    async fn create_catalog_artist(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog::CreateCatalogArtistInput,
+    ) -> async_graphql::Result<catalog::CatalogArtistInfo> {
+        catalog::create_artist(ctx, input).await
+    }
+
+    async fn update_catalog_artist(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog::UpdateCatalogArtistInput,
+    ) -> async_graphql::Result<catalog::CatalogArtistInfo> {
+        catalog::update_artist(ctx, input).await
+    }
+
+    async fn create_catalog_release(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog::CreateCatalogReleaseInput,
+    ) -> async_graphql::Result<catalog::CatalogReleaseInfo> {
+        catalog::create_release(ctx, input).await
+    }
+
+    async fn update_catalog_release(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog::UpdateCatalogReleaseInput,
+    ) -> async_graphql::Result<catalog::CatalogReleaseInfo> {
+        catalog::update_release(ctx, input).await
+    }
+
+    async fn execute_catalog_release_command(
+        &self,
+        ctx: &Context<'_>,
+        input: catalog::ExecuteCatalogReleaseCommandInput,
+    ) -> async_graphql::Result<catalog::CatalogReleaseInfo> {
+        catalog::execute_release_command(ctx, input).await
+    }
+
+    async fn create_ingest_job(
+        &self,
+        ctx: &Context<'_>,
+        job_id: Option<Uuid>,
+    ) -> async_graphql::Result<ingest::IngestJobInfo> {
+        ingest::create_job(ctx, job_id).await
+    }
+
+    async fn execute_ingest_job_command(
+        &self,
+        ctx: &Context<'_>,
+        input: ingest::ExecuteIngestJobCommandInput,
+    ) -> async_graphql::Result<ingest::IngestJobInfo> {
+        ingest::execute_command(ctx, input).await
+    }
+
+    async fn edit_ingest_metadata(
+        &self,
+        ctx: &Context<'_>,
+        input: ingest_metadata::EditIngestMetadataInput,
+    ) -> async_graphql::Result<ingest_metadata::IngestMetadataReviewPayload> {
+        ingest_metadata::edit_metadata(ctx, input).await
+    }
+
+    async fn approve_ingest_metadata(
+        &self,
+        ctx: &Context<'_>,
+        input: ingest_metadata::IngestMetadataRevisionActionInput,
+    ) -> async_graphql::Result<ingest_metadata::IngestMetadataReviewPayload> {
+        ingest_metadata::approve_metadata(ctx, input).await
+    }
+
+    async fn revise_ingest_metadata(
+        &self,
+        ctx: &Context<'_>,
+        input: ingest_metadata::IngestMetadataRevisionActionInput,
+    ) -> async_graphql::Result<ingest_metadata::IngestMetadataReviewPayload> {
+        ingest_metadata::revise_metadata(ctx, input).await
+    }
+
     /// Add the metatada of a full album to annim.
     async fn add_album<'ctx>(
         &self,
diff --git a/annim/src/ingest/mod.rs b/annim/src/ingest/mod.rs
new file mode 100644
index 00000000..617702a4
--- /dev/null
+++ b/annim/src/ingest/mod.rs
@@ -0,0 +1,775 @@
+//! Persistence boundary for audio-ingestion jobs.
+//!
+//! GraphQL resolvers and background workers both use this repository so every
+//! write receives the same optimistic-concurrency protection.
+
+use anni_ingest::{
+    Digest, IngestJob, IngestJobSnapshot, JobState, MetadataDraft, MetadataDraftSnapshot,
+    MetadataError, MetadataRevision, SnapshotError,
+};
+use sea_orm::prelude::{DateTimeUtc, Uuid};
+use sea_orm::{
+    sea_query::{Expr, OnConflict},
+    ActiveValue::NotSet,
+    ActiveValue::Set,
+    ColumnTrait, ConnectionTrait, DatabaseConnection, DbErr, EntityTrait, QueryFilter, QueryOrder,
+    QuerySelect, TransactionTrait, TryInsertResult,
+};
+use sha2::{Digest as ShaDigest, Sha256};
+use thiserror::Error;
+
+use crate::entities::{
+    helper::{now, timestamp},
+    ingest_job, ingest_metadata_revision,
+};
+
+mod service;
+
+pub use service::{
+    IngestCommand, IngestJobEvent, IngestMetadataReview, IngestService, IngestServiceError,
+    MetadataEdit,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct RowVersion(u64);
+
+impl RowVersion {
+    pub const INITIAL: Self = Self(1);
+
+    pub const fn new(value: u64) -> Option<Self> {
+        if value == 0 {
+            None
+        } else {
+            Some(Self(value))
+        }
+    }
+
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+
+    fn as_i64(self, job_id: Uuid) -> Result<i64, IngestRepositoryError> {
+        i64::try_from(self.0).map_err(|_| IngestRepositoryError::NumericOutOfRange {
+            job_id,
+            field: "row_version",
+        })
+    }
+
+    fn next(self, job_id: Uuid) -> Result<Self, IngestRepositoryError> {
+        self.0
+            .checked_add(1)
+            .filter(|value| i64::try_from(*value).is_ok())
+            .map(Self)
+            .ok_or(IngestRepositoryError::NumericOutOfRange {
+                job_id,
+                field: "row_version",
+            })
+    }
+}
+
+impl std::fmt::Display for RowVersion {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct VersionedIngestJob {
+    job: IngestJob,
+    row_version: RowVersion,
+    created_at: DateTimeUtc,
+    updated_at: DateTimeUtc,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PersistedMetadataDraft {
+    draft: MetadataDraft,
+    created_at: DateTimeUtc,
+    updated_at: DateTimeUtc,
+}
+
+impl PersistedMetadataDraft {
+    pub const fn draft(&self) -> &MetadataDraft {
+        &self.draft
+    }
+
+    pub fn into_draft(self) -> MetadataDraft {
+        self.draft
+    }
+
+    pub const fn created_at(&self) -> DateTimeUtc {
+        self.created_at
+    }
+
+    pub const fn updated_at(&self) -> DateTimeUtc {
+        self.updated_at
+    }
+}
+
+impl VersionedIngestJob {
+    pub const fn job(&self) -> &IngestJob {
+        &self.job
+    }
+
+    pub fn job_mut(&mut self) -> &mut IngestJob {
+        &mut self.job
+    }
+
+    pub const fn row_version(&self) -> RowVersion {
+        self.row_version
+    }
+
+    pub const fn created_at(&self) -> DateTimeUtc {
+        self.created_at
+    }
+
+    pub const fn updated_at(&self) -> DateTimeUtc {
+        self.updated_at
+    }
+
+    pub fn into_job(self) -> IngestJob {
+        self.job
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum IngestRepositoryError {
+    #[error("ingest job {job_id} already exists")]
+    AlreadyExists { job_id: Uuid },
+    #[error("ingest job {job_id} does not exist")]
+    NotFound { job_id: Uuid },
+    #[error(
+        "ingest job {job_id} changed concurrently: expected row version {expected}, actual {actual}"
+    )]
+    ConcurrentModification {
+        job_id: Uuid,
+        expected: RowVersion,
+        actual: RowVersion,
+    },
+    #[error("persisted ingest job {job_id} has an unknown state: {state}")]
+    InvalidState { job_id: Uuid, state: String },
+    #[error("persisted ingest job {job_id} is invalid: {source}")]
+    InvalidPersistedJob {
+        job_id: Uuid,
+        #[source]
+        source: SnapshotError,
+    },
+    #[error("persisted ingest job {job_id} has an invalid {field} length: {actual}")]
+    InvalidDigestLength {
+        job_id: Uuid,
+        field: &'static str,
+        actual: usize,
+    },
+    #[error("persisted ingest job {job_id} has an out-of-range {field}")]
+    NumericOutOfRange { job_id: Uuid, field: &'static str },
+    #[error(
+        "ingest job {job_id} is at metadata revision {job_revision}, but the draft is revision {draft_revision}"
+    )]
+    MetadataRevisionMismatch {
+        job_id: Uuid,
+        job_revision: MetadataRevision,
+        draft_revision: MetadataRevision,
+    },
+    #[error(
+        "ingest job {job_id} cannot change metadata revision from {stored_revision} to {requested_revision} without a metadata document"
+    )]
+    MetadataRevisionRequiresDocument {
+        job_id: Uuid,
+        stored_revision: MetadataRevision,
+        requested_revision: MetadataRevision,
+    },
+    #[error("metadata revision {revision} for ingest job {job_id} is frozen")]
+    MetadataFrozen {
+        job_id: Uuid,
+        revision: MetadataRevision,
+    },
+    #[error("metadata revision {revision} for ingest job {job_id} does not exist")]
+    MetadataNotFound {
+        job_id: Uuid,
+        revision: MetadataRevision,
+    },
+    #[error("could not serialize metadata revision {revision} for ingest job {job_id}: {source}")]
+    SerializeMetadata {
+        job_id: Uuid,
+        revision: MetadataRevision,
+        #[source]
+        source: serde_json::Error,
+    },
+    #[error(
+        "persisted metadata revision {revision} for ingest job {job_id} has an invalid SHA-256 length: {actual}"
+    )]
+    InvalidMetadataDigestLength {
+        job_id: Uuid,
+        revision: MetadataRevision,
+        actual: usize,
+    },
+    #[error(
+        "persisted metadata revision {revision} for ingest job {job_id} does not match its SHA-256"
+    )]
+    MetadataDigestMismatch {
+        job_id: Uuid,
+        revision: MetadataRevision,
+    },
+    #[error("persisted metadata revision {revision} for ingest job {job_id} is not valid JSON: {source}")]
+    InvalidMetadataDocument {
+        job_id: Uuid,
+        revision: MetadataRevision,
+        #[source]
+        source: serde_json::Error,
+    },
+    #[error(
+        "persisted metadata revision {revision} for ingest job {job_id} violates domain invariants: {source}"
+    )]
+    InvalidPersistedMetadata {
+        job_id: Uuid,
+        revision: MetadataRevision,
+        #[source]
+        source: MetadataError,
+    },
+    #[error(
+        "persisted metadata row {row_revision} for ingest job {job_id} contains revision {document_revision}"
+    )]
+    MetadataDocumentRevisionMismatch {
+        job_id: Uuid,
+        row_revision: MetadataRevision,
+        document_revision: MetadataRevision,
+    },
+    #[error(transparent)]
+    Database(#[from] DbErr),
+}
+
+#[derive(Clone)]
+pub struct IngestJobRepository {
+    database: DatabaseConnection,
+}
+
+impl IngestJobRepository {
+    pub fn new(database: DatabaseConnection) -> Self {
+        Self { database }
+    }
+
+    pub async fn create(
+        &self,
+        job: &IngestJob,
+    ) -> Result<VersionedIngestJob, IngestRepositoryError> {
+        let snapshot = job.snapshot();
+        let transaction = self.database.begin().await?;
+        let active_model = ingest_job::ActiveModel {
+            id: NotSet,
+            job_id: Set(snapshot.id()),
+            state: Set(snapshot.state().as_str().to_owned()),
+            metadata_revision: Set(revision_to_i64(
+                snapshot.id(),
+                snapshot.metadata_revision(),
+                "metadata_revision",
+            )?),
+            approved_revision: Set(optional_revision_to_i64(
+                snapshot.id(),
+                snapshot.approved_revision(),
+                "approved_revision",
+            )?),
+            manifest_digest: Set(digest_bytes(snapshot.manifest_digest())),
+            plan_digest: Set(digest_bytes(snapshot.plan_digest())),
+            verification_digest: Set(digest_bytes(snapshot.verification_digest())),
+            row_version: Set(RowVersion::INITIAL.as_i64(snapshot.id())?),
+            created_at: NotSet,
+            updated_at: NotSet,
+        };
+
+        let result = ingest_job::Entity::insert(active_model)
+            .on_conflict(
+                OnConflict::column(ingest_job::Column::JobId)
+                    .do_nothing()
+                    .to_owned(),
+            )
+            .do_nothing()
+            .exec_without_returning(&transaction)
+            .await?;
+
+        match result {
+            TryInsertResult::Inserted(1) => {
+                insert_metadata_document(
+                    &transaction,
+                    snapshot.id(),
+                    &MetadataDraft::new(snapshot.metadata_revision()),
+                )
+                .await?;
+                transaction.commit().await?;
+                self.get(job.id()).await?.ok_or_else(|| {
+                    IngestRepositoryError::Database(DbErr::Custom(
+                        "created ingest job could not be read back".to_owned(),
+                    ))
+                })
+            }
+            TryInsertResult::Conflicted | TryInsertResult::Inserted(0) => {
+                Err(IngestRepositoryError::AlreadyExists { job_id: job.id() })
+            }
+            TryInsertResult::Inserted(_) | TryInsertResult::Empty => {
+                Err(IngestRepositoryError::Database(DbErr::Custom(
+                    "ingest job insert affected an unexpected number of rows".to_owned(),
+                )))
+            }
+        }
+    }
+
+    pub async fn get(
+        &self,
+        job_id: Uuid,
+    ) -> Result<Option<VersionedIngestJob>, IngestRepositoryError> {
+        get_job(&self.database, job_id).await
+    }
+
+    pub async fn get_metadata_draft(
+        &self,
+        job_id: Uuid,
+        revision: MetadataRevision,
+    ) -> Result<Option<PersistedMetadataDraft>, IngestRepositoryError> {
+        get_metadata_draft(&self.database, job_id, revision).await
+    }
+
+    pub async fn list_metadata_revisions(
+        &self,
+        job_id: Uuid,
+    ) -> Result<Vec<PersistedMetadataDraft>, IngestRepositoryError> {
+        ingest_metadata_revision::Entity::find()
+            .filter(ingest_metadata_revision::Column::JobId.eq(job_id))
+            .order_by_desc(ingest_metadata_revision::Column::Revision)
+            .all(&self.database)
+            .await?
+            .into_iter()
+            .map(model_to_metadata_draft)
+            .collect()
+    }
+
+    pub async fn list(
+        &self,
+        state: Option<JobState>,
+        limit: u64,
+        offset: u64,
+    ) -> Result<Vec<VersionedIngestJob>, IngestRepositoryError> {
+        let mut query = ingest_job::Entity::find();
+        if let Some(state) = state {
+            query = query.filter(ingest_job::Column::State.eq(state.as_str()));
+        }
+
+        query
+            .order_by_desc(ingest_job::Column::Id)
+            .limit(limit)
+            .offset(offset)
+            .all(&self.database)
+            .await?
+            .into_iter()
+            .map(model_to_versioned)
+            .collect()
+    }
+
+    /// Atomically replace the durable snapshot only if no other actor has
+    /// written the row since `expected` was loaded.
+    pub async fn compare_and_swap(
+        &self,
+        job: &IngestJob,
+        expected: RowVersion,
+    ) -> Result<RowVersion, IngestRepositoryError> {
+        compare_and_swap(&self.database, job, expected, false).await
+    }
+
+    pub async fn save(
+        &self,
+        versioned: &mut VersionedIngestJob,
+    ) -> Result<(), IngestRepositoryError> {
+        self.compare_and_swap(&versioned.job, versioned.row_version)
+            .await?;
+        *versioned =
+            self.get(versioned.job.id())
+                .await?
+                .ok_or(IngestRepositoryError::NotFound {
+                    job_id: versioned.job.id(),
+                })?;
+        Ok(())
+    }
+
+    /// Atomically persist a job change and its current metadata document.
+    /// Historical revision rows are never selected by this method because the
+    /// draft revision must match the job aggregate's current revision.
+    pub async fn save_with_metadata(
+        &self,
+        versioned: &mut VersionedIngestJob,
+        draft: &MetadataDraft,
+    ) -> Result<PersistedMetadataDraft, IngestRepositoryError> {
+        let job_id = versioned.job().id();
+        let job_revision = versioned.job().metadata_revision();
+        if draft.revision() != job_revision {
+            return Err(IngestRepositoryError::MetadataRevisionMismatch {
+                job_id,
+                job_revision,
+                draft_revision: draft.revision(),
+            });
+        }
+        if versioned.job().state() != JobState::Reviewing
+            || versioned.job().approved_revision() == Some(job_revision)
+        {
+            return Err(IngestRepositoryError::MetadataFrozen {
+                job_id,
+                revision: job_revision,
+            });
+        }
+
+        let transaction = self.database.begin().await?;
+        compare_and_swap(&transaction, versioned.job(), versioned.row_version(), true).await?;
+        upsert_metadata_document(&transaction, job_id, draft).await?;
+        transaction.commit().await?;
+
+        *versioned = self
+            .get(job_id)
+            .await?
+            .ok_or(IngestRepositoryError::NotFound { job_id })?;
+        self.get_metadata_draft(job_id, draft.revision())
+            .await?
+            .ok_or_else(|| {
+                IngestRepositoryError::Database(DbErr::Custom(
+                    "saved metadata document could not be read back".to_owned(),
+                ))
+            })
+    }
+}
+
+async fn get_job<C: ConnectionTrait>(
+    connection: &C,
+    job_id: Uuid,
+) -> Result<Option<VersionedIngestJob>, IngestRepositoryError> {
+    ingest_job::Entity::find()
+        .filter(ingest_job::Column::JobId.eq(job_id))
+        .one(connection)
+        .await?
+        .map(model_to_versioned)
+        .transpose()
+}
+
+async fn compare_and_swap<C: ConnectionTrait>(
+    connection: &C,
+    job: &IngestJob,
+    expected: RowVersion,
+    allow_metadata_revision_change: bool,
+) -> Result<RowVersion, IngestRepositoryError> {
+    if !allow_metadata_revision_change {
+        let current = get_job(connection, job.id())
+            .await?
+            .ok_or(IngestRepositoryError::NotFound { job_id: job.id() })?;
+        if current.row_version() != expected {
+            return Err(IngestRepositoryError::ConcurrentModification {
+                job_id: job.id(),
+                expected,
+                actual: current.row_version(),
+            });
+        }
+        if current.job().metadata_revision() != job.metadata_revision() {
+            return Err(IngestRepositoryError::MetadataRevisionRequiresDocument {
+                job_id: job.id(),
+                stored_revision: current.job().metadata_revision(),
+                requested_revision: job.metadata_revision(),
+            });
+        }
+    }
+
+    let snapshot = job.snapshot();
+    let expected_i64 = expected.as_i64(job.id())?;
+    let next = expected.next(job.id())?;
+
+    let result = ingest_job::Entity::update_many()
+        .col_expr(
+            ingest_job::Column::State,
+            Expr::value(snapshot.state().as_str()),
+        )
+        .col_expr(
+            ingest_job::Column::MetadataRevision,
+            Expr::value(revision_to_i64(
+                snapshot.id(),
+                snapshot.metadata_revision(),
+                "metadata_revision",
+            )?),
+        )
+        .col_expr(
+            ingest_job::Column::ApprovedRevision,
+            Expr::value(optional_revision_to_i64(
+                snapshot.id(),
+                snapshot.approved_revision(),
+                "approved_revision",
+            )?),
+        )
+        .col_expr(
+            ingest_job::Column::ManifestDigest,
+            Expr::value(digest_bytes(snapshot.manifest_digest())),
+        )
+        .col_expr(
+            ingest_job::Column::PlanDigest,
+            Expr::value(digest_bytes(snapshot.plan_digest())),
+        )
+        .col_expr(
+            ingest_job::Column::VerificationDigest,
+            Expr::value(digest_bytes(snapshot.verification_digest())),
+        )
+        .col_expr(
+            ingest_job::Column::RowVersion,
+            Expr::value(next.as_i64(job.id())?),
+        )
+        .col_expr(
+            ingest_job::Column::UpdatedAt,
+            Expr::current_timestamp().into(),
+        )
+        .filter(ingest_job::Column::JobId.eq(job.id()))
+        .filter(ingest_job::Column::RowVersion.eq(expected_i64))
+        .exec(connection)
+        .await?;
+
+    if result.rows_affected == 1 {
+        return Ok(next);
+    }
+
+    match get_job(connection, job.id()).await? {
+        Some(current) => Err(IngestRepositoryError::ConcurrentModification {
+            job_id: job.id(),
+            expected,
+            actual: current.row_version,
+        }),
+        None => Err(IngestRepositoryError::NotFound { job_id: job.id() }),
+    }
+}
+
+async fn get_metadata_draft<C: ConnectionTrait>(
+    connection: &C,
+    job_id: Uuid,
+    revision: MetadataRevision,
+) -> Result<Option<PersistedMetadataDraft>, IngestRepositoryError> {
+    ingest_metadata_revision::Entity::find()
+        .filter(ingest_metadata_revision::Column::JobId.eq(job_id))
+        .filter(
+            ingest_metadata_revision::Column::Revision.eq(revision_to_i64(
+                job_id,
+                revision,
+                "metadata_revision",
+            )?),
+        )
+        .one(connection)
+        .await?
+        .map(model_to_metadata_draft)
+        .transpose()
+}
+
+async fn insert_metadata_document<C: ConnectionTrait>(
+    connection: &C,
+    job_id: Uuid,
+    draft: &MetadataDraft,
+) -> Result<(), IngestRepositoryError> {
+    ingest_metadata_revision::Entity::insert(metadata_active_model(job_id, draft)?)
+        .exec_without_returning(connection)
+        .await?;
+    Ok(())
+}
+
+async fn upsert_metadata_document<C: ConnectionTrait>(
+    connection: &C,
+    job_id: Uuid,
+    draft: &MetadataDraft,
+) -> Result<(), IngestRepositoryError> {
+    ingest_metadata_revision::Entity::insert(metadata_active_model(job_id, draft)?)
+        .on_conflict(
+            OnConflict::columns([
+                ingest_metadata_revision::Column::JobId,
+                ingest_metadata_revision::Column::Revision,
+            ])
+            .update_columns([
+                ingest_metadata_revision::Column::Document,
+                ingest_metadata_revision::Column::DocumentSha256,
+                ingest_metadata_revision::Column::UpdatedAt,
+            ])
+            .to_owned(),
+        )
+        .exec_without_returning(connection)
+        .await?;
+    Ok(())
+}
+
+fn metadata_active_model(
+    job_id: Uuid,
+    draft: &MetadataDraft,
+) -> Result<ingest_metadata_revision::ActiveModel, IngestRepositoryError> {
+    let revision = draft.revision();
+    let document = serde_json::to_string(&draft.snapshot()).map_err(|source| {
+        IngestRepositoryError::SerializeMetadata {
+            job_id,
+            revision,
+            source,
+        }
+    })?;
+    let document_sha256 = sha256(document.as_bytes());
+
+    Ok(ingest_metadata_revision::ActiveModel {
+        id: NotSet,
+        job_id: Set(job_id),
+        revision: Set(revision_to_i64(job_id, revision, "metadata_revision")?),
+        document: Set(document),
+        document_sha256: Set(document_sha256.as_bytes().to_vec()),
+        created_at: NotSet,
+        updated_at: Set(now()),
+    })
+}
+
+fn model_to_metadata_draft(
+    model: ingest_metadata_revision::Model,
+) -> Result<PersistedMetadataDraft, IngestRepositoryError> {
+    let job_id = model.job_id;
+    let revision = revision_from_i64(job_id, model.revision, "metadata_revision")?;
+    let digest_length = model.document_sha256.len();
+    let stored_digest = <[u8; Digest::LENGTH]>::try_from(model.document_sha256)
+        .map(Digest::new)
+        .map_err(|_| IngestRepositoryError::InvalidMetadataDigestLength {
+            job_id,
+            revision,
+            actual: digest_length,
+        })?;
+    if sha256(model.document.as_bytes()) != stored_digest {
+        return Err(IngestRepositoryError::MetadataDigestMismatch { job_id, revision });
+    }
+
+    let snapshot: MetadataDraftSnapshot =
+        serde_json::from_str(&model.document).map_err(|source| {
+            IngestRepositoryError::InvalidMetadataDocument {
+                job_id,
+                revision,
+                source,
+            }
+        })?;
+    let draft = MetadataDraft::restore(snapshot).map_err(|source| {
+        IngestRepositoryError::InvalidPersistedMetadata {
+            job_id,
+            revision,
+            source,
+        }
+    })?;
+    if draft.revision() != revision {
+        return Err(IngestRepositoryError::MetadataDocumentRevisionMismatch {
+            job_id,
+            row_revision: revision,
+            document_revision: draft.revision(),
+        });
+    }
+
+    Ok(PersistedMetadataDraft {
+        draft,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+fn sha256(value: &[u8]) -> Digest {
+    let mut hasher = Sha256::new();
+    hasher.update(value);
+    Digest::new(hasher.finalize().into())
+}
+
+fn model_to_versioned(
+    model: ingest_job::Model,
+) -> Result<VersionedIngestJob, IngestRepositoryError> {
+    let job_id = model.job_id;
+    let state = model
+        .state
+        .parse()
+        .map_err(|_| IngestRepositoryError::InvalidState {
+            job_id,
+            state: model.state,
+        })?;
+    let metadata_revision =
+        revision_from_i64(job_id, model.metadata_revision, "metadata_revision")?;
+    let approved_revision =
+        optional_revision_from_i64(job_id, model.approved_revision, "approved_revision")?;
+    let snapshot = IngestJobSnapshot::new(
+        job_id,
+        state,
+        metadata_revision,
+        approved_revision,
+        digest_from_bytes(job_id, "manifest_digest", model.manifest_digest)?,
+        digest_from_bytes(job_id, "plan_digest", model.plan_digest)?,
+        digest_from_bytes(job_id, "verification_digest", model.verification_digest)?,
+    );
+    let job = IngestJob::restore(snapshot)
+        .map_err(|source| IngestRepositoryError::InvalidPersistedJob { job_id, source })?;
+    let row_version = RowVersion::new(u64::try_from(model.row_version).map_err(|_| {
+        IngestRepositoryError::NumericOutOfRange {
+            job_id,
+            field: "row_version",
+        }
+    })?)
+    .ok_or(IngestRepositoryError::NumericOutOfRange {
+        job_id,
+        field: "row_version",
+    })?;
+
+    Ok(VersionedIngestJob {
+        job,
+        row_version,
+        created_at: timestamp(model.created_at),
+        updated_at: timestamp(model.updated_at),
+    })
+}
+
+fn revision_to_i64(
+    job_id: Uuid,
+    revision: MetadataRevision,
+    field: &'static str,
+) -> Result<i64, IngestRepositoryError> {
+    i64::try_from(revision.get())
+        .map_err(|_| IngestRepositoryError::NumericOutOfRange { job_id, field })
+}
+
+fn optional_revision_to_i64(
+    job_id: Uuid,
+    revision: Option<MetadataRevision>,
+    field: &'static str,
+) -> Result<Option<i64>, IngestRepositoryError> {
+    revision
+        .map(|revision| revision_to_i64(job_id, revision, field))
+        .transpose()
+}
+
+fn revision_from_i64(
+    job_id: Uuid,
+    value: i64,
+    field: &'static str,
+) -> Result<MetadataRevision, IngestRepositoryError> {
+    let value = u64::try_from(value)
+        .map_err(|_| IngestRepositoryError::NumericOutOfRange { job_id, field })?;
+    MetadataRevision::new(value).ok_or(IngestRepositoryError::NumericOutOfRange { job_id, field })
+}
+
+fn optional_revision_from_i64(
+    job_id: Uuid,
+    value: Option<i64>,
+    field: &'static str,
+) -> Result<Option<MetadataRevision>, IngestRepositoryError> {
+    value
+        .map(|value| revision_from_i64(job_id, value, field))
+        .transpose()
+}
+
+fn digest_bytes(digest: Option<Digest>) -> Option<Vec<u8>> {
+    digest.map(|digest| digest.as_bytes().to_vec())
+}
+
+fn digest_from_bytes(
+    job_id: Uuid,
+    field: &'static str,
+    bytes: Option<Vec<u8>>,
+) -> Result<Option<Digest>, IngestRepositoryError> {
+    bytes
+        .map(|bytes| {
+            let actual = bytes.len();
+            <[u8; Digest::LENGTH]>::try_from(bytes)
+                .map(Digest::new)
+                .map_err(|_| IngestRepositoryError::InvalidDigestLength {
+                    job_id,
+                    field,
+                    actual,
+                })
+        })
+        .transpose()
+}
diff --git a/annim/src/ingest/service.rs b/annim/src/ingest/service.rs
new file mode 100644
index 00000000..21cb6557
--- /dev/null
+++ b/annim/src/ingest/service.rs
@@ -0,0 +1,397 @@
+use anni_ingest::{
+    Digest, FieldPath, IngestJob, JobError, JobState, MetadataCandidate, MetadataDecision,
+    MetadataDraft, MetadataError, MetadataReviewContext, MetadataRevision,
+};
+use sea_orm::prelude::Uuid;
+use thiserror::Error;
+use tokio::sync::broadcast;
+
+use super::{
+    IngestJobRepository, IngestRepositoryError, PersistedMetadataDraft, RowVersion,
+    VersionedIngestJob,
+};
+
+const EVENT_CHANNEL_CAPACITY: usize = 256;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IngestJobEvent {
+    job: VersionedIngestJob,
+}
+
+impl IngestJobEvent {
+    pub const fn job(&self) -> &VersionedIngestJob {
+        &self.job
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IngestMetadataReview {
+    job: VersionedIngestJob,
+    metadata: PersistedMetadataDraft,
+}
+
+impl IngestMetadataReview {
+    pub const fn job(&self) -> &VersionedIngestJob {
+        &self.job
+    }
+
+    pub const fn metadata(&self) -> &PersistedMetadataDraft {
+        &self.metadata
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum MetadataEdit {
+    ConfigureReview(MetadataReviewContext),
+    AddCandidate(MetadataCandidate),
+    AcceptCandidate(Uuid),
+    RejectCandidate(Uuid),
+}
+
+impl MetadataEdit {
+    fn apply(self, draft: &mut MetadataDraft) -> Result<bool, MetadataError> {
+        match self {
+            Self::ConfigureReview(context) => {
+                if draft.review_context() == Some(&context) {
+                    return Ok(false);
+                }
+                draft.set_review_context(context)?;
+                Ok(true)
+            }
+            Self::AddCandidate(candidate) => {
+                if draft
+                    .candidate(candidate.id())
+                    .is_some_and(|existing| existing == &candidate)
+                {
+                    return Ok(false);
+                }
+                draft.add_candidate(candidate)?;
+                Ok(true)
+            }
+            Self::AcceptCandidate(candidate_id) => {
+                if draft.decision(candidate_id)? == MetadataDecision::Accepted {
+                    return Ok(false);
+                }
+                draft.accept(candidate_id)?;
+                Ok(true)
+            }
+            Self::RejectCandidate(candidate_id) => {
+                if draft.decision(candidate_id)? == MetadataDecision::Rejected {
+                    return Ok(false);
+                }
+                draft.reject(candidate_id)?;
+                Ok(true)
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+struct IngestEventHub {
+    sender: broadcast::Sender<IngestJobEvent>,
+}
+
+impl Default for IngestEventHub {
+    fn default() -> Self {
+        let (sender, _) = broadcast::channel(EVENT_CHANNEL_CAPACITY);
+        Self { sender }
+    }
+}
+
+impl IngestEventHub {
+    fn publish(&self, job: &VersionedIngestJob) {
+        // Having no live Web clients is normal and must not fail a committed
+        // database write.
+        let _ = self.sender.send(IngestJobEvent { job: job.clone() });
+    }
+
+    fn subscribe(&self) -> broadcast::Receiver<IngestJobEvent> {
+        self.sender.subscribe()
+    }
+}
+
+/// Complete command vocabulary shared by Web requests and background workers.
+/// Values are parsed into domain types before this boundary is crossed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum IngestCommand {
+    BeginReview,
+    ApproveRevision {
+        expected_revision: MetadataRevision,
+    },
+    ReviseMetadata {
+        expected_revision: MetadataRevision,
+    },
+    CreatePlan {
+        expected_revision: MetadataRevision,
+        manifest_digest: Digest,
+        plan_digest: Digest,
+    },
+    BeginExecution {
+        plan_digest: Digest,
+    },
+    BeginVerification {
+        plan_digest: Digest,
+    },
+    AcceptVerification {
+        plan_digest: Digest,
+        verification_digest: Digest,
+    },
+    BeginCommit {
+        plan_digest: Digest,
+        verification_digest: Digest,
+    },
+    Publish {
+        plan_digest: Digest,
+        verification_digest: Digest,
+    },
+    Quarantine,
+    Cancel,
+}
+
+impl IngestCommand {
+    fn apply(self, job: &mut IngestJob) -> Result<(), JobError> {
+        match self {
+            Self::BeginReview => job.begin_review(),
+            Self::ApproveRevision { expected_revision } => job.approve_revision(expected_revision),
+            Self::ReviseMetadata { expected_revision } => {
+                job.revise_metadata(expected_revision).map(|_| ())
+            }
+            Self::CreatePlan {
+                expected_revision,
+                manifest_digest,
+                plan_digest,
+            } => job
+                .create_plan(expected_revision, manifest_digest, plan_digest)
+                .map(|_| ()),
+            Self::BeginExecution { plan_digest } => job.begin_execution(plan_digest),
+            Self::BeginVerification { plan_digest } => job.begin_verification(plan_digest),
+            Self::AcceptVerification {
+                plan_digest,
+                verification_digest,
+            } => job
+                .accept_verification(plan_digest, verification_digest)
+                .map(|_| ()),
+            Self::BeginCommit {
+                plan_digest,
+                verification_digest,
+            } => job.begin_commit(plan_digest, verification_digest),
+            Self::Publish {
+                plan_digest,
+                verification_digest,
+            } => job.publish(plan_digest, verification_digest),
+            Self::Quarantine => job.quarantine(),
+            Self::Cancel => job.cancel(),
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum IngestServiceError {
+    #[error(transparent)]
+    Repository(#[from] IngestRepositoryError),
+    #[error(transparent)]
+    Domain(#[from] JobError),
+    #[error(transparent)]
+    Metadata(#[from] MetadataError),
+    #[error("metadata revision is incomplete")]
+    MetadataIncomplete { missing: Vec<FieldPath> },
+}
+
+#[derive(Clone)]
+pub struct IngestService {
+    repository: IngestJobRepository,
+    events: IngestEventHub,
+}
+
+impl IngestService {
+    pub fn new(repository: IngestJobRepository) -> Self {
+        Self {
+            repository,
+            events: IngestEventHub::default(),
+        }
+    }
+
+    pub async fn create(
+        &self,
+        job_id: Option<Uuid>,
+    ) -> Result<VersionedIngestJob, IngestServiceError> {
+        let job = IngestJob::new(job_id.unwrap_or_else(Uuid::new_v4));
+        let versioned = self.repository.create(&job).await?;
+        self.events.publish(&versioned);
+        Ok(versioned)
+    }
+
+    pub async fn get(
+        &self,
+        job_id: Uuid,
+    ) -> Result<Option<VersionedIngestJob>, IngestServiceError> {
+        Ok(self.repository.get(job_id).await?)
+    }
+
+    pub async fn list(
+        &self,
+        state: Option<JobState>,
+        limit: u64,
+        offset: u64,
+    ) -> Result<Vec<VersionedIngestJob>, IngestServiceError> {
+        Ok(self.repository.list(state, limit, offset).await?)
+    }
+
+    pub async fn metadata(
+        &self,
+        job_id: Uuid,
+        revision: Option<MetadataRevision>,
+    ) -> Result<Option<IngestMetadataReview>, IngestServiceError> {
+        let Some(job) = self.repository.get(job_id).await? else {
+            return Ok(None);
+        };
+        let revision = revision.unwrap_or_else(|| job.job().metadata_revision());
+        let Some(metadata) = self.repository.get_metadata_draft(job_id, revision).await? else {
+            return Ok(None);
+        };
+        Ok(Some(IngestMetadataReview { job, metadata }))
+    }
+
+    pub async fn metadata_revisions(
+        &self,
+        job_id: Uuid,
+    ) -> Result<Vec<PersistedMetadataDraft>, IngestServiceError> {
+        if self.repository.get(job_id).await?.is_none() {
+            return Err(IngestRepositoryError::NotFound { job_id }.into());
+        }
+        Ok(self.repository.list_metadata_revisions(job_id).await?)
+    }
+
+    pub async fn edit_metadata(
+        &self,
+        job_id: Uuid,
+        expected_row_version: RowVersion,
+        expected_revision: MetadataRevision,
+        edit: MetadataEdit,
+    ) -> Result<IngestMetadataReview, IngestServiceError> {
+        let mut versioned = self
+            .repository
+            .get(job_id)
+            .await?
+            .ok_or(IngestRepositoryError::NotFound { job_id })?;
+        if versioned.row_version() != expected_row_version {
+            return Err(IngestRepositoryError::ConcurrentModification {
+                job_id,
+                expected: expected_row_version,
+                actual: versioned.row_version(),
+            }
+            .into());
+        }
+        if versioned.job().metadata_revision() != expected_revision {
+            return Err(JobError::RevisionConflict {
+                expected: expected_revision,
+                actual: versioned.job().metadata_revision(),
+            }
+            .into());
+        }
+        if versioned.job().state() != JobState::Reviewing
+            || versioned.job().approved_revision() == Some(expected_revision)
+        {
+            return Err(IngestRepositoryError::MetadataFrozen {
+                job_id,
+                revision: expected_revision,
+            }
+            .into());
+        }
+
+        let persisted = self
+            .repository
+            .get_metadata_draft(job_id, expected_revision)
+            .await?
+            .ok_or(IngestRepositoryError::MetadataNotFound {
+                job_id,
+                revision: expected_revision,
+            })?;
+        let mut draft = persisted.draft().clone();
+        if !edit.apply(&mut draft)? {
+            return Ok(IngestMetadataReview {
+                job: versioned,
+                metadata: persisted,
+            });
+        }
+
+        let metadata = self
+            .repository
+            .save_with_metadata(&mut versioned, &draft)
+            .await?;
+        self.events.publish(&versioned);
+        Ok(IngestMetadataReview {
+            job: versioned,
+            metadata,
+        })
+    }
+
+    pub async fn execute(
+        &self,
+        job_id: Uuid,
+        expected_row_version: RowVersion,
+        command: IngestCommand,
+    ) -> Result<VersionedIngestJob, IngestServiceError> {
+        let mut versioned = self
+            .repository
+            .get(job_id)
+            .await?
+            .ok_or(IngestRepositoryError::NotFound { job_id })?;
+
+        if versioned.row_version() != expected_row_version {
+            return Err(IngestRepositoryError::ConcurrentModification {
+                job_id,
+                expected: expected_row_version,
+                actual: versioned.row_version(),
+            }
+            .into());
+        }
+
+        let metadata = if matches!(
+            command,
+            IngestCommand::ApproveRevision { .. } | IngestCommand::ReviseMetadata { .. }
+        ) {
+            let revision = versioned.job().metadata_revision();
+            Some(
+                self.repository
+                    .get_metadata_draft(job_id, revision)
+                    .await?
+                    .ok_or(IngestRepositoryError::MetadataNotFound { job_id, revision })?,
+            )
+        } else {
+            None
+        };
+
+        if matches!(command, IngestCommand::ApproveRevision { .. }) {
+            let completeness = metadata
+                .as_ref()
+                .expect("approval loads current metadata")
+                .draft()
+                .review_completeness()?;
+            if !completeness.is_complete() {
+                return Err(IngestServiceError::MetadataIncomplete {
+                    missing: completeness.missing().to_vec(),
+                });
+            }
+        }
+
+        command.apply(versioned.job_mut())?;
+        if matches!(command, IngestCommand::ReviseMetadata { .. }) {
+            let fork = metadata
+                .expect("revision loads current metadata")
+                .into_draft()
+                .fork(versioned.job().metadata_revision())?;
+            self.repository
+                .save_with_metadata(&mut versioned, &fork)
+                .await?;
+        } else {
+            self.repository.save(&mut versioned).await?;
+        }
+        self.events.publish(&versioned);
+        Ok(versioned)
+    }
+
+    pub fn subscribe(&self) -> broadcast::Receiver<IngestJobEvent> {
+        self.events.subscribe()
+    }
+}
diff --git a/annim/src/lib.rs b/annim/src/lib.rs
index 4aa80416..bf0a2145 100644
--- a/annim/src/lib.rs
+++ b/annim/src/lib.rs
@@ -1,5 +1,12 @@
 pub mod auth;
+pub mod catalog;
+pub mod config;
+pub mod cover;
+pub mod cover_worker;
 pub mod entities;
 pub mod graphql;
+pub mod ingest;
 pub mod migrator;
 pub mod search;
+pub mod server;
+mod web;
diff --git a/annim/src/main.rs b/annim/src/main.rs
index 4f5598a4..55934b3f 100644
--- a/annim/src/main.rs
+++ b/annim/src/main.rs
@@ -1,61 +1,14 @@
 use annim::{
-    auth::{on_connection_init, AuthToken},
-    graphql::{MetadataMutation, MetadataQuery, MetadataSchema},
+    auth::AuthConfig,
+    catalog::CatalogSyncService,
+    config::{CatalogSyncProvisioningConfig, ServerConfig},
+    graphql::schema_builder_with_catalog_sync_service,
     search::RepositorySearchManager,
-};
-use async_graphql::{
-    http::{graphiql_source, ALL_WEBSOCKET_PROTOCOLS},
-    EmptySubscription,
-};
-use async_graphql_axum::{GraphQLProtocol, GraphQLRequest, GraphQLResponse, GraphQLWebSocket};
-use axum::{
-    extract::{State, WebSocketUpgrade},
-    http::{HeaderMap, Method},
-    response::{self, IntoResponse, Response},
-    routing::get,
-    Router,
+    server::{build_router, ServerState},
 };
 use sea_orm::Database;
 use sea_orm_migration::MigratorTrait;
 use tokio::net::TcpListener;
-use tower_http::cors;
-use tower_http::cors::CorsLayer;
-
-async fn graphql_playground() -> impl IntoResponse {
-    response::Html(graphiql_source("/", None))
-}
-
-fn get_token_from_headers(headers: &HeaderMap) -> Option<AuthToken> {
-    headers
-        .get("Authorization")
-        .and_then(|value| value.to_str().map(|s| AuthToken::new(s.to_string())).ok())
-}
-
-async fn graphql_handler(
-    State(schema): State<MetadataSchema>,
-    headers: HeaderMap,
-    req: GraphQLRequest,
-) -> GraphQLResponse {
-    let mut req = req.into_inner();
-    if let Some(token) = get_token_from_headers(&headers) {
-        req = req.data(token);
-    }
-    schema.execute(req).await.into()
-}
-
-async fn graphql_ws_handler(
-    State(schema): State<MetadataSchema>,
-    protocol: GraphQLProtocol,
-    websocket: WebSocketUpgrade,
-) -> Response {
-    websocket
-        .protocols(ALL_WEBSOCKET_PROTOCOLS)
-        .on_upgrade(move |stream| {
-            GraphQLWebSocket::new(stream, schema.clone(), protocol)
-                .on_connection_init(on_connection_init)
-                .serve()
-        })
-}
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -65,34 +18,38 @@ async fn main() -> anyhow::Result<()> {
         .init();
 
     let database_url = std::env::var("ANNIM_DATABASE_URL")?;
-    let database = Database::connect(database_url)
-        .await
-        .expect("Fail to initialize database connection");
+    let auth = AuthConfig::from_env()?;
+    let server_config = ServerConfig::from_env()?;
+    let catalog_sync_provisioning = CatalogSyncProvisioningConfig::from_env()?;
+    let database = Database::connect(database_url).await?;
 
     annim::migrator::Migrator::up(&database, None).await?;
 
+    let catalog_sync_service =
+        CatalogSyncService::with_provisioning(database.clone(), catalog_sync_provisioning);
+    let provisioned_sources = catalog_sync_service.provision_existing_sources().await?;
+    if provisioned_sources > 0 {
+        tracing::info!(
+            source_count = provisioned_sources,
+            "provisioned existing Apple Music catalog sources"
+        );
+    }
+
     let searcher_directory = std::env::var("ANNIM_SEARCH_DIRECTORY")?;
     std::fs::create_dir_all(&searcher_directory)?;
     let searcher = RepositorySearchManager::open_or_create(searcher_directory)?;
-
-    let schema = MetadataSchema::build(MetadataQuery, MetadataMutation, EmptySubscription)
-        .data(database)
+    let schema = schema_builder_with_catalog_sync_service(database.clone(), catalog_sync_service)
         .data(searcher)
         .finish();
+    let state = ServerState::new(schema, auth, database);
+    let app = build_router(state, &server_config);
 
-    let app = Router::new()
-        .route("/", get(graphql_playground).post(graphql_handler))
-        .route("/ws", get(graphql_ws_handler))
-        .layer(
-            CorsLayer::new()
-                .allow_methods([Method::GET, Method::POST])
-                .allow_origin(cors::Any)
-                .allow_headers(cors::Any),
-        )
-        .with_state(schema);
-
-    println!("Playground: http://localhost:8000");
-    axum::serve(TcpListener::bind("0.0.0.0:8000").await?, app).await?;
+    let bind_addr = server_config.bind_addr();
+    tracing::info!(%bind_addr, "Annim server listening");
+    if !bind_addr.ip().is_loopback() {
+        tracing::warn!("non-loopback listeners should be protected by a TLS reverse proxy");
+    }
+    axum::serve(TcpListener::bind(bind_addr).await?, app).await?;
 
     Ok(())
 }
diff --git a/annim/src/migrator/m20240905_000004_album_extra_jsonb.rs b/annim/src/migrator/m20240905_000004_album_extra_jsonb.rs
index 476bb4fa..0b5e967e 100644
--- a/annim/src/migrator/m20240905_000004_album_extra_jsonb.rs
+++ b/annim/src/migrator/m20240905_000004_album_extra_jsonb.rs
@@ -14,27 +14,33 @@ impl MigrationName for Migration {
 #[async_trait::async_trait]
 impl MigrationTrait for Migration {
     async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
-        manager
-            .alter_table(
-                Table::alter()
-                    .table(Album::Table)
-                    .modify_column(json_binary_null(Album::Extra))
-                    .to_owned(),
-            )
-            .await?;
+        // SQLite has a single JSON storage representation and does not support
+        // ALTER COLUMN. The JSON -> JSONB distinction only exists on Postgres.
+        if manager.get_database_backend() == sea_orm::DatabaseBackend::Postgres {
+            manager
+                .alter_table(
+                    Table::alter()
+                        .table(Album::Table)
+                        .modify_column(json_binary_null(Album::Extra))
+                        .to_owned(),
+                )
+                .await?;
+        }
 
         Ok(())
     }
 
     async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
-        manager
-            .alter_table(
-                Table::alter()
-                    .table(Album::Table)
-                    .modify_column(json_null(Album::Extra))
-                    .to_owned(),
-            )
-            .await?;
+        if manager.get_database_backend() == sea_orm::DatabaseBackend::Postgres {
+            manager
+                .alter_table(
+                    Table::alter()
+                        .table(Album::Table)
+                        .modify_column(json_null(Album::Extra))
+                        .to_owned(),
+                )
+                .await?;
+        }
 
         Ok(())
     }
diff --git a/annim/src/migrator/m20260712_000005_create_ingest_job.rs b/annim/src/migrator/m20260712_000005_create_ingest_job.rs
new file mode 100644
index 00000000..31e5ef8e
--- /dev/null
+++ b/annim/src/migrator/m20260712_000005_create_ingest_job.rs
@@ -0,0 +1,66 @@
+use anni_ingest::{Digest, JobState};
+use sea_orm_migration::{prelude::*, schema::*};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000005_create_ingest_job"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(IngestJob::Table)
+                    .col(pk_auto(IngestJob::Id))
+                    .col(uuid_uniq(IngestJob::JobId))
+                    .col(string(IngestJob::State).default(JobState::Created.as_str()))
+                    .col(big_integer(IngestJob::MetadataRevision).default(1))
+                    .col(big_integer_null(IngestJob::ApprovedRevision))
+                    .col(binary_len_null(
+                        IngestJob::ManifestDigest,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(binary_len_null(
+                        IngestJob::PlanDigest,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(binary_len_null(
+                        IngestJob::VerificationDigest,
+                        Digest::LENGTH as u32,
+                    ))
+                    // Used by the repository layer for optimistic concurrency.
+                    .col(big_integer(IngestJob::RowVersion).default(1))
+                    .col(timestamp(IngestJob::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(IngestJob::UpdatedAt).default(Expr::current_timestamp()))
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(IngestJob::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(Iden)]
+pub(crate) enum IngestJob {
+    Table,
+    Id,
+    JobId,
+    State,
+    MetadataRevision,
+    ApprovedRevision,
+    ManifestDigest,
+    PlanDigest,
+    VerificationDigest,
+    RowVersion,
+    CreatedAt,
+    UpdatedAt,
+}
diff --git a/annim/src/migrator/m20260712_000006_create_ingest_metadata_revision.rs b/annim/src/migrator/m20260712_000006_create_ingest_metadata_revision.rs
new file mode 100644
index 00000000..e79b6c7c
--- /dev/null
+++ b/annim/src/migrator/m20260712_000006_create_ingest_metadata_revision.rs
@@ -0,0 +1,84 @@
+use anni_ingest::Digest;
+use sea_orm_migration::{prelude::*, schema::*};
+
+use super::m20260712_000005_create_ingest_job::IngestJob;
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000006_create_ingest_metadata_revision"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(IngestMetadataRevision::Table)
+                    .col(pk_auto(IngestMetadataRevision::Id))
+                    .col(uuid(IngestMetadataRevision::JobId))
+                    .col(big_integer(IngestMetadataRevision::Revision))
+                    // JSON is stored as text so SQLite and PostgreSQL use the
+                    // same representation and preserve every Unicode scalar.
+                    .col(text(IngestMetadataRevision::Document))
+                    .col(binary_len(
+                        IngestMetadataRevision::DocumentSha256,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(
+                        timestamp(IngestMetadataRevision::CreatedAt)
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        timestamp(IngestMetadataRevision::UpdatedAt)
+                            .default(Expr::current_timestamp()),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-ingest-metadata-revision-job")
+                            .from(IngestMetadataRevision::Table, IngestMetadataRevision::JobId)
+                            .to(IngestJob::Table, IngestJob::JobId)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-ingest-metadata-revision-identity")
+                    .table(IngestMetadataRevision::Table)
+                    .col(IngestMetadataRevision::JobId)
+                    .col(IngestMetadataRevision::Revision)
+                    .unique()
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(IngestMetadataRevision::Table)
+                    .to_owned(),
+            )
+            .await
+    }
+}
+
+#[derive(Iden)]
+enum IngestMetadataRevision {
+    Table,
+    Id,
+    JobId,
+    Revision,
+    Document,
+    DocumentSha256,
+    CreatedAt,
+    UpdatedAt,
+}
diff --git a/annim/src/migrator/m20260712_000007_create_catalog_collection.rs b/annim/src/migrator/m20260712_000007_create_catalog_collection.rs
new file mode 100644
index 00000000..a3476123
--- /dev/null
+++ b/annim/src/migrator/m20260712_000007_create_catalog_collection.rs
@@ -0,0 +1,209 @@
+use anni_catalog::ReleaseKind;
+use anni_ingest::Digest;
+use sea_orm_migration::{prelude::*, schema::*};
+
+use super::{
+    helper::pk_foreign, m20240817_000001_create_basic_tables::Album,
+    m20260712_000005_create_ingest_job::IngestJob,
+};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000007_create_catalog_collection"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogArtist::Table)
+                    .col(pk_auto(CatalogArtist::Id))
+                    .col(uuid_uniq(CatalogArtist::ArtistId))
+                    .col(string(CatalogArtist::DisplayName))
+                    .col(string_null(CatalogArtist::SortName))
+                    .col(text_null(CatalogArtist::Notes))
+                    .col(big_integer(CatalogArtist::RowVersion).default(1))
+                    .col(timestamp(CatalogArtist::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CatalogArtist::UpdatedAt).default(Expr::current_timestamp()))
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogRelease::Table)
+                    .col(pk_auto(CatalogRelease::Id))
+                    .col(uuid_uniq(CatalogRelease::ReleaseId))
+                    .col(pk_foreign(CatalogRelease::ArtistDbId))
+                    .col(string(CatalogRelease::Title))
+                    .col(string_null(CatalogRelease::Edition))
+                    .col(string_null(CatalogRelease::Catalog))
+                    // A string preserves year-only and year-month precision.
+                    .col(string_null(CatalogRelease::ReleaseDate))
+                    .col(string(CatalogRelease::Kind).default(ReleaseKind::Album.as_str()))
+                    .col(boolean(CatalogRelease::Wanted).default(false))
+                    .col(boolean(CatalogRelease::Unavailable).default(false))
+                    .col(uuid_null(CatalogRelease::MatchedAlbumId))
+                    .col(uuid_null(CatalogRelease::ActiveIngestJobId))
+                    .col(text_null(CatalogRelease::Notes))
+                    .col(big_integer(CatalogRelease::RowVersion).default(1))
+                    .col(timestamp(CatalogRelease::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CatalogRelease::UpdatedAt).default(Expr::current_timestamp()))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-release-artist")
+                            .from(CatalogRelease::Table, CatalogRelease::ArtistDbId)
+                            .to(CatalogArtist::Table, CatalogArtist::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-release-album")
+                            .from(CatalogRelease::Table, CatalogRelease::MatchedAlbumId)
+                            .to(Album::Table, Album::AlbumId)
+                            .on_delete(ForeignKeyAction::SetNull),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-release-ingest-job")
+                            .from(CatalogRelease::Table, CatalogRelease::ActiveIngestJobId)
+                            .to(IngestJob::Table, IngestJob::JobId)
+                            .on_delete(ForeignKeyAction::SetNull),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-release-artist")
+                    .table(CatalogRelease::Table)
+                    .col(CatalogRelease::ArtistDbId)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CollectionCopy::Table)
+                    .col(pk_auto(CollectionCopy::Id))
+                    .col(uuid_uniq(CollectionCopy::CopyId))
+                    .col(pk_foreign(CollectionCopy::ReleaseDbId))
+                    .col(string(CollectionCopy::SourceKind))
+                    .col(string(CollectionCopy::SourceLabel))
+                    // Locators can contain private tracker or local path data;
+                    // public GraphQL output must not expose this column.
+                    .col(text_null(CollectionCopy::PrivateLocator))
+                    .col(string(CollectionCopy::Codec))
+                    .col(integer_null(CollectionCopy::SampleRateHz))
+                    .col(small_integer_null(CollectionCopy::BitDepth))
+                    .col(small_integer_null(CollectionCopy::Channels))
+                    .col(integer_null(CollectionCopy::TrackCount))
+                    .col(big_integer_null(CollectionCopy::ByteLength))
+                    .col(binary_len_null(
+                        CollectionCopy::ManifestDigest,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(boolean(CollectionCopy::QualityVerified).default(false))
+                    .col(uuid_null(CollectionCopy::IngestJobId))
+                    .col(text_null(CollectionCopy::Notes))
+                    .col(timestamp(CollectionCopy::AcquiredAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CollectionCopy::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CollectionCopy::UpdatedAt).default(Expr::current_timestamp()))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-collection-copy-release")
+                            .from(CollectionCopy::Table, CollectionCopy::ReleaseDbId)
+                            .to(CatalogRelease::Table, CatalogRelease::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-collection-copy-ingest-job")
+                            .from(CollectionCopy::Table, CollectionCopy::IngestJobId)
+                            .to(IngestJob::Table, IngestJob::JobId)
+                            .on_delete(ForeignKeyAction::SetNull),
+                    )
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(CollectionCopy::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CatalogRelease::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CatalogArtist::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogArtist {
+    Table,
+    Id,
+    ArtistId,
+    DisplayName,
+    SortName,
+    Notes,
+    RowVersion,
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogRelease {
+    Table,
+    Id,
+    ReleaseId,
+    ArtistDbId,
+    Title,
+    Edition,
+    Catalog,
+    ReleaseDate,
+    Kind,
+    Wanted,
+    Unavailable,
+    MatchedAlbumId,
+    ActiveIngestJobId,
+    Notes,
+    RowVersion,
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CollectionCopy {
+    Table,
+    Id,
+    CopyId,
+    ReleaseDbId,
+    SourceKind,
+    SourceLabel,
+    PrivateLocator,
+    Codec,
+    SampleRateHz,
+    BitDepth,
+    Channels,
+    TrackCount,
+    ByteLength,
+    ManifestDigest,
+    QualityVerified,
+    IngestJobId,
+    Notes,
+    AcquiredAt,
+    CreatedAt,
+    UpdatedAt,
+}
diff --git a/annim/src/migrator/m20260712_000008_create_catalog_sources.rs b/annim/src/migrator/m20260712_000008_create_catalog_sources.rs
new file mode 100644
index 00000000..e44d186d
--- /dev/null
+++ b/annim/src/migrator/m20260712_000008_create_catalog_sources.rs
@@ -0,0 +1,280 @@
+use anni_catalog::SyncRunStatus;
+use anni_ingest::Digest;
+use sea_orm_migration::{prelude::*, schema::*};
+
+use super::{
+    helper::pk_foreign,
+    m20260712_000007_create_catalog_collection::{CatalogArtist, CatalogRelease},
+};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000008_create_catalog_sources"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogSource::Table)
+                    .col(pk_auto(CatalogSource::Id))
+                    .col(uuid_uniq(CatalogSource::SourceId))
+                    .col(pk_foreign(CatalogSource::ArtistDbId))
+                    .col(string(CatalogSource::Kind))
+                    .col(string(CatalogSource::Locator))
+                    .col(string_null(CatalogSource::Storefront))
+                    .col(string_null(CatalogSource::Locale))
+                    .col(text_null(CatalogSource::ConfigurationDocument))
+                    // Credentials live outside the database; this is only a
+                    // reference understood by the worker runtime.
+                    .col(string_null(CatalogSource::SecretRef))
+                    .col(boolean(CatalogSource::Enabled).default(true))
+                    .col(big_integer(CatalogSource::RowVersion).default(1))
+                    .col(timestamp(CatalogSource::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CatalogSource::UpdatedAt).default(Expr::current_timestamp()))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-source-artist")
+                            .from(CatalogSource::Table, CatalogSource::ArtistDbId)
+                            .to(CatalogArtist::Table, CatalogArtist::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-source-identity")
+                    .table(CatalogSource::Table)
+                    .col(CatalogSource::ArtistDbId)
+                    .col(CatalogSource::Kind)
+                    .col(CatalogSource::Locator)
+                    .unique()
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogSyncRun::Table)
+                    .col(pk_auto(CatalogSyncRun::Id))
+                    .col(uuid_uniq(CatalogSyncRun::RunId))
+                    .col(pk_foreign(CatalogSyncRun::SourceDbId))
+                    .col(string(CatalogSyncRun::Status).default(SyncRunStatus::Queued.as_str()))
+                    .col(text_null(CatalogSyncRun::RequestedCursor))
+                    .col(text_null(CatalogSyncRun::ResultCursor))
+                    .col(integer(CatalogSyncRun::ObservedCount).default(0))
+                    .col(text_null(CatalogSyncRun::ErrorMessage))
+                    .col(big_integer(CatalogSyncRun::RowVersion).default(1))
+                    .col(timestamp(CatalogSyncRun::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp_null(CatalogSyncRun::StartedAt))
+                    .col(timestamp_null(CatalogSyncRun::FinishedAt))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-sync-run-source")
+                            .from(CatalogSyncRun::Table, CatalogSyncRun::SourceDbId)
+                            .to(CatalogSource::Table, CatalogSource::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogSourceRelease::Table)
+                    .col(pk_auto(CatalogSourceRelease::Id))
+                    .col(uuid_uniq(CatalogSourceRelease::SourceReleaseId))
+                    .col(pk_foreign(CatalogSourceRelease::SourceDbId))
+                    .col(string(CatalogSourceRelease::ExternalReleaseId))
+                    .col(text(CatalogSourceRelease::SourceUrl))
+                    .col(integer_null(CatalogSourceRelease::LinkedReleaseDbId))
+                    .col(
+                        timestamp(CatalogSourceRelease::FirstSeenAt)
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        timestamp(CatalogSourceRelease::LastSeenAt)
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(timestamp_null(CatalogSourceRelease::NotSeenSince))
+                    .col(big_integer(CatalogSourceRelease::RowVersion).default(1))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-source-release-source")
+                            .from(
+                                CatalogSourceRelease::Table,
+                                CatalogSourceRelease::SourceDbId,
+                            )
+                            .to(CatalogSource::Table, CatalogSource::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-source-release-target")
+                            .from(
+                                CatalogSourceRelease::Table,
+                                CatalogSourceRelease::LinkedReleaseDbId,
+                            )
+                            .to(CatalogRelease::Table, CatalogRelease::Id)
+                            .on_delete(ForeignKeyAction::SetNull),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-source-release-external-id")
+                    .table(CatalogSourceRelease::Table)
+                    .col(CatalogSourceRelease::SourceDbId)
+                    .col(CatalogSourceRelease::ExternalReleaseId)
+                    .unique()
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CatalogSourceReleaseRevision::Table)
+                    .col(pk_auto(CatalogSourceReleaseRevision::Id))
+                    .col(pk_foreign(CatalogSourceReleaseRevision::SourceReleaseDbId))
+                    .col(big_integer(CatalogSourceReleaseRevision::Revision))
+                    .col(uuid(CatalogSourceReleaseRevision::SyncRunId))
+                    .col(text(CatalogSourceReleaseRevision::RawDocument))
+                    .col(text(CatalogSourceReleaseRevision::ParsedDocument))
+                    .col(binary_len(
+                        CatalogSourceReleaseRevision::RawSha256,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(
+                        timestamp(CatalogSourceReleaseRevision::ObservedAt)
+                            .default(Expr::current_timestamp()),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-source-release-revision-release")
+                            .from(
+                                CatalogSourceReleaseRevision::Table,
+                                CatalogSourceReleaseRevision::SourceReleaseDbId,
+                            )
+                            .to(CatalogSourceRelease::Table, CatalogSourceRelease::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-catalog-source-release-revision-run")
+                            .from(
+                                CatalogSourceReleaseRevision::Table,
+                                CatalogSourceReleaseRevision::SyncRunId,
+                            )
+                            .to(CatalogSyncRun::Table, CatalogSyncRun::RunId)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-source-release-revision")
+                    .table(CatalogSourceReleaseRevision::Table)
+                    .col(CatalogSourceReleaseRevision::SourceReleaseDbId)
+                    .col(CatalogSourceReleaseRevision::Revision)
+                    .unique()
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(CatalogSourceReleaseRevision::Table)
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CatalogSourceRelease::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CatalogSyncRun::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CatalogSource::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogSource {
+    Table,
+    Id,
+    SourceId,
+    ArtistDbId,
+    Kind,
+    Locator,
+    Storefront,
+    Locale,
+    ConfigurationDocument,
+    SecretRef,
+    Enabled,
+    RowVersion,
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogSyncRun {
+    Table,
+    Id,
+    RunId,
+    SourceDbId,
+    Status,
+    RequestedCursor,
+    ResultCursor,
+    ObservedCount,
+    ErrorMessage,
+    RowVersion,
+    CreatedAt,
+    StartedAt,
+    FinishedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogSourceRelease {
+    Table,
+    Id,
+    SourceReleaseId,
+    SourceDbId,
+    ExternalReleaseId,
+    SourceUrl,
+    LinkedReleaseDbId,
+    FirstSeenAt,
+    LastSeenAt,
+    NotSeenSince,
+    RowVersion,
+}
+
+#[derive(Iden)]
+pub(crate) enum CatalogSourceReleaseRevision {
+    Table,
+    Id,
+    SourceReleaseDbId,
+    Revision,
+    SyncRunId,
+    RawDocument,
+    ParsedDocument,
+    RawSha256,
+    ObservedAt,
+}
diff --git a/annim/src/migrator/m20260712_000009_create_cover_assets.rs b/annim/src/migrator/m20260712_000009_create_cover_assets.rs
new file mode 100644
index 00000000..5cb44295
--- /dev/null
+++ b/annim/src/migrator/m20260712_000009_create_cover_assets.rs
@@ -0,0 +1,253 @@
+use anni_catalog::CoverCandidateState;
+use anni_ingest::Digest;
+use sea_orm_migration::{prelude::*, schema::*};
+
+use super::{
+    helper::pk_foreign, m20260712_000007_create_catalog_collection::CatalogRelease,
+    m20260712_000008_create_catalog_sources::CatalogSourceReleaseRevision,
+};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000009_create_cover_assets"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(CoverAsset::Table)
+                    .col(pk_auto(CoverAsset::Id))
+                    .col(uuid_uniq(CoverAsset::AssetId))
+                    // The immutable original is addressed by its bytes, not
+                    // by a mutable remote URL or filename.
+                    .col(binary_len_uniq(
+                        CoverAsset::ContentSha256,
+                        Digest::LENGTH as u32,
+                    ))
+                    .col(string_uniq(CoverAsset::StorageKey))
+                    .col(string(CoverAsset::MediaType))
+                    .col(integer(CoverAsset::Width))
+                    .col(integer(CoverAsset::Height))
+                    .col(big_integer(CoverAsset::ByteLength))
+                    .col(timestamp(CoverAsset::FetchedAt))
+                    .col(timestamp(CoverAsset::VerifiedAt))
+                    .col(timestamp(CoverAsset::CreatedAt).default(Expr::current_timestamp()))
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CoverCandidate::Table)
+                    .col(pk_auto(CoverCandidate::Id))
+                    .col(uuid_uniq(CoverCandidate::CandidateId))
+                    .col(pk_foreign(CoverCandidate::ReleaseDbId))
+                    // Zero means the release-level cover; positive values are
+                    // one-based disc numbers.
+                    .col(small_integer(CoverCandidate::DiscNumber).default(0))
+                    .col(string(CoverCandidate::SourceKind))
+                    .col(integer_null(CoverCandidate::SourceReleaseRevisionDbId))
+                    // All URL forms remain available for audit and fallback.
+                    // Manual uploads may start with no URL and an asset.
+                    .col(text_null(CoverCandidate::SubmittedUrl))
+                    .col(text_null(CoverCandidate::CanonicalUrl))
+                    .col(text_null(CoverCandidate::EffectiveUrl))
+                    .col(
+                        string(CoverCandidate::State)
+                            .default(CoverCandidateState::Discovered.as_str()),
+                    )
+                    .col(integer_null(CoverCandidate::AssetDbId))
+                    .col(integer(CoverCandidate::AttemptCount).default(0))
+                    .col(uuid_null(CoverCandidate::LeaseToken))
+                    .col(timestamp_null(CoverCandidate::LeaseExpiresAt))
+                    .col(timestamp_null(CoverCandidate::NextAttemptAt))
+                    .col(integer_null(CoverCandidate::LastHttpStatus))
+                    .col(string_null(CoverCandidate::LastErrorCode))
+                    // Error messages are sanitized before persistence because
+                    // source URLs may contain secret query parameters.
+                    .col(text_null(CoverCandidate::LastErrorMessage))
+                    .col(timestamp_null(CoverCandidate::FetchedAt))
+                    .col(big_integer(CoverCandidate::RowVersion).default(1))
+                    .col(timestamp(CoverCandidate::CreatedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CoverCandidate::UpdatedAt).default(Expr::current_timestamp()))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-candidate-release")
+                            .from(CoverCandidate::Table, CoverCandidate::ReleaseDbId)
+                            .to(CatalogRelease::Table, CatalogRelease::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-candidate-asset")
+                            .from(CoverCandidate::Table, CoverCandidate::AssetDbId)
+                            .to(CoverAsset::Table, CoverAsset::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-candidate-source-revision")
+                            .from(
+                                CoverCandidate::Table,
+                                CoverCandidate::SourceReleaseRevisionDbId,
+                            )
+                            .to(
+                                CatalogSourceReleaseRevision::Table,
+                                CatalogSourceReleaseRevision::Id,
+                            )
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-cover-candidate-release")
+                    .table(CoverCandidate::Table)
+                    .col(CoverCandidate::ReleaseDbId)
+                    .col(CoverCandidate::DiscNumber)
+                    .col(CoverCandidate::State)
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-cover-candidate-claim")
+                    .table(CoverCandidate::Table)
+                    .col(CoverCandidate::State)
+                    .col(CoverCandidate::NextAttemptAt)
+                    .col(CoverCandidate::LeaseExpiresAt)
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_table(
+                Table::create()
+                    .table(CoverSelection::Table)
+                    .col(pk_auto(CoverSelection::Id))
+                    .col(uuid_uniq(CoverSelection::SelectionId))
+                    .col(pk_foreign(CoverSelection::ReleaseDbId))
+                    .col(small_integer(CoverSelection::DiscNumber).default(0))
+                    .col(pk_foreign(CoverSelection::CandidateDbId))
+                    // Freeze the selected bytes independently from mutable
+                    // candidate processing fields.
+                    .col(pk_foreign(CoverSelection::AssetDbId))
+                    .col(big_integer(CoverSelection::RowVersion).default(1))
+                    .col(timestamp(CoverSelection::SelectedAt).default(Expr::current_timestamp()))
+                    .col(timestamp(CoverSelection::UpdatedAt).default(Expr::current_timestamp()))
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-selection-release")
+                            .from(CoverSelection::Table, CoverSelection::ReleaseDbId)
+                            .to(CatalogRelease::Table, CatalogRelease::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-selection-candidate")
+                            .from(CoverSelection::Table, CoverSelection::CandidateDbId)
+                            .to(CoverCandidate::Table, CoverCandidate::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-cover-selection-asset")
+                            .from(CoverSelection::Table, CoverSelection::AssetDbId)
+                            .to(CoverAsset::Table, CoverAsset::Id)
+                            .on_delete(ForeignKeyAction::Restrict),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-cover-selection-scope")
+                    .table(CoverSelection::Table)
+                    .col(CoverSelection::ReleaseDbId)
+                    .col(CoverSelection::DiscNumber)
+                    .unique()
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(CoverSelection::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CoverCandidate::Table).to_owned())
+            .await?;
+        manager
+            .drop_table(Table::drop().table(CoverAsset::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(Iden)]
+pub(crate) enum CoverAsset {
+    Table,
+    Id,
+    AssetId,
+    ContentSha256,
+    StorageKey,
+    MediaType,
+    Width,
+    Height,
+    ByteLength,
+    FetchedAt,
+    VerifiedAt,
+    CreatedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CoverCandidate {
+    Table,
+    Id,
+    CandidateId,
+    ReleaseDbId,
+    DiscNumber,
+    SourceKind,
+    SourceReleaseRevisionDbId,
+    SubmittedUrl,
+    CanonicalUrl,
+    EffectiveUrl,
+    State,
+    AssetDbId,
+    AttemptCount,
+    LeaseToken,
+    LeaseExpiresAt,
+    NextAttemptAt,
+    LastHttpStatus,
+    LastErrorCode,
+    LastErrorMessage,
+    FetchedAt,
+    RowVersion,
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[derive(Iden)]
+pub(crate) enum CoverSelection {
+    Table,
+    Id,
+    SelectionId,
+    ReleaseDbId,
+    DiscNumber,
+    CandidateDbId,
+    AssetDbId,
+    RowVersion,
+    SelectedAt,
+    UpdatedAt,
+}
diff --git a/annim/src/migrator/m20260712_000010_add_catalog_lookup_indexes.rs b/annim/src/migrator/m20260712_000010_add_catalog_lookup_indexes.rs
new file mode 100644
index 00000000..a9163407
--- /dev/null
+++ b/annim/src/migrator/m20260712_000010_add_catalog_lookup_indexes.rs
@@ -0,0 +1,57 @@
+use sea_orm_migration::prelude::*;
+
+use super::{
+    m20260712_000007_create_catalog_collection::CollectionCopy,
+    m20260712_000008_create_catalog_sources::CatalogSourceRelease,
+};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000010_add_catalog_lookup_indexes"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-collection-copy-release")
+                    .table(CollectionCopy::Table)
+                    .col(CollectionCopy::ReleaseDbId)
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-source-release-linked-release")
+                    .table(CatalogSourceRelease::Table)
+                    .col(CatalogSourceRelease::LinkedReleaseDbId)
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_index(
+                Index::drop()
+                    .name("idx-catalog-source-release-linked-release")
+                    .table(CatalogSourceRelease::Table)
+                    .to_owned(),
+            )
+            .await?;
+        manager
+            .drop_index(
+                Index::drop()
+                    .name("idx-collection-copy-release")
+                    .table(CollectionCopy::Table)
+                    .to_owned(),
+            )
+            .await
+    }
+}
diff --git a/annim/src/migrator/m20260712_000011_harden_catalog_sync_runs.rs b/annim/src/migrator/m20260712_000011_harden_catalog_sync_runs.rs
new file mode 100644
index 00000000..9a180b9f
--- /dev/null
+++ b/annim/src/migrator/m20260712_000011_harden_catalog_sync_runs.rs
@@ -0,0 +1,98 @@
+use anni_catalog::SyncCoverage;
+use sea_orm_migration::{prelude::*, schema::*};
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260712_000011_harden_catalog_sync_runs"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // SQLite permits one ADD COLUMN per ALTER TABLE, so keep this
+        // migration portable instead of emitting a backend-specific batch.
+        for column in [
+            string(CatalogSyncRun::Coverage)
+                .default(SyncCoverage::DiscoveryOnly.as_str())
+                .to_owned(),
+            boolean(CatalogSyncRun::StartedFromRoot)
+                .default(false)
+                .to_owned(),
+            boolean(CatalogSyncRun::SnapshotComplete)
+                .default(false)
+                .to_owned(),
+            uuid_null(CatalogSyncRun::LeaseToken),
+            timestamp_null(CatalogSyncRun::LeaseExpiresAt),
+            timestamp_null(CatalogSyncRun::NextAttemptAt),
+            integer(CatalogSyncRun::AttemptCount).default(0).to_owned(),
+        ] {
+            manager
+                .alter_table(
+                    Table::alter()
+                        .table(CatalogSyncRun::Table)
+                        .add_column(column)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-catalog-sync-run-claimable")
+                    .table(CatalogSyncRun::Table)
+                    .col(CatalogSyncRun::Status)
+                    .col(CatalogSyncRun::NextAttemptAt)
+                    .col(CatalogSyncRun::LeaseExpiresAt)
+                    .col(CatalogSyncRun::CreatedAt)
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_index(
+                Index::drop()
+                    .name("idx-catalog-sync-run-claimable")
+                    .table(CatalogSyncRun::Table)
+                    .to_owned(),
+            )
+            .await?;
+        for column in [
+            CatalogSyncRun::AttemptCount,
+            CatalogSyncRun::NextAttemptAt,
+            CatalogSyncRun::LeaseExpiresAt,
+            CatalogSyncRun::LeaseToken,
+            CatalogSyncRun::SnapshotComplete,
+            CatalogSyncRun::StartedFromRoot,
+            CatalogSyncRun::Coverage,
+        ] {
+            manager
+                .alter_table(
+                    Table::alter()
+                        .table(CatalogSyncRun::Table)
+                        .drop_column(column)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum CatalogSyncRun {
+    Table,
+    Status,
+    Coverage,
+    StartedFromRoot,
+    SnapshotComplete,
+    LeaseToken,
+    LeaseExpiresAt,
+    NextAttemptAt,
+    AttemptCount,
+    CreatedAt,
+}
diff --git a/annim/src/migrator/mod.rs b/annim/src/migrator/mod.rs
index 2f58472c..6e1df70a 100644
--- a/annim/src/migrator/mod.rs
+++ b/annim/src/migrator/mod.rs
@@ -5,6 +5,13 @@ mod m20240817_000001_create_basic_tables;
 mod m20240824_000002_create_tag_tables;
 mod m20240905_000003_add_tag_type_category;
 mod m20240905_000004_album_extra_jsonb;
+mod m20260712_000005_create_ingest_job;
+mod m20260712_000006_create_ingest_metadata_revision;
+mod m20260712_000007_create_catalog_collection;
+mod m20260712_000008_create_catalog_sources;
+mod m20260712_000009_create_cover_assets;
+mod m20260712_000010_add_catalog_lookup_indexes;
+mod m20260712_000011_harden_catalog_sync_runs;
 
 pub struct Migrator;
 
@@ -16,6 +23,13 @@ impl MigratorTrait for Migrator {
             Box::new(m20240824_000002_create_tag_tables::Migration),
             Box::new(m20240905_000003_add_tag_type_category::Migration),
             Box::new(m20240905_000004_album_extra_jsonb::Migration),
+            Box::new(m20260712_000005_create_ingest_job::Migration),
+            Box::new(m20260712_000006_create_ingest_metadata_revision::Migration),
+            Box::new(m20260712_000007_create_catalog_collection::Migration),
+            Box::new(m20260712_000008_create_catalog_sources::Migration),
+            Box::new(m20260712_000009_create_cover_assets::Migration),
+            Box::new(m20260712_000010_add_catalog_lookup_indexes::Migration),
+            Box::new(m20260712_000011_harden_catalog_sync_runs::Migration),
         ]
     }
 }
diff --git a/annim/src/server.rs b/annim/src/server.rs
new file mode 100644
index 00000000..f06fb532
--- /dev/null
+++ b/annim/src/server.rs
@@ -0,0 +1,248 @@
+use std::sync::Arc;
+
+use async_graphql::http::{graphiql_source, ALL_WEBSOCKET_PROTOCOLS};
+use async_graphql_axum::{GraphQLProtocol, GraphQLRequest, GraphQLResponse, GraphQLWebSocket};
+use axum::{
+    extract::{Request, State, WebSocketUpgrade},
+    http::{
+        header::{AUTHORIZATION, CONTENT_TYPE, HOST, ORIGIN, WWW_AUTHENTICATE},
+        uri::Authority,
+        HeaderMap, HeaderValue, Method, StatusCode,
+    },
+    middleware::{self, Next},
+    response::{self, IntoResponse, Response},
+    routing::{get, post},
+    Extension, Json, Router,
+};
+use sea_orm::DatabaseConnection;
+use serde::Serialize;
+use tower_http::cors::{AllowOrigin, CorsLayer};
+use url::Url;
+
+use crate::{
+    auth::{on_connection_init, AuthConfig, AuthenticatedAdmin},
+    config::ServerConfig,
+    graphql::MetadataSchema,
+    web,
+};
+
+const BEARER_CHALLENGE: HeaderValue = HeaderValue::from_static("Bearer realm=\"annim\"");
+const NO_STORE: HeaderValue = HeaderValue::from_static("no-store");
+
+#[derive(Clone)]
+pub struct ServerState {
+    schema: MetadataSchema,
+    auth: AuthConfig,
+    database: DatabaseConnection,
+}
+
+impl ServerState {
+    pub fn new(schema: MetadataSchema, auth: AuthConfig, database: DatabaseConnection) -> Self {
+        Self {
+            schema,
+            auth,
+            database,
+        }
+    }
+}
+
+#[derive(Clone)]
+struct OriginPolicy {
+    allowed: Arc<[HeaderValue]>,
+}
+
+impl OriginPolicy {
+    fn from_config(config: &ServerConfig) -> Self {
+        Self {
+            allowed: config.allowed_origins().to_vec().into(),
+        }
+    }
+
+    fn accepts(&self, headers: &HeaderMap) -> bool {
+        let mut values = headers.get_all(ORIGIN).iter();
+        match (values.next(), values.next()) {
+            (None, None) => true,
+            (Some(origin), None) => {
+                self.allowed.iter().any(|allowed| allowed == origin)
+                    || origin_matches_host(origin, headers.get(HOST))
+            }
+            _ => false,
+        }
+    }
+}
+
+/// The embedded client is served by Annim itself, so its browser requests are
+/// allowed when the Origin authority matches the HTTP Host authority. This
+/// remains fail-closed for cross-origin callers and works behind a reverse
+/// proxy without trusting forwarded-host headers.
+fn origin_matches_host(origin: &HeaderValue, host: Option<&HeaderValue>) -> bool {
+    let Some(host) = host.and_then(|value| value.to_str().ok()) else {
+        return false;
+    };
+    let Ok(authority) = host.parse::<Authority>() else {
+        return false;
+    };
+    let Some(origin) = origin
+        .to_str()
+        .ok()
+        .and_then(|value| Url::parse(value).ok())
+    else {
+        return false;
+    };
+    if !matches!(origin.scheme(), "http" | "https")
+        || !origin.username().is_empty()
+        || origin.password().is_some()
+        || origin.query().is_some()
+        || origin.fragment().is_some()
+        || origin.path() != "/"
+    {
+        return false;
+    }
+    let Some(origin_host) = origin.host_str() else {
+        return false;
+    };
+    let origin_host = origin_host.trim_matches(['[', ']']);
+    let request_host = authority.host().trim_matches(['[', ']']);
+    if !origin_host.eq_ignore_ascii_case(request_host) {
+        return false;
+    }
+    authority.port_u16().map_or_else(
+        || origin.port().is_none(),
+        |port| origin.port_or_known_default() == Some(port),
+    )
+}
+
+pub fn build_router(state: ServerState, config: &ServerConfig) -> Router {
+    let auth_layer = middleware::from_fn_with_state(state.auth.clone(), require_http_admin);
+    let mut root = post(graphql_handler).route_layer(auth_layer);
+    if config.graphiql_enabled() {
+        root = root.get(graphql_playground);
+    }
+
+    let allowed_origins = config.allowed_origins().to_vec();
+    let cors = CorsLayer::new()
+        .allow_methods([Method::GET, Method::POST])
+        .allow_headers([AUTHORIZATION, CONTENT_TYPE])
+        .allow_origin(AllowOrigin::list(allowed_origins));
+    let origin_policy = OriginPolicy::from_config(config);
+
+    Router::new()
+        .route("/", root)
+        .route("/ws", get(graphql_ws_handler))
+        .route("/app", get(web::index))
+        .route("/app/", get(web::index))
+        .route("/app/styles.css", get(web::styles))
+        .route("/app/app.js", get(web::app))
+        .route("/health/live", get(liveness))
+        .route("/health/ready", get(readiness))
+        .with_state(state)
+        .layer(cors)
+        // CORS controls browser response headers; this outer policy also
+        // rejects disallowed WebSocket handshakes and non-preflight requests.
+        .layer(middleware::from_fn_with_state(
+            origin_policy,
+            enforce_origin,
+        ))
+}
+
+async fn require_http_admin(
+    State(auth): State<AuthConfig>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    let authenticated = request
+        .headers()
+        .get(AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| auth.authenticate_bearer(value).ok());
+
+    match authenticated {
+        Some(admin) => {
+            request.extensions_mut().insert(admin);
+            next.run(request).await
+        }
+        None => unauthorized_response(),
+    }
+}
+
+async fn enforce_origin(
+    State(policy): State<OriginPolicy>,
+    request: Request,
+    next: Next,
+) -> Response {
+    if policy.accepts(request.headers()) {
+        next.run(request).await
+    } else {
+        (StatusCode::FORBIDDEN, "Origin not allowed").into_response()
+    }
+}
+
+fn unauthorized_response() -> Response {
+    let mut response = (StatusCode::UNAUTHORIZED, "Unauthorized").into_response();
+    response
+        .headers_mut()
+        .insert(WWW_AUTHENTICATE, BEARER_CHALLENGE);
+    response
+}
+
+async fn graphql_handler(
+    State(state): State<ServerState>,
+    Extension(admin): Extension<AuthenticatedAdmin>,
+    req: GraphQLRequest,
+) -> GraphQLResponse {
+    state
+        .schema
+        .execute(req.into_inner().data(admin))
+        .await
+        .into()
+}
+
+async fn graphql_ws_handler(
+    State(state): State<ServerState>,
+    protocol: GraphQLProtocol,
+    websocket: WebSocketUpgrade,
+) -> Response {
+    websocket
+        .protocols(ALL_WEBSOCKET_PROTOCOLS)
+        .on_upgrade(move |stream| {
+            let auth = state.auth.clone();
+            GraphQLWebSocket::new(stream, state.schema, protocol)
+                .on_connection_init(move |value| on_connection_init(auth.clone(), value))
+                .serve()
+        })
+}
+
+async fn graphql_playground() -> impl IntoResponse {
+    response::Html(graphiql_source("/", Some("/ws")))
+}
+
+#[derive(Serialize)]
+struct HealthResponse {
+    status: &'static str,
+}
+
+async fn liveness() -> Response {
+    health_response(StatusCode::OK, "live")
+}
+
+async fn readiness(State(state): State<ServerState>) -> Response {
+    if state.database.ping().await.is_ok() {
+        health_response(StatusCode::OK, "ready")
+    } else {
+        health_response(StatusCode::SERVICE_UNAVAILABLE, "unavailable")
+    }
+}
+
+fn health_response(status: StatusCode, health_status: &'static str) -> Response {
+    let mut response = (
+        status,
+        Json(HealthResponse {
+            status: health_status,
+        }),
+    )
+        .into_response();
+    response
+        .headers_mut()
+        .insert(axum::http::header::CACHE_CONTROL, NO_STORE);
+    response
+}
diff --git a/annim/src/web.rs b/annim/src/web.rs
new file mode 100644
index 00000000..fe7e5682
--- /dev/null
+++ b/annim/src/web.rs
@@ -0,0 +1,88 @@
+//! Embedded Annim Web assets and browser security headers.
+//!
+//! The operator UI is readable without authentication, but every GraphQL
+//! request still crosses the server's admin guard. Assets are compiled into
+//! the binary so deployments cannot accidentally serve a stale or writable
+//! web root.
+
+use axum::{
+    body::Body,
+    http::{header, HeaderValue, Response, StatusCode},
+};
+
+// These paths intentionally stay outside `annim/src`: the browser client is a
+// first-class workspace surface while the release binary embeds one exact copy.
+const INDEX: &str = include_str!("../../annim-web/index.html");
+const STYLES: &str = include_str!("../../annim-web/styles.css");
+const APP: &str = include_str!("../../annim-web/app.js");
+
+const NO_STORE: HeaderValue = HeaderValue::from_static("no-store");
+const NOSNIFF: HeaderValue = HeaderValue::from_static("nosniff");
+const NO_REFERRER: HeaderValue = HeaderValue::from_static("no-referrer");
+const DENY: HeaderValue = HeaderValue::from_static("DENY");
+const SAME_ORIGIN: HeaderValue = HeaderValue::from_static("same-origin");
+const NO_BROWSER_PERMISSIONS: HeaderValue =
+    HeaderValue::from_static("camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+const CSP: HeaderValue = HeaderValue::from_static(
+    "default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; object-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'",
+);
+
+pub async fn index() -> Response<Body> {
+    asset(INDEX, "text/html; charset=utf-8")
+}
+
+pub async fn styles() -> Response<Body> {
+    asset(STYLES, "text/css; charset=utf-8")
+}
+
+pub async fn app() -> Response<Body> {
+    asset(APP, "text/javascript; charset=utf-8")
+}
+
+fn asset(content: &'static str, content_type: &'static str) -> Response<Body> {
+    let mut response = Response::new(Body::from(content));
+    *response.status_mut() = StatusCode::OK;
+    let headers = response.headers_mut();
+    headers.insert(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
+    headers.insert(header::CACHE_CONTROL, NO_STORE);
+    headers.insert("x-content-type-options", NOSNIFF);
+    headers.insert("referrer-policy", NO_REFERRER);
+    headers.insert("x-frame-options", DENY);
+    headers.insert("cross-origin-opener-policy", SAME_ORIGIN);
+    headers.insert("cross-origin-resource-policy", SAME_ORIGIN);
+    headers.insert("permissions-policy", NO_BROWSER_PERMISSIONS);
+    headers.insert("content-security-policy", CSP);
+    response
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_asset_uses_the_same_fail_closed_headers() {
+        for response in [
+            asset(INDEX, "text/html; charset=utf-8"),
+            asset(STYLES, "text/css; charset=utf-8"),
+            asset(APP, "text/javascript; charset=utf-8"),
+        ] {
+            assert_eq!(response.status(), StatusCode::OK);
+            assert_eq!(
+                response.headers().get(header::CACHE_CONTROL),
+                Some(&NO_STORE)
+            );
+            assert_eq!(
+                response.headers().get("x-content-type-options"),
+                Some(&NOSNIFF)
+            );
+            assert_eq!(
+                response.headers().get("content-security-policy"),
+                Some(&CSP)
+            );
+            assert_eq!(
+                response.headers().get("cross-origin-resource-policy"),
+                Some(&SAME_ORIGIN)
+            );
+        }
+    }
+}
diff --git a/annim/tests/catalog_collection_migration.rs b/annim/tests/catalog_collection_migration.rs
new file mode 100644
index 00000000..152a93ee
--- /dev/null
+++ b/annim/tests/catalog_collection_migration.rs
@@ -0,0 +1,96 @@
+#![cfg(feature = "sqlite")]
+
+use anni_catalog::ReleaseKind;
+use annim::migrator::Migrator;
+use sea_orm::{
+    prelude::Uuid, ConnectOptions, ConnectionTrait, Database, DatabaseConnection, DbBackend,
+    Statement,
+};
+use sea_orm_migration::{MigratorTrait, SchemaManager};
+
+async fn migrated_database() -> DatabaseConnection {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    database
+}
+
+#[tokio::test]
+async fn catalog_collection_schema_preserves_exact_labels_and_defaults() {
+    let database = migrated_database().await;
+    let manager = SchemaManager::new(&database);
+    for table in ["catalog_artist", "catalog_release", "collection_copy"] {
+        assert!(manager.has_table(table).await.unwrap(), "missing {table}");
+    }
+
+    let artist_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_artist (artist_id, display_name) VALUES (?, ?)",
+            [artist_id.into(), "Artist（公式）".into()],
+        ))
+        .await
+        .unwrap();
+    let artist_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_artist WHERE artist_id = ?",
+            [artist_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let release_id = Uuid::new_v4();
+    let exact_title = "作品・A〜B～C (初回)";
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_release (release_id, artist_db_id, title) VALUES (?, ?, ?)",
+            [release_id.into(), artist_db_id.into(), exact_title.into()],
+        ))
+        .await
+        .unwrap();
+    let release = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id, title, kind, wanted, unavailable, row_version \
+             FROM catalog_release WHERE release_id = ?",
+            [release_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(release.try_get::<String>("", "title").unwrap(), exact_title);
+    assert_eq!(
+        release.try_get::<String>("", "kind").unwrap(),
+        ReleaseKind::Album.as_str()
+    );
+    assert!(!release.try_get::<bool>("", "wanted").unwrap());
+    assert!(!release.try_get::<bool>("", "unavailable").unwrap());
+    assert_eq!(release.try_get::<i64>("", "row_version").unwrap(), 1);
+
+    let copy_id = Uuid::new_v4();
+    let release_db_id = release.try_get::<i32>("", "id").unwrap();
+    let insert_copy = || {
+        database.execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO collection_copy \
+             (copy_id, release_db_id, source_kind, source_label, codec) \
+             VALUES (?, ?, ?, ?, ?)",
+            [
+                copy_id.into(),
+                release_db_id.into(),
+                "angel_anime".into(),
+                "天使动漫".into(),
+                "flac".into(),
+            ],
+        ))
+    };
+    insert_copy().await.unwrap();
+    assert!(insert_copy().await.is_err());
+}
diff --git a/annim/tests/catalog_graphql.rs b/annim/tests/catalog_graphql.rs
new file mode 100644
index 00000000..3e00162a
--- /dev/null
+++ b/annim/tests/catalog_graphql.rs
@@ -0,0 +1,189 @@
+#![cfg(feature = "sqlite")]
+
+use annim::{auth::AuthConfig, graphql::build_schema, migrator::Migrator};
+use async_graphql::Request;
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+
+async fn test_schema() -> annim::graphql::MetadataSchema {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    build_schema(database)
+}
+
+fn admin_request(query: impl Into<String>) -> Request {
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+    let admin = AuthConfig::new(TOKEN)
+        .unwrap()
+        .authenticate_bearer(&format!("Bearer {TOKEN}"))
+        .unwrap();
+    Request::new(query).data(admin)
+}
+
+fn error_code(response: &async_graphql::Response) -> Option<&async_graphql::Value> {
+    response.errors.first()?.extensions.as_ref()?.get("code")
+}
+
+#[tokio::test]
+async fn catalog_queries_require_an_admin_token() {
+    let schema = test_schema().await;
+    let response = schema.execute("{ catalogArtists { artistId } }").await;
+
+    assert_eq!(response.errors.len(), 1);
+    assert_eq!(response.errors[0].message, "Unauthorized");
+}
+
+#[tokio::test]
+async fn graphql_drives_artist_collection_without_exposing_private_locators() {
+    let schema = test_schema().await;
+    let artist_id = Uuid::new_v4();
+    let release_id = Uuid::new_v4();
+    let copy_id = Uuid::new_v4();
+    let manifest_digest = "5a".repeat(32);
+
+    let artist = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogArtist(input: {{
+                    artistId: "{artist_id}"
+                    displayName: "Artist（公式）"
+                    sortName: "Artist"
+                }}) {{ artistId displayName rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(artist.errors.is_empty(), "{:?}", artist.errors);
+    assert_eq!(
+        artist.data.into_json().unwrap()["createCatalogArtist"]["displayName"],
+        "Artist（公式）"
+    );
+
+    let release = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogRelease(input: {{
+                    releaseId: "{release_id}"
+                    artistId: "{artist_id}"
+                    title: "作品・A〜B～C (初回)"
+                    edition: "初回限定盤（CD＋BD）"
+                    catalog: "TEST-0001"
+                    releaseDate: "2026-07"
+                    kind: ALBUM
+                }}) {{ releaseId title collectionState rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(release.errors.is_empty(), "{:?}", release.errors);
+
+    let wanted = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeCatalogReleaseCommand(input: {{
+                    releaseId: "{release_id}"
+                    expectedRowVersion: "1"
+                    command: {{ markWanted: EXECUTE }}
+                }}) {{ collectionState rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(wanted.errors.is_empty(), "{:?}", wanted.errors);
+    assert_eq!(
+        wanted.data.into_json().unwrap()["executeCatalogReleaseCommand"]["collectionState"],
+        "WANTED"
+    );
+
+    let recorded = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeCatalogReleaseCommand(input: {{
+                    releaseId: "{release_id}"
+                    expectedRowVersion: "2"
+                    command: {{ recordCopy: {{
+                        copyId: "{copy_id}"
+                        sourceKind: ANGEL_ANIME
+                        sourceLabel: "天使动漫（群友补档）"
+                        privateLocator: "私有/不可公开/PT种子"
+                        codec: FLAC
+                        sampleRateHz: 96000
+                        bitDepth: 24
+                        channels: 2
+                        trackCount: 12
+                        byteLength: "1234567890"
+                        manifestDigest: "{manifest_digest}"
+                        qualityVerified: true
+                        notes: "原始抓取・A〜B～C"
+                    }} }}
+                }}) {{
+                    collectionState rowVersion
+                    copies {{ sourceLabel qualityTier byteLength qualityVerified }}
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(recorded.errors.is_empty(), "{:?}", recorded.errors);
+    let recorded = recorded.data.into_json().unwrap();
+    assert_eq!(
+        recorded["executeCatalogReleaseCommand"]["collectionState"],
+        "ACQUIRED"
+    );
+    assert_eq!(recorded["executeCatalogReleaseCommand"]["rowVersion"], "3");
+    assert_eq!(
+        recorded["executeCatalogReleaseCommand"]["copies"][0]["qualityTier"],
+        "HI_RES_LOSSLESS"
+    );
+
+    let collection = schema
+        .execute(admin_request(format!(
+            r#"{{
+                catalogArtistCollection(artistId: "{artist_id}") {{
+                    artist {{ displayName }}
+                    summary {{ total acquired collected }}
+                    releaseTotalCount
+                    releases {{
+                        title edition collectionState
+                        copies {{ sourceKind sourceLabel codec sampleRateHz bitDepth }}
+                    }}
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(collection.errors.is_empty(), "{:?}", collection.errors);
+    let collection = collection.data.into_json().unwrap();
+    let collection = &collection["catalogArtistCollection"];
+    assert_eq!(collection["artist"]["displayName"], "Artist（公式）");
+    assert_eq!(collection["summary"]["total"], "1");
+    assert_eq!(collection["summary"]["acquired"], "1");
+    assert_eq!(collection["summary"]["collected"], "1");
+    assert_eq!(collection["releases"][0]["title"], "作品・A〜B～C (初回)");
+    assert_eq!(
+        collection["releases"][0]["copies"][0]["sourceLabel"],
+        "天使动漫（群友补档）"
+    );
+
+    let private_query = schema
+        .execute(admin_request(format!(
+            r#"{{ catalogArtistCollection(artistId: "{artist_id}") {{
+                releases {{ copies {{ privateLocator }} }}
+            }} }}"#
+        )))
+        .await;
+    assert!(!private_query.errors.is_empty());
+
+    let stale = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeCatalogReleaseCommand(input: {{
+                    releaseId: "{release_id}"
+                    expectedRowVersion: "2"
+                    command: {{ markUnavailable: EXECUTE }}
+                }}) {{ rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(
+        error_code(&stale),
+        Some(&async_graphql::Value::from("CATALOG_RELEASE_CONFLICT"))
+    );
+}
diff --git a/annim/tests/catalog_repository.rs b/annim/tests/catalog_repository.rs
new file mode 100644
index 00000000..dac20dd2
--- /dev/null
+++ b/annim/tests/catalog_repository.rs
@@ -0,0 +1,166 @@
+#![cfg(feature = "sqlite")]
+
+use std::num::NonZeroU32;
+
+use anni_catalog::{AcquisitionSourceKind, AudioCodec, CollectionState, QualityTier, ReleaseKind};
+use anni_ingest::Digest;
+use annim::{
+    catalog::{
+        CatalogError, CatalogReleaseCommand, CatalogRepository, CatalogRowVersion, CatalogService,
+        NewCatalogArtist, NewCatalogRelease, NewCollectionCopy,
+    },
+    migrator::Migrator,
+};
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+
+async fn service() -> CatalogService {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    CatalogService::new(CatalogRepository::new(database))
+}
+
+fn hi_res_copy(copy_id: Uuid) -> NewCollectionCopy {
+    NewCollectionCopy {
+        copy_id: Some(copy_id),
+        source_kind: AcquisitionSourceKind::AngelAnime,
+        source_label: "天使动漫（群友补档）".to_owned(),
+        private_locator: Some("私有/不可公开/PT种子".to_owned()),
+        codec: AudioCodec::Flac,
+        sample_rate_hz: NonZeroU32::new(96_000),
+        bit_depth: Some(24),
+        channels: Some(2),
+        track_count: Some(12),
+        byte_length: Some(1_234_567_890),
+        manifest_digest: Some(Digest::new([0x5a; Digest::LENGTH])),
+        quality_verified: true,
+        ingest_job_id: None,
+        notes: Some("原始抓取・A〜B～C".to_owned()),
+    }
+}
+
+async fn create_release(service: &CatalogService) -> (Uuid, Uuid) {
+    let artist_id = Uuid::new_v4();
+    service
+        .create_artist(NewCatalogArtist {
+            artist_id: Some(artist_id),
+            display_name: "Artist（公式）".to_owned(),
+            sort_name: Some("Artist".to_owned()),
+            notes: None,
+        })
+        .await
+        .unwrap();
+    let release_id = Uuid::new_v4();
+    service
+        .create_release(NewCatalogRelease {
+            release_id: Some(release_id),
+            artist_id,
+            title: "作品・A〜B～C (初回)".to_owned(),
+            edition: Some("初回限定盤（CD＋BD）".to_owned()),
+            catalog: Some("TEST-0001".to_owned()),
+            release_date: Some("2026-07".to_owned()),
+            kind: ReleaseKind::Album,
+            notes: None,
+        })
+        .await
+        .unwrap();
+    (artist_id, release_id)
+}
+
+#[tokio::test]
+async fn artist_collection_round_trips_exact_text_and_measured_quality() {
+    let service = service().await;
+    let (artist_id, release_id) = create_release(&service).await;
+    let recorded = service
+        .execute_release_command(
+            release_id,
+            CatalogRowVersion::INITIAL,
+            CatalogReleaseCommand::RecordCopy(hi_res_copy(Uuid::new_v4())),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(recorded.title, "作品・A〜B～C (初回)");
+    assert_eq!(recorded.collection_state(), CollectionState::Acquired);
+    assert_eq!(recorded.row_version.get(), 2);
+    assert_eq!(recorded.copies.len(), 1);
+    assert_eq!(recorded.copies[0].source_label, "天使动漫（群友补档）");
+    assert_eq!(
+        recorded.copies[0].quality_tier(),
+        QualityTier::HiResLossless
+    );
+    assert_eq!(
+        recorded.copies[0].manifest_digest,
+        Some(Digest::new([0x5a; Digest::LENGTH]))
+    );
+
+    let collection = service
+        .artist_collection(artist_id, None)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(collection.artist.display_name, "Artist（公式）");
+    assert_eq!(collection.summary.total, 1);
+    assert_eq!(collection.summary.acquired, 1);
+    assert_eq!(collection.summary.collected, 1);
+}
+
+#[tokio::test]
+async fn copy_insert_failure_and_stale_writer_leave_the_aggregate_unchanged() {
+    let service = service().await;
+    let (_, release_id) = create_release(&service).await;
+    let copy_id = Uuid::new_v4();
+    let recorded = service
+        .execute_release_command(
+            release_id,
+            CatalogRowVersion::INITIAL,
+            CatalogReleaseCommand::RecordCopy(hi_res_copy(copy_id)),
+        )
+        .await
+        .unwrap();
+    assert_eq!(recorded.row_version.get(), 2);
+
+    let duplicate = service
+        .execute_release_command(
+            release_id,
+            recorded.row_version,
+            CatalogReleaseCommand::RecordCopy(hi_res_copy(copy_id)),
+        )
+        .await;
+    assert!(matches!(
+        duplicate,
+        Err(CatalogError::CopyAlreadyExists { copy_id: actual }) if actual == copy_id
+    ));
+    let after_duplicate = service
+        .repository()
+        .get_release(release_id)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(after_duplicate.row_version.get(), 2);
+    assert_eq!(after_duplicate.copies.len(), 1);
+
+    let stale_copy_id = Uuid::new_v4();
+    let stale = service
+        .execute_release_command(
+            release_id,
+            CatalogRowVersion::INITIAL,
+            CatalogReleaseCommand::RecordCopy(hi_res_copy(stale_copy_id)),
+        )
+        .await;
+    assert!(matches!(stale, Err(CatalogError::ReleaseConflict { .. })));
+    let after_stale = service
+        .repository()
+        .get_release(release_id)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(after_stale.row_version.get(), 2);
+    assert_eq!(after_stale.copies.len(), 1);
+    assert!(after_stale
+        .copies
+        .iter()
+        .all(|copy| copy.copy_id != stale_copy_id));
+}
diff --git a/annim/tests/catalog_source_migration.rs b/annim/tests/catalog_source_migration.rs
new file mode 100644
index 00000000..268620b4
--- /dev/null
+++ b/annim/tests/catalog_source_migration.rs
@@ -0,0 +1,198 @@
+#![cfg(feature = "sqlite")]
+
+use anni_catalog::{CatalogSourceKind, SyncCoverage, SyncRunStatus};
+use annim::migrator::Migrator;
+use sea_orm::{
+    prelude::Uuid, ConnectOptions, ConnectionTrait, Database, DatabaseConnection, DbBackend,
+    Statement,
+};
+use sea_orm_migration::{MigratorTrait, SchemaManager};
+use sha2::{Digest as _, Sha256};
+
+async fn migrated_database() -> DatabaseConnection {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    database
+}
+
+#[tokio::test]
+async fn catalog_source_schema_keeps_immutable_observation_revisions() {
+    let database = migrated_database().await;
+    let manager = SchemaManager::new(&database);
+    for table in [
+        "catalog_source",
+        "catalog_sync_run",
+        "catalog_source_release",
+        "catalog_source_release_revision",
+    ] {
+        assert!(manager.has_table(table).await.unwrap(), "missing {table}");
+    }
+
+    let artist_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_artist (artist_id, display_name) VALUES (?, ?)",
+            [artist_id.into(), "Artist（公式）".into()],
+        ))
+        .await
+        .unwrap();
+    let artist_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_artist WHERE artist_id = ?",
+            [artist_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let source_id = Uuid::new_v4();
+    let insert_source = || {
+        database.execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_source (source_id, artist_db_id, kind, locator) \
+             VALUES (?, ?, ?, ?)",
+            [
+                source_id.into(),
+                artist_db_id.into(),
+                CatalogSourceKind::Vgmdb.as_str().into(),
+                "https://vgmdb.net/artist/1234".into(),
+            ],
+        ))
+    };
+    insert_source().await.unwrap();
+    assert!(insert_source().await.is_err());
+    let source_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_source WHERE source_id = ?",
+            [source_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let run_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_sync_run (run_id, source_db_id) VALUES (?, ?)",
+            [run_id.into(), source_db_id.into()],
+        ))
+        .await
+        .unwrap();
+    let run = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT status, coverage, started_from_root, snapshot_complete, attempt_count, \
+             lease_token, lease_expires_at, next_attempt_at \
+             FROM catalog_sync_run WHERE run_id = ?",
+            [run_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        run.try_get::<String>("", "status").unwrap(),
+        SyncRunStatus::Queued.as_str()
+    );
+    assert_eq!(
+        run.try_get::<String>("", "coverage").unwrap(),
+        SyncCoverage::DiscoveryOnly.as_str()
+    );
+    assert!(!run.try_get::<bool>("", "started_from_root").unwrap());
+    assert!(!run.try_get::<bool>("", "snapshot_complete").unwrap());
+    assert_eq!(run.try_get::<i32>("", "attempt_count").unwrap(), 0);
+    assert!(run
+        .try_get::<Option<Uuid>>("", "lease_token")
+        .unwrap()
+        .is_none());
+    assert!(run
+        .try_get::<Option<String>>("", "lease_expires_at")
+        .unwrap()
+        .is_none());
+    assert!(run
+        .try_get::<Option<String>>("", "next_attempt_at")
+        .unwrap()
+        .is_none());
+
+    let source_release_id = Uuid::new_v4();
+    let insert_release = || {
+        database.execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_source_release \
+             (source_release_id, source_db_id, external_release_id, source_url) \
+             VALUES (?, ?, ?, ?)",
+            [
+                source_release_id.into(),
+                source_db_id.into(),
+                "album/作品・A〜B～C".into(),
+                "https://vgmdb.net/album/5678".into(),
+            ],
+        ))
+    };
+    insert_release().await.unwrap();
+    assert!(insert_release().await.is_err());
+    let source_release_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_source_release WHERE source_release_id = ?",
+            [source_release_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let raw_document = r#"{"title":"作品・A〜B～C (初回)"}"#;
+    let parsed_document = r#"{"title":"作品・A〜B～C (初回)","kind":"album"}"#;
+    let raw_sha256 = Sha256::digest(raw_document.as_bytes()).to_vec();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_source_release_revision \
+             (source_release_db_id, revision, sync_run_id, raw_document, \
+              parsed_document, raw_sha256) VALUES (?, ?, ?, ?, ?, ?)",
+            [
+                source_release_db_id.into(),
+                1_i64.into(),
+                run_id.into(),
+                raw_document.into(),
+                parsed_document.into(),
+                raw_sha256.clone().into(),
+            ],
+        ))
+        .await
+        .unwrap();
+    let revision = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT raw_document, parsed_document, raw_sha256 \
+             FROM catalog_source_release_revision \
+             WHERE source_release_db_id = ? AND revision = 1",
+            [source_release_db_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        revision.try_get::<String>("", "raw_document").unwrap(),
+        raw_document
+    );
+    assert_eq!(
+        revision.try_get::<String>("", "parsed_document").unwrap(),
+        parsed_document
+    );
+    assert_eq!(
+        revision.try_get::<Vec<u8>>("", "raw_sha256").unwrap(),
+        raw_sha256
+    );
+}
diff --git a/annim/tests/catalog_sync_graphql.rs b/annim/tests/catalog_sync_graphql.rs
new file mode 100644
index 00000000..693619a6
--- /dev/null
+++ b/annim/tests/catalog_sync_graphql.rs
@@ -0,0 +1,284 @@
+#![cfg(feature = "sqlite")]
+
+use annim::{
+    auth::AuthConfig,
+    catalog::CatalogSyncService,
+    config::{CatalogSyncProvisioningConfig, APPLE_MUSIC_SECRET_REF_ENV},
+    graphql::{build_schema, schema_builder_with_catalog_sync_service},
+    migrator::Migrator,
+};
+use async_graphql::Request;
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+
+async fn test_schema() -> annim::graphql::MetadataSchema {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    build_schema(database)
+}
+
+async fn configured_test_schema() -> annim::graphql::MetadataSchema {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    let provisioning = CatalogSyncProvisioningConfig::from_lookup(|name| {
+        (name == APPLE_MUSIC_SECRET_REF_ENV).then(|| "apple/developer-token.jwt".to_owned())
+    })
+    .unwrap();
+    let service = CatalogSyncService::with_provisioning(database.clone(), provisioning);
+    schema_builder_with_catalog_sync_service(database, service).finish()
+}
+
+fn admin_request(query: impl Into<String>) -> Request {
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+    let admin = AuthConfig::new(TOKEN)
+        .unwrap()
+        .authenticate_bearer(&format!("Bearer {TOKEN}"))
+        .unwrap();
+    Request::new(query).data(admin)
+}
+
+#[tokio::test]
+async fn graphql_queues_catalog_sync_without_exposing_adapter_evidence_or_secrets() {
+    let schema = configured_test_schema().await;
+    let artist_id = Uuid::new_v4();
+    let source_id = Uuid::new_v4();
+    let run_id = Uuid::new_v4();
+
+    let artist = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogArtist(input: {{
+                    artistId: "{artist_id}"
+                    displayName: "Artist（公式）"
+                }}) {{ artistId }}
+            }}"#
+        )))
+        .await;
+    assert!(artist.errors.is_empty(), "{:?}", artist.errors);
+
+    let source = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogSyncSource(input: {{
+                    sourceId: "{source_id}"
+                    artistId: "{artist_id}"
+                    kind: APPLE_MUSIC
+                    locator: "1370700"
+                    storefront: "jp"
+                    locale: "ja-JP"
+                }}) {{
+                    sourceId artistId kind storefront locale enabled provisioningState rowVersion
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(source.errors.is_empty(), "{:?}", source.errors);
+    let source = source.data.into_json().unwrap();
+    assert_eq!(
+        source["createCatalogSyncSource"]["sourceId"],
+        source_id.to_string()
+    );
+    assert_eq!(source["createCatalogSyncSource"]["kind"], "APPLE_MUSIC");
+    assert_eq!(
+        source["createCatalogSyncSource"]["provisioningState"],
+        "READY_TO_QUEUE"
+    );
+    assert_eq!(source["createCatalogSyncSource"]["rowVersion"], "1");
+
+    let sources = schema
+        .execute(admin_request(format!(
+            r#"{{ catalogSyncSources(artistId: "{artist_id}") {{
+                sourceId kind storefront locale enabled provisioningState rowVersion
+            }} }}"#
+        )))
+        .await;
+    assert!(sources.errors.is_empty(), "{:?}", sources.errors);
+    let sources = sources.data.into_json().unwrap();
+    assert_eq!(sources["catalogSyncSources"].as_array().unwrap().len(), 1);
+    assert_eq!(
+        sources["catalogSyncSources"][0]["sourceId"],
+        source_id.to_string()
+    );
+    assert_eq!(
+        sources["catalogSyncSources"][0]["provisioningState"],
+        "READY_TO_QUEUE"
+    );
+
+    let run = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                startCatalogSyncRun(input: {{ runId: "{run_id}", sourceId: "{source_id}" }}) {{
+                    runId sourceId status coverage startedFromRoot snapshotComplete
+                    observedCount attemptCount rowVersion startedAt finishedAt
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(run.errors.is_empty(), "{:?}", run.errors);
+    let run = run.data.into_json().unwrap();
+    assert_eq!(run["startCatalogSyncRun"]["status"], "QUEUED");
+    assert_eq!(run["startCatalogSyncRun"]["coverage"], "DISCOVERY_ONLY");
+    assert_eq!(run["startCatalogSyncRun"]["startedFromRoot"], true);
+    assert_eq!(run["startCatalogSyncRun"]["snapshotComplete"], false);
+    assert_eq!(run["startCatalogSyncRun"]["observedCount"], "0");
+    assert_eq!(run["startCatalogSyncRun"]["attemptCount"], "0");
+    assert_eq!(run["startCatalogSyncRun"]["rowVersion"], "1");
+
+    let polled = schema
+        .execute(admin_request(format!(
+            r#"{{ catalogSyncRun(runId: "{run_id}") {{ runId status observedCount rowVersion }} }}"#
+        )))
+        .await;
+    assert!(polled.errors.is_empty(), "{:?}", polled.errors);
+    assert_eq!(
+        polled.data.into_json().unwrap()["catalogSyncRun"]["runId"],
+        run_id.to_string()
+    );
+
+    let history = schema
+        .execute(admin_request(format!(
+            r#"{{ catalogSyncRuns(sourceId: "{source_id}", limit: 10, offset: 0) {{
+                runId sourceId status observedCount rowVersion
+            }} }}"#
+        )))
+        .await;
+    assert!(history.errors.is_empty(), "{:?}", history.errors);
+    let history = history.data.into_json().unwrap();
+    assert_eq!(history["catalogSyncRuns"].as_array().unwrap().len(), 1);
+    assert_eq!(history["catalogSyncRuns"][0]["runId"], run_id.to_string());
+
+    let after_enqueue = schema
+        .execute(admin_request(format!(
+            r#"{{ catalogSyncSource(sourceId: "{source_id}") {{ rowVersion }} }}"#
+        )))
+        .await;
+    assert!(after_enqueue.errors.is_empty());
+    assert_eq!(
+        after_enqueue.data.into_json().unwrap()["catalogSyncSource"]["rowVersion"],
+        "2"
+    );
+    let disabled = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                setCatalogSyncSourceEnabled(input: {{
+                    sourceId: "{source_id}"
+                    expectedRowVersion: "2"
+                    enabled: false
+                }}) {{ enabled provisioningState rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(disabled.errors.is_empty(), "{:?}", disabled.errors);
+    let disabled = disabled.data.into_json().unwrap();
+    assert_eq!(disabled["setCatalogSyncSourceEnabled"]["enabled"], false);
+    assert_eq!(
+        disabled["setCatalogSyncSourceEnabled"]["provisioningState"],
+        "DISABLED"
+    );
+    assert_eq!(disabled["setCatalogSyncSourceEnabled"]["rowVersion"], "3");
+    let stale = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                setCatalogSyncSourceEnabled(input: {{
+                    sourceId: "{source_id}"
+                    expectedRowVersion: "2"
+                    enabled: true
+                }}) {{ rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(stale.errors.len(), 1);
+    assert_eq!(
+        stale.errors[0]
+            .extensions
+            .as_ref()
+            .and_then(|extensions| extensions.get("code")),
+        Some(&async_graphql::Value::from("CATALOG_SYNC_SOURCE_CONFLICT"))
+    );
+    let enabled = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                setCatalogSyncSourceEnabled(input: {{
+                    sourceId: "{source_id}"
+                    expectedRowVersion: "3"
+                    enabled: true
+                }}) {{ enabled provisioningState rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(enabled.errors.is_empty(), "{:?}", enabled.errors);
+    assert_eq!(
+        enabled.data.into_json().unwrap()["setCatalogSyncSourceEnabled"]["rowVersion"],
+        "4"
+    );
+
+    let private_fields = schema
+        .execute(admin_request(format!(
+            r#"{{
+                catalogSyncSource(sourceId: "{source_id}") {{
+                    locator configurationDocument secretRef
+                }}
+                catalogSyncRun(runId: "{run_id}") {{
+                    requestedCursor resultCursor errorMessage rawDocument parsedDocument
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(!private_fields.errors.is_empty());
+
+    let worker_mutation = schema
+        .execute(admin_request(format!(
+            r#"mutation {{ claimCatalogSyncRun(runId: "{run_id}", expectedRowVersion: "1") }}"#
+        )))
+        .await;
+    assert!(!worker_mutation.errors.is_empty());
+
+    let unconfigured = test_schema().await;
+    let unconfigured_artist = unconfigured
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogArtist(input: {{
+                    artistId: "{artist_id}"
+                    displayName: "Unconfigured Artist"
+                }}) {{ artistId }}
+            }}"#
+        )))
+        .await;
+    assert!(unconfigured_artist.errors.is_empty());
+    let rejected = unconfigured
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogSyncSource(input: {{
+                    artistId: "{artist_id}"
+                    kind: APPLE_MUSIC
+                    locator: "1370700"
+                    storefront: "jp"
+                }}) {{ sourceId }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(rejected.errors.len(), 1);
+    assert_eq!(
+        rejected.errors[0]
+            .extensions
+            .as_ref()
+            .and_then(|extensions| extensions.get("code")),
+        Some(&async_graphql::Value::from(
+            "CATALOG_SYNC_CREDENTIAL_NOT_CONFIGURED"
+        ))
+    );
+    let empty = unconfigured
+        .execute(admin_request(format!(
+            r#"{{ catalogSyncSources(artistId: "{artist_id}") {{ sourceId }} }}"#
+        )))
+        .await;
+    assert!(empty.errors.is_empty());
+    assert!(empty.data.into_json().unwrap()["catalogSyncSources"]
+        .as_array()
+        .unwrap()
+        .is_empty());
+}
diff --git a/annim/tests/cover_asset_migration.rs b/annim/tests/cover_asset_migration.rs
new file mode 100644
index 00000000..975456e0
--- /dev/null
+++ b/annim/tests/cover_asset_migration.rs
@@ -0,0 +1,186 @@
+#![cfg(feature = "sqlite")]
+
+use anni_catalog::{CoverCandidateState, CoverSourceKind};
+use annim::migrator::Migrator;
+use sea_orm::{
+    prelude::Uuid, ConnectOptions, ConnectionTrait, Database, DatabaseConnection, DbBackend,
+    Statement,
+};
+use sea_orm_migration::{MigratorTrait, SchemaManager};
+
+async fn migrated_database() -> DatabaseConnection {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    database
+}
+
+#[tokio::test]
+async fn cover_schema_deduplicates_verified_bytes_and_one_selection_per_scope() {
+    let database = migrated_database().await;
+    let manager = SchemaManager::new(&database);
+    for table in ["cover_asset", "cover_candidate", "cover_selection"] {
+        assert!(manager.has_table(table).await.unwrap(), "missing {table}");
+    }
+
+    let artist_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_artist (artist_id, display_name) VALUES (?, ?)",
+            [artist_id.into(), "Artist（公式）".into()],
+        ))
+        .await
+        .unwrap();
+    let artist_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_artist WHERE artist_id = ?",
+            [artist_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let release_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO catalog_release (release_id, artist_db_id, title) VALUES (?, ?, ?)",
+            [
+                release_id.into(),
+                artist_db_id.into(),
+                "作品・A〜B～C".into(),
+            ],
+        ))
+        .await
+        .unwrap();
+    let release_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM catalog_release WHERE release_id = ?",
+            [release_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let content_sha256 = vec![0x2a; 32];
+    let asset_id = Uuid::new_v4();
+    let storage_key = format!("sha256/2a/2a/{}.jpg", "2a".repeat(32));
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO cover_asset \
+             (asset_id, content_sha256, storage_key, media_type, width, height, \
+              byte_length, fetched_at, verified_at) \
+             VALUES (?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)",
+            [
+                asset_id.into(),
+                content_sha256.clone().into(),
+                storage_key.into(),
+                "image/jpeg".into(),
+                4_000_i32.into(),
+                4_000_i32.into(),
+                8_000_000_i64.into(),
+            ],
+        ))
+        .await
+        .unwrap();
+    let duplicate_digest = database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO cover_asset \
+             (asset_id, content_sha256, storage_key, media_type, width, height, \
+              byte_length, fetched_at, verified_at) \
+             VALUES (?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)",
+            [
+                Uuid::new_v4().into(),
+                content_sha256.into(),
+                "sha256/duplicate.jpg".into(),
+                "image/jpeg".into(),
+                4_000_i32.into(),
+                4_000_i32.into(),
+                8_000_000_i64.into(),
+            ],
+        ))
+        .await;
+    assert!(duplicate_digest.is_err());
+    let asset_db_id = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id FROM cover_asset WHERE asset_id = ?",
+            [asset_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap()
+        .try_get::<i32>("", "id")
+        .unwrap();
+
+    let submitted_url =
+        "https://m.media-amazon.com/images/I/81abc._AC_SL1500_.jpg?X-Amz-Signature=abc%2F123";
+    let canonical_url = "https://m.media-amazon.com/images/I/81abc.jpg?X-Amz-Signature=abc%2F123";
+    let candidate_id = Uuid::new_v4();
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO cover_candidate \
+             (candidate_id, release_db_id, source_kind, submitted_url, canonical_url, \
+              effective_url, state, asset_db_id, fetched_at) \
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)",
+            [
+                candidate_id.into(),
+                release_db_id.into(),
+                CoverSourceKind::Amazon.as_str().into(),
+                submitted_url.into(),
+                canonical_url.into(),
+                canonical_url.into(),
+                CoverCandidateState::Verified.as_str().into(),
+                asset_db_id.into(),
+            ],
+        ))
+        .await
+        .unwrap();
+    let candidate = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT id, submitted_url, canonical_url FROM cover_candidate \
+             WHERE candidate_id = ?",
+            [candidate_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        candidate.try_get::<String>("", "submitted_url").unwrap(),
+        submitted_url
+    );
+    assert_eq!(
+        candidate.try_get::<String>("", "canonical_url").unwrap(),
+        canonical_url
+    );
+    let candidate_db_id = candidate.try_get::<i32>("", "id").unwrap();
+
+    let insert_selection = |selection_id: Uuid| {
+        database.execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO cover_selection \
+             (selection_id, release_db_id, disc_number, candidate_db_id, asset_db_id) \
+             VALUES (?, ?, 0, ?, ?)",
+            [
+                selection_id.into(),
+                release_db_id.into(),
+                candidate_db_id.into(),
+                asset_db_id.into(),
+            ],
+        ))
+    };
+    insert_selection(Uuid::new_v4()).await.unwrap();
+    assert!(insert_selection(Uuid::new_v4()).await.is_err());
+}
diff --git a/annim/tests/cover_graphql.rs b/annim/tests/cover_graphql.rs
new file mode 100644
index 00000000..c45ec1c1
--- /dev/null
+++ b/annim/tests/cover_graphql.rs
@@ -0,0 +1,113 @@
+#![cfg(feature = "sqlite")]
+
+use annim::{auth::AuthConfig, graphql::build_schema, migrator::Migrator};
+use async_graphql::Request;
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+
+async fn test_schema() -> annim::graphql::MetadataSchema {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    build_schema(database)
+}
+
+fn admin_request(query: impl Into<String>) -> Request {
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+    let admin = AuthConfig::new(TOKEN)
+        .unwrap()
+        .authenticate_bearer(&format!("Bearer {TOKEN}"))
+        .unwrap();
+    Request::new(query).data(admin)
+}
+
+#[tokio::test]
+async fn graphql_manages_cover_candidates_without_exposing_worker_secrets() {
+    let schema = test_schema().await;
+    let artist_id = Uuid::new_v4();
+    let release_id = Uuid::new_v4();
+    let candidate_id = Uuid::new_v4();
+
+    let seeded = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createCatalogArtist(input: {{
+                    artistId: "{artist_id}"
+                    displayName: "Artist（公式）"
+                }}) {{ artistId }}
+                createCatalogRelease(input: {{
+                    releaseId: "{release_id}"
+                    artistId: "{artist_id}"
+                    title: "作品・A〜B～C (初回)"
+                    kind: ALBUM
+                }}) {{ releaseId }}
+            }}"#
+        )))
+        .await;
+    assert!(seeded.errors.is_empty(), "{:?}", seeded.errors);
+
+    let added = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                addCoverCandidate(input: {{
+                    candidateId: "{candidate_id}"
+                    releaseId: "{release_id}"
+                    discNumber: 0
+                    sourceKind: AMAZON
+                    submittedUrl: "https://m.media-amazon.com/images/I/example._SL500_.jpg"
+                }}) {{
+                    candidateId state sourceKind hasRemoteUrl attemptCount rowVersion asset {{ assetId }}
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(added.errors.is_empty(), "{:?}", added.errors);
+    let added = added.data.into_json().unwrap()["addCoverCandidate"].clone();
+    assert_eq!(added["candidateId"], candidate_id.to_string());
+    assert_eq!(added["state"], "DISCOVERED");
+    assert_eq!(added["sourceKind"], "AMAZON");
+    assert_eq!(added["hasRemoteUrl"], true);
+    assert_eq!(added["attemptCount"], "0");
+    assert_eq!(added["rowVersion"], "1");
+    assert!(added["asset"].is_null());
+
+    let queued = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                queueCoverCandidate(input: {{
+                    candidateId: "{candidate_id}"
+                    expectedRowVersion: "1"
+                }}) {{ state rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(queued.errors.is_empty(), "{:?}", queued.errors);
+    let queued = queued.data.into_json().unwrap();
+    assert_eq!(queued["queueCoverCandidate"]["state"], "QUEUED");
+    assert_eq!(queued["queueCoverCandidate"]["rowVersion"], "2");
+
+    let listed = schema
+        .execute(admin_request(format!(
+            r#"{{ coverCandidates(releaseId: "{release_id}", discNumber: 0) {{
+                candidateId state hasRemoteUrl rowVersion
+            }} }}"#
+        )))
+        .await;
+    assert!(listed.errors.is_empty(), "{:?}", listed.errors);
+    let listed = listed.data.into_json().unwrap();
+    assert_eq!(
+        listed["coverCandidates"][0]["candidateId"],
+        candidate_id.to_string()
+    );
+    assert_eq!(listed["coverCandidates"][0]["state"], "QUEUED");
+
+    let sensitive_fields = schema
+        .execute(admin_request(format!(
+            r#"{{ coverCandidates(releaseId: "{release_id}") {{
+                submittedUrl requestUrl storageKey leaseToken
+            }} }}"#
+        )))
+        .await;
+    assert!(!sensitive_fields.errors.is_empty());
+}
diff --git a/annim/tests/cover_repository.rs b/annim/tests/cover_repository.rs
new file mode 100644
index 00000000..0a17f7a8
--- /dev/null
+++ b/annim/tests/cover_repository.rs
@@ -0,0 +1,174 @@
+#![cfg(feature = "sqlite")]
+
+use std::{num::NonZeroU32, time::Duration};
+
+use anni_catalog::{cover_asset_storage_key, CoverCandidateState, CoverMediaType, CoverSourceKind};
+use anni_ingest::Digest;
+use annim::{
+    catalog::{CatalogRepository, CatalogService, NewCatalogArtist, NewCatalogRelease},
+    cover::{
+        CoverError, CoverRepository, CoverRowVersion, CoverService, NewCoverCandidate, SelectCover,
+        VerifiedCoverAsset,
+    },
+    migrator::Migrator,
+};
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+
+async fn services() -> (CatalogService, CoverService) {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    (
+        CatalogService::new(CatalogRepository::new(database.clone())),
+        CoverService::new(CoverRepository::new(database)),
+    )
+}
+
+async fn release(catalog: &CatalogService) -> Uuid {
+    let artist_id = Uuid::new_v4();
+    catalog
+        .create_artist(NewCatalogArtist {
+            artist_id: Some(artist_id),
+            display_name: "Artist（公式）".to_owned(),
+            sort_name: None,
+            notes: None,
+        })
+        .await
+        .unwrap();
+    let release_id = Uuid::new_v4();
+    catalog
+        .create_release(NewCatalogRelease {
+            release_id: Some(release_id),
+            artist_id,
+            title: "作品・A〜B～C".to_owned(),
+            edition: None,
+            catalog: None,
+            release_date: None,
+            kind: anni_catalog::ReleaseKind::Album,
+            notes: None,
+        })
+        .await
+        .unwrap();
+    release_id
+}
+
+fn verified_asset(effective_url: String) -> VerifiedCoverAsset {
+    VerifiedCoverAsset {
+        content_sha256: Digest::new([0xab; Digest::LENGTH]),
+        media_type: CoverMediaType::Jpeg,
+        width: NonZeroU32::new(4_000).unwrap(),
+        height: NonZeroU32::new(4_000).unwrap(),
+        byte_length: 8_000_000,
+        effective_url: Some(effective_url),
+    }
+}
+
+#[tokio::test]
+async fn verified_candidate_becomes_a_content_frozen_selection() {
+    let (catalog, covers) = services().await;
+    let release_id = release(&catalog).await;
+    let candidate = covers
+        .create_candidate(NewCoverCandidate {
+            candidate_id: None,
+            release_id,
+            disc_number: 0,
+            source_kind: CoverSourceKind::Amazon,
+            source_release_revision_db_id: None,
+            submitted_url: "https://m.media-amazon.com/images/I/81abc._AC_SL1500_.jpg?X-Amz-Signature=abc%2F123".to_owned(),
+        })
+        .await
+        .unwrap();
+    assert_eq!(candidate.state, CoverCandidateState::Discovered);
+    assert!(candidate.has_remote_url);
+
+    let queued = covers
+        .queue_candidate(candidate.candidate_id, candidate.row_version, None)
+        .await
+        .unwrap();
+    assert_eq!(queued.state, CoverCandidateState::Queued);
+    let lease = covers
+        .claim_next(Duration::from_secs(60))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(lease.candidate_id, candidate.candidate_id);
+    assert!(lease.request_url.contains("/81abc.jpg?"));
+    assert!(lease.request_url.contains("X-Amz-Signature=abc%2F123"));
+
+    let verified = covers
+        .complete_fetch(
+            lease.candidate_id,
+            lease.row_version,
+            lease.lease_token,
+            verified_asset(lease.request_url),
+        )
+        .await
+        .unwrap();
+    assert_eq!(verified.state, CoverCandidateState::Verified);
+    let asset = verified.asset.as_ref().unwrap();
+    assert_eq!(
+        asset.storage_key,
+        cover_asset_storage_key(asset.content_sha256.as_bytes(), CoverMediaType::Jpeg)
+    );
+
+    let selection = covers
+        .select_cover(SelectCover {
+            release_id,
+            disc_number: 0,
+            candidate_id: verified.candidate_id,
+            expected_row_version: None,
+        })
+        .await
+        .unwrap();
+    assert_eq!(selection.row_version, CoverRowVersion::INITIAL);
+    assert_eq!(selection.asset.content_sha256, asset.content_sha256);
+}
+
+#[tokio::test]
+async fn an_expired_worker_lease_cannot_publish_an_asset() {
+    let (catalog, covers) = services().await;
+    let release_id = release(&catalog).await;
+    let candidate = covers
+        .create_candidate(NewCoverCandidate {
+            candidate_id: None,
+            release_id,
+            disc_number: 0,
+            source_kind: CoverSourceKind::ArtistWebsite,
+            source_release_revision_db_id: None,
+            submitted_url: "https://artist.example/ジャケット（初回）.jpg".to_owned(),
+        })
+        .await
+        .unwrap();
+    covers
+        .queue_candidate(candidate.candidate_id, candidate.row_version, None)
+        .await
+        .unwrap();
+    let expired = covers
+        .repository()
+        .claim_next_at(
+            chrono::Utc::now() - chrono::Duration::minutes(5),
+            Duration::from_secs(1),
+        )
+        .await
+        .unwrap()
+        .unwrap();
+
+    let stale = covers
+        .complete_fetch(
+            expired.candidate_id,
+            expired.row_version,
+            expired.lease_token,
+            verified_asset(expired.request_url),
+        )
+        .await;
+    assert!(matches!(stale, Err(CoverError::LeaseMismatch { .. })));
+    let reclaimed = covers
+        .claim_next(Duration::from_secs(60))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_ne!(reclaimed.lease_token, expired.lease_token);
+    assert!(reclaimed.row_version > expired.row_version);
+}
diff --git a/annim/tests/ingest_graphql.rs b/annim/tests/ingest_graphql.rs
new file mode 100644
index 00000000..3fd366b7
--- /dev/null
+++ b/annim/tests/ingest_graphql.rs
@@ -0,0 +1,374 @@
+#![cfg(feature = "sqlite")]
+
+use annim::{auth::AuthConfig, graphql::build_schema, migrator::Migrator};
+use async_graphql::Request;
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+use tokio::time::{timeout, Duration};
+use tokio_stream::StreamExt;
+
+async fn test_schema() -> annim::graphql::MetadataSchema {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database: DatabaseConnection = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    build_schema(database)
+}
+
+fn admin_request(query: impl Into<String>) -> Request {
+    const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+    let admin = AuthConfig::new(TOKEN)
+        .unwrap()
+        .authenticate_bearer(&format!("Bearer {TOKEN}"))
+        .unwrap();
+    Request::new(query).data(admin)
+}
+
+fn error_code(response: &async_graphql::Response) -> Option<&async_graphql::Value> {
+    response.errors.first()?.extensions.as_ref()?.get("code")
+}
+
+#[tokio::test]
+async fn ingest_queries_require_an_admin_token() {
+    let schema = test_schema().await;
+    let response = schema.execute("{ ingestJobs { jobId } }").await;
+
+    assert_eq!(response.errors.len(), 1);
+    assert_eq!(response.errors[0].message, "Unauthorized");
+}
+
+#[tokio::test]
+async fn graphql_executes_commands_and_reports_stale_writers() {
+    let schema = test_schema().await;
+    let job_id = Uuid::new_v4();
+
+    let created = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                createIngestJob(jobId: "{job_id}") {{
+                    jobId state metadataRevision rowVersion
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(created.errors.is_empty(), "{:?}", created.errors);
+    assert_eq!(
+        created.data.into_json().unwrap()["createIngestJob"]["rowVersion"],
+        "1"
+    );
+
+    let reviewed = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeIngestJobCommand(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "1"
+                    command: {{ beginReview: EXECUTE }}
+                }}) {{ state rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(reviewed.errors.is_empty(), "{:?}", reviewed.errors);
+    let reviewed = reviewed.data.into_json().unwrap();
+    assert_eq!(reviewed["executeIngestJobCommand"]["state"], "REVIEWING");
+    assert_eq!(reviewed["executeIngestJobCommand"]["rowVersion"], "2");
+
+    let stale = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeIngestJobCommand(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "1"
+                    command: {{ cancel: EXECUTE }}
+                }}) {{ state rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(
+        error_code(&stale),
+        Some(&async_graphql::Value::from("INGEST_JOB_CONFLICT"))
+    );
+    let extensions = stale.errors[0].extensions.as_ref().unwrap();
+    assert_eq!(
+        extensions.get("expectedRowVersion"),
+        Some(&async_graphql::Value::from("1"))
+    );
+    assert_eq!(
+        extensions.get("actualRowVersion"),
+        Some(&async_graphql::Value::from("2"))
+    );
+}
+
+#[tokio::test]
+async fn graphql_exposes_domain_transition_errors_with_stable_codes() {
+    let schema = test_schema().await;
+    let job_id = Uuid::new_v4();
+    let create = schema
+        .execute(admin_request(format!(
+            r#"mutation {{ createIngestJob(jobId: "{job_id}") {{ jobId }} }}"#
+        )))
+        .await;
+    assert!(create.errors.is_empty(), "{:?}", create.errors);
+
+    let digest = "00".repeat(32);
+    let response = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeIngestJobCommand(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "1"
+                    command: {{ beginExecution: {{ planDigest: "{digest}" }} }}
+                }}) {{ state }}
+            }}"#
+        )))
+        .await;
+
+    assert_eq!(
+        error_code(&response),
+        Some(&async_graphql::Value::from("INGEST_INVALID_TRANSITION"))
+    );
+}
+
+#[tokio::test]
+async fn subscription_emits_only_after_a_committed_update() {
+    let schema = test_schema().await;
+    let job_id = Uuid::new_v4();
+    let create = schema
+        .execute(admin_request(format!(
+            r#"mutation {{ createIngestJob(jobId: "{job_id}") {{ jobId }} }}"#
+        )))
+        .await;
+    assert!(create.errors.is_empty(), "{:?}", create.errors);
+
+    let mut events = Box::pin(schema.execute_stream(admin_request(format!(
+        r#"subscription {{
+            ingestJobChanged(jobId: "{job_id}", afterRowVersion: "1") {{
+                state rowVersion
+            }}
+        }}"#
+    ))));
+
+    // Poll once so the resolver installs its receiver before the mutation.
+    assert!(timeout(Duration::from_millis(20), events.next())
+        .await
+        .is_err());
+
+    let mutation = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeIngestJobCommand(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "1"
+                    command: {{ beginReview: EXECUTE }}
+                }}) {{ rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(mutation.errors.is_empty(), "{:?}", mutation.errors);
+
+    let event = timeout(Duration::from_secs(1), events.next())
+        .await
+        .expect("subscription timed out")
+        .expect("subscription ended");
+    assert!(event.errors.is_empty(), "{:?}", event.errors);
+    let event = event.data.into_json().unwrap();
+    assert_eq!(event["ingestJobChanged"]["state"], "REVIEWING");
+    assert_eq!(event["ingestJobChanged"]["rowVersion"], "2");
+}
+
+#[tokio::test]
+async fn graphql_reviews_exact_metadata_with_typed_evidence_and_optimistic_locking() {
+    let schema = test_schema().await;
+    let job_id = Uuid::new_v4();
+    let candidate_id = Uuid::new_v4();
+    let exact = "曲名（Booklet） / 曲名(Booklet)・A〜B～C";
+
+    let created = schema
+        .execute(admin_request(format!(
+            r#"mutation {{ createIngestJob(jobId: "{job_id}") {{ rowVersion }} }}"#
+        )))
+        .await;
+    assert!(created.errors.is_empty(), "{:?}", created.errors);
+    let reviewing = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                executeIngestJobCommand(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "1"
+                    command: {{ beginReview: EXECUTE }}
+                }}) {{ rowVersion }}
+            }}"#
+        )))
+        .await;
+    assert!(reviewing.errors.is_empty(), "{:?}", reviewing.errors);
+
+    let configured = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                editIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "2"
+                    expectedRevision: "1"
+                    edit: {{ configureReview: {{ profile: CD, trackCounts: [1] }} }}
+                }}) {{
+                    job {{ rowVersion }}
+                    draft {{ profile trackCounts requirementsConfigured totalRequired complete }}
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(configured.errors.is_empty(), "{:?}", configured.errors);
+    let configured = configured.data.into_json().unwrap();
+    assert_eq!(configured["editIngestMetadata"]["job"]["rowVersion"], "3");
+    assert_eq!(configured["editIngestMetadata"]["draft"]["profile"], "CD");
+    assert_eq!(
+        configured["editIngestMetadata"]["draft"]["totalRequired"],
+        "8"
+    );
+    assert_eq!(configured["editIngestMetadata"]["draft"]["complete"], false);
+
+    let incomplete = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                approveIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "3"
+                    expectedRevision: "1"
+                }}) {{ job {{ rowVersion }} }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(
+        error_code(&incomplete),
+        Some(&async_graphql::Value::from("INGEST_METADATA_INCOMPLETE"))
+    );
+
+    let wrong_value = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                editIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "3"
+                    expectedRevision: "1"
+                    edit: {{ addCandidate: {{
+                        field: {{ scope: ALBUM, field: TITLE }}
+                        value: {{ trackType: NORMAL }}
+                        evidence: {{
+                            sourceKind: CD_BOOKLET
+                            locator: "booklet.pdf#page=2"
+                            method: MANUAL_TRANSCRIPTION
+                        }}
+                        confidenceBasisPoints: 10000
+                    }} }}
+                }}) {{ job {{ rowVersion }} }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(
+        error_code(&wrong_value),
+        Some(&async_graphql::Value::from("INGEST_METADATA_INVALID_VALUE"))
+    );
+
+    let added = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                editIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "3"
+                    expectedRevision: "1"
+                    edit: {{ addCandidate: {{
+                        candidateId: "{candidate_id}"
+                        field: {{ scope: ALBUM, field: TITLE }}
+                        value: {{ text: "{exact}" }}
+                        evidence: {{
+                            sourceKind: CD_BOOKLET
+                            locator: "booklet.pdf#page=2"
+                            detail: "front cover title"
+                            method: MANUAL_TRANSCRIPTION
+                        }}
+                        confidenceBasisPoints: 10000
+                    }} }}
+                }}) {{
+                    job {{ rowVersion }}
+                    draft {{
+                        candidates {{
+                            candidateId recommended decision
+                            value {{ kind text }}
+                            evidence {{ sourceKind locator method }}
+                        }}
+                    }}
+                }}
+            }}"#
+        )))
+        .await;
+    assert!(added.errors.is_empty(), "{:?}", added.errors);
+    let added = added.data.into_json().unwrap();
+    assert_eq!(added["editIngestMetadata"]["job"]["rowVersion"], "4");
+    let candidate = &added["editIngestMetadata"]["draft"]["candidates"][0];
+    assert_eq!(candidate["value"]["text"], exact);
+    assert_eq!(candidate["decision"], "PENDING");
+    assert_eq!(candidate["recommended"], true);
+    assert_eq!(candidate["evidence"]["sourceKind"], "CD_BOOKLET");
+
+    let accepted = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                editIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "4"
+                    expectedRevision: "1"
+                    edit: {{ acceptCandidate: {{ candidateId: "{candidate_id}" }} }}
+                }}) {{ job {{ rowVersion }} draft {{ acceptedRequired }} }}
+            }}"#
+        )))
+        .await;
+    assert!(accepted.errors.is_empty(), "{:?}", accepted.errors);
+    assert_eq!(
+        accepted.data.into_json().unwrap()["editIngestMetadata"]["job"]["rowVersion"],
+        "5"
+    );
+
+    let queried = schema
+        .execute(admin_request(format!(
+            r#"query {{
+                ingestMetadataDraft(jobId: "{job_id}") {{
+                    job {{ rowVersion }}
+                    draft {{
+                        revision acceptedRequired
+                        candidates {{ candidateId decision value {{ text }} }}
+                    }}
+                }}
+                ingestMetadataRevisions(jobId: "{job_id}") {{ revision }}
+            }}"#
+        )))
+        .await;
+    assert!(queried.errors.is_empty(), "{:?}", queried.errors);
+    let queried = queried.data.into_json().unwrap();
+    assert_eq!(queried["ingestMetadataDraft"]["job"]["rowVersion"], "5");
+    assert_eq!(queried["ingestMetadataRevisions"][0]["revision"], "1");
+    assert_eq!(
+        queried["ingestMetadataDraft"]["draft"]["candidates"][0]["decision"],
+        "ACCEPTED"
+    );
+    assert_eq!(
+        queried["ingestMetadataDraft"]["draft"]["candidates"][0]["value"]["text"],
+        exact
+    );
+
+    let stale = schema
+        .execute(admin_request(format!(
+            r#"mutation {{
+                editIngestMetadata(input: {{
+                    jobId: "{job_id}"
+                    expectedRowVersion: "4"
+                    expectedRevision: "1"
+                    edit: {{ rejectCandidate: {{ candidateId: "{candidate_id}" }} }}
+                }}) {{ job {{ rowVersion }} }}
+            }}"#
+        )))
+        .await;
+    assert_eq!(
+        error_code(&stale),
+        Some(&async_graphql::Value::from("INGEST_JOB_CONFLICT"))
+    );
+}
diff --git a/annim/tests/ingest_job_migration.rs b/annim/tests/ingest_job_migration.rs
new file mode 100644
index 00000000..bb1ff0d5
--- /dev/null
+++ b/annim/tests/ingest_job_migration.rs
@@ -0,0 +1,94 @@
+#![cfg(feature = "sqlite")]
+
+use anni_ingest::{Digest, JobState};
+use annim::migrator::Migrator;
+use sea_orm::{prelude::Uuid, ConnectOptions, ConnectionTrait, Database, DbBackend, Statement};
+use sea_orm_migration::{MigratorTrait, SchemaManager};
+
+async fn migrated_database() -> sea_orm::DatabaseConnection {
+    // A SQLite in-memory database belongs to one connection. Limiting the pool
+    // keeps the migration and assertions on the same database instance.
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    database
+}
+
+async fn insert_job(
+    database: &sea_orm::DatabaseConnection,
+    job_id: Uuid,
+) -> Result<(), sea_orm::DbErr> {
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO ingest_job (job_id) VALUES (?)",
+            [job_id.into()],
+        ))
+        .await
+        .map(|_| ())
+}
+
+#[tokio::test]
+async fn migration_creates_job_with_domain_defaults() {
+    let database = migrated_database().await;
+    let manager = SchemaManager::new(&database);
+    assert!(manager.has_table("ingest_job").await.unwrap());
+
+    let job_id = Uuid::new_v4();
+    insert_job(&database, job_id).await.unwrap();
+
+    let row = database
+        .query_one(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "SELECT state, metadata_revision, row_version FROM ingest_job WHERE job_id = ?",
+            [job_id.into()],
+        ))
+        .await
+        .unwrap()
+        .unwrap();
+
+    assert_eq!(
+        row.try_get::<String>("", "state").unwrap(),
+        JobState::Created.as_str()
+    );
+    assert_eq!(row.try_get::<i64>("", "metadata_revision").unwrap(), 1);
+    assert_eq!(row.try_get::<i64>("", "row_version").unwrap(), 1);
+}
+
+#[tokio::test]
+async fn migration_enforces_stable_job_identity() {
+    let database = migrated_database().await;
+    let job_id = Uuid::new_v4();
+
+    insert_job(&database, job_id).await.unwrap();
+    let duplicate = insert_job(&database, job_id).await;
+
+    assert!(duplicate.is_err());
+}
+
+#[tokio::test]
+async fn migration_enforces_one_metadata_document_per_job_revision() {
+    let database = migrated_database().await;
+    let manager = SchemaManager::new(&database);
+    assert!(manager.has_table("ingest_metadata_revision").await.unwrap());
+
+    let job_id = Uuid::new_v4();
+    insert_job(&database, job_id).await.unwrap();
+    let insert = || {
+        database.execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO ingest_metadata_revision \
+             (job_id, revision, document, document_sha256) VALUES (?, ?, ?, ?)",
+            [
+                job_id.into(),
+                1_i64.into(),
+                "{}".into(),
+                vec![0_u8; Digest::LENGTH].into(),
+            ],
+        ))
+    };
+
+    insert().await.unwrap();
+    assert!(insert().await.is_err());
+}
diff --git a/annim/tests/ingest_job_repository.rs b/annim/tests/ingest_job_repository.rs
new file mode 100644
index 00000000..979729c4
--- /dev/null
+++ b/annim/tests/ingest_job_repository.rs
@@ -0,0 +1,340 @@
+#![cfg(feature = "sqlite")]
+
+use std::num::NonZeroU16;
+
+use anni_ingest::{
+    AlbumField, AlbumLayout, Confidence, Digest, Evidence, EvidenceMethod, EvidenceSourceKind,
+    FieldPath, IngestJob, JobState, MetadataCandidate, MetadataDraft, MetadataProfile,
+    MetadataReviewContext, MetadataRevision, MetadataValue,
+};
+use annim::{
+    ingest::{
+        IngestCommand, IngestJobRepository, IngestRepositoryError, IngestService,
+        IngestServiceError, MetadataEdit, RowVersion,
+    },
+    migrator::Migrator,
+};
+use sea_orm::{
+    prelude::Uuid, ConnectOptions, ConnectionTrait, Database, DatabaseConnection, DbBackend,
+    Statement,
+};
+use sea_orm_migration::MigratorTrait;
+
+async fn migrated_database() -> DatabaseConnection {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    let database = Database::connect(options).await.unwrap();
+    Migrator::up(&database, None).await.unwrap();
+    database
+}
+
+fn booklet_title(id: Uuid, value: &str) -> MetadataCandidate {
+    MetadataCandidate::new(
+        id,
+        FieldPath::Album(AlbumField::Title),
+        MetadataValue::Text(value.to_owned()),
+        Evidence::new(
+            EvidenceSourceKind::CdBooklet,
+            "booklet.pdf#page=2",
+            Some("front cover title".to_owned()),
+            EvidenceMethod::ManualTranscription,
+        ),
+        Confidence::new(10_000).unwrap(),
+    )
+    .unwrap()
+}
+
+#[tokio::test]
+async fn repository_round_trips_and_lists_versioned_jobs() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database);
+    let job = IngestJob::new(Uuid::new_v4());
+
+    let mut stored = repository.create(&job).await.unwrap();
+    assert_eq!(stored.row_version(), RowVersion::INITIAL);
+    assert_eq!(stored.job(), &job);
+    assert_eq!(
+        repository
+            .get_metadata_draft(job.id(), MetadataRevision::INITIAL)
+            .await
+            .unwrap()
+            .unwrap()
+            .draft(),
+        &MetadataDraft::new(MetadataRevision::INITIAL)
+    );
+    assert!(matches!(
+        repository.create(&job).await,
+        Err(IngestRepositoryError::AlreadyExists { .. })
+    ));
+
+    stored.job_mut().begin_review().unwrap();
+    repository.save(&mut stored).await.unwrap();
+
+    let mut unsafe_revision = stored.clone();
+    unsafe_revision
+        .job_mut()
+        .revise_metadata(MetadataRevision::INITIAL)
+        .unwrap();
+    assert!(matches!(
+        repository.save(&mut unsafe_revision).await,
+        Err(IngestRepositoryError::MetadataRevisionRequiresDocument { .. })
+    ));
+
+    assert_eq!(stored.row_version(), RowVersion::new(2).unwrap());
+    assert_eq!(
+        repository.get(job.id()).await.unwrap(),
+        Some(stored.clone())
+    );
+    assert_eq!(
+        repository
+            .list(Some(JobState::Reviewing), 10, 0)
+            .await
+            .unwrap(),
+        vec![stored]
+    );
+    assert!(repository
+        .list(Some(JobState::Created), 10, 0)
+        .await
+        .unwrap()
+        .is_empty());
+}
+
+#[tokio::test]
+async fn metadata_documents_preserve_unicode_and_fork_history() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database.clone());
+    let job = IngestJob::new(Uuid::new_v4());
+    let mut stored = repository.create(&job).await.unwrap();
+    stored.job_mut().begin_review().unwrap();
+    repository.save(&mut stored).await.unwrap();
+
+    let exact = "曲名（Booklet） / 曲名(Booklet)・A〜B～C";
+    let candidate_id = Uuid::new_v4();
+    let mut draft = repository
+        .get_metadata_draft(job.id(), MetadataRevision::INITIAL)
+        .await
+        .unwrap()
+        .unwrap()
+        .into_draft();
+    draft
+        .add_candidate(booklet_title(candidate_id, exact))
+        .unwrap();
+    draft.accept(candidate_id).unwrap();
+    let persisted = repository
+        .save_with_metadata(&mut stored, &draft)
+        .await
+        .unwrap();
+    assert_eq!(
+        persisted
+            .draft()
+            .accepted_value(FieldPath::Album(AlbumField::Title)),
+        Some(&MetadataValue::Text(exact.to_owned()))
+    );
+
+    let service = IngestService::new(repository.clone());
+    let revised = service
+        .execute(
+            job.id(),
+            stored.row_version(),
+            IngestCommand::ReviseMetadata {
+                expected_revision: MetadataRevision::INITIAL,
+            },
+        )
+        .await
+        .unwrap();
+    let next_revision = revised.job().metadata_revision();
+
+    let revisions = repository.list_metadata_revisions(job.id()).await.unwrap();
+    assert_eq!(revisions.len(), 2);
+    assert_eq!(revisions[0].draft().revision(), next_revision);
+    assert_eq!(
+        revisions[1]
+            .draft()
+            .accepted_value(FieldPath::Album(AlbumField::Title)),
+        Some(&MetadataValue::Text(exact.to_owned()))
+    );
+
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "UPDATE ingest_metadata_revision SET document = document || ' ' \
+             WHERE job_id = ? AND revision = ?",
+            [job.id().into(), 1_i64.into()],
+        ))
+        .await
+        .unwrap();
+    assert!(matches!(
+        repository
+            .get_metadata_draft(job.id(), MetadataRevision::INITIAL)
+            .await,
+        Err(IngestRepositoryError::MetadataDigestMismatch { .. })
+    ));
+}
+
+#[tokio::test]
+async fn stale_metadata_writer_cannot_leave_a_document_change() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database);
+    let job = IngestJob::new(Uuid::new_v4());
+    repository.create(&job).await.unwrap();
+
+    let mut winner_job = repository.get(job.id()).await.unwrap().unwrap();
+    let mut stale_job = winner_job.clone();
+    winner_job.job_mut().begin_review().unwrap();
+    stale_job.job_mut().begin_review().unwrap();
+    let base = repository
+        .get_metadata_draft(job.id(), MetadataRevision::INITIAL)
+        .await
+        .unwrap()
+        .unwrap()
+        .into_draft();
+    let mut winner_draft = base.clone();
+    winner_draft
+        .add_candidate(booklet_title(Uuid::new_v4(), "Winner"))
+        .unwrap();
+    let mut stale_draft = base;
+    stale_draft
+        .add_candidate(booklet_title(Uuid::new_v4(), "Stale"))
+        .unwrap();
+
+    repository
+        .save_with_metadata(&mut winner_job, &winner_draft)
+        .await
+        .unwrap();
+    assert!(matches!(
+        repository
+            .save_with_metadata(&mut stale_job, &stale_draft)
+            .await,
+        Err(IngestRepositoryError::ConcurrentModification { .. })
+    ));
+
+    let current = repository
+        .get_metadata_draft(job.id(), MetadataRevision::INITIAL)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(current.draft().candidates().len(), 1);
+    assert_eq!(
+        current.draft().candidates()[0].value(),
+        &MetadataValue::Text("Winner".to_owned())
+    );
+}
+
+#[tokio::test]
+async fn metadata_edits_are_idempotent_and_incomplete_approval_is_blocked() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database);
+    let service = IngestService::new(repository);
+    let created = service.create(Some(Uuid::new_v4())).await.unwrap();
+    let reviewing = service
+        .execute(
+            created.job().id(),
+            created.row_version(),
+            IngestCommand::BeginReview,
+        )
+        .await
+        .unwrap();
+    let context = MetadataReviewContext::new(
+        MetadataProfile::Cd,
+        AlbumLayout::new(vec![NonZeroU16::new(1).unwrap()]).unwrap(),
+    );
+    let configured = service
+        .edit_metadata(
+            reviewing.job().id(),
+            reviewing.row_version(),
+            MetadataRevision::INITIAL,
+            MetadataEdit::ConfigureReview(context.clone()),
+        )
+        .await
+        .unwrap();
+    let retried = service
+        .edit_metadata(
+            configured.job().job().id(),
+            configured.job().row_version(),
+            MetadataRevision::INITIAL,
+            MetadataEdit::ConfigureReview(context),
+        )
+        .await
+        .unwrap();
+    assert_eq!(retried.job().row_version(), configured.job().row_version());
+
+    assert!(matches!(
+        service
+            .execute(
+                retried.job().job().id(),
+                retried.job().row_version(),
+                IngestCommand::ApproveRevision {
+                    expected_revision: MetadataRevision::INITIAL,
+                },
+            )
+            .await,
+        Err(IngestServiceError::MetadataIncomplete { missing }) if !missing.is_empty()
+    ));
+    let current = service
+        .get(retried.job().job().id())
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(current.row_version(), retried.job().row_version());
+    assert_eq!(current.job().approved_revision(), None);
+}
+
+#[tokio::test]
+async fn stale_writer_is_rejected_without_overwriting_the_winner() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database);
+    let job = IngestJob::new(Uuid::new_v4());
+    repository.create(&job).await.unwrap();
+
+    let mut first = repository.get(job.id()).await.unwrap().unwrap();
+    let mut stale = first.clone();
+    first.job_mut().begin_review().unwrap();
+    stale.job_mut().begin_review().unwrap();
+
+    repository.save(&mut first).await.unwrap();
+    let error = repository.save(&mut stale).await.unwrap_err();
+
+    assert!(matches!(
+        error,
+        IngestRepositoryError::ConcurrentModification {
+            expected: RowVersion::INITIAL,
+            actual,
+            ..
+        } if actual == RowVersion::new(2).unwrap()
+    ));
+    assert_eq!(repository.get(job.id()).await.unwrap(), Some(first));
+}
+
+#[tokio::test]
+async fn corrupt_digest_is_rejected_at_the_repository_boundary() {
+    let database = migrated_database().await;
+    let repository = IngestJobRepository::new(database.clone());
+    let job_id = Uuid::new_v4();
+
+    database
+        .execute(Statement::from_sql_and_values(
+            DbBackend::Sqlite,
+            "INSERT INTO ingest_job \
+             (job_id, state, metadata_revision, approved_revision, manifest_digest, plan_digest) \
+             VALUES (?, ?, ?, ?, ?, ?)",
+            [
+                job_id.into(),
+                JobState::Planned.as_str().into(),
+                1_i64.into(),
+                1_i64.into(),
+                vec![1_u8].into(),
+                vec![2_u8; Digest::LENGTH].into(),
+            ],
+        ))
+        .await
+        .unwrap();
+
+    assert!(matches!(
+        repository.get(job_id).await,
+        Err(IngestRepositoryError::InvalidDigestLength {
+            field: "manifest_digest",
+            actual: 1,
+            ..
+        })
+    ));
+}
diff --git a/annim/tests/server_security.rs b/annim/tests/server_security.rs
new file mode 100644
index 00000000..816807b4
--- /dev/null
+++ b/annim/tests/server_security.rs
@@ -0,0 +1,869 @@
+#![cfg(feature = "sqlite")]
+
+use annim::{
+    auth::AuthConfig,
+    catalog::CatalogSyncService,
+    config::{CatalogSyncProvisioningConfig, ServerConfig, APPLE_MUSIC_SECRET_REF_ENV},
+    graphql::{build_schema, schema_builder_with_catalog_sync_service},
+    migrator::Migrator,
+    server::{build_router, ServerState},
+};
+use axum::{
+    body::{to_bytes, Body},
+    http::{
+        header::{
+            ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_REQUEST_HEADERS,
+            ACCESS_CONTROL_REQUEST_METHOD, AUTHORIZATION, CACHE_CONTROL, CONTENT_TYPE, HOST,
+            ORIGIN, WWW_AUTHENTICATE,
+        },
+        Method, Request, StatusCode,
+    },
+    Router,
+};
+use sea_orm::{prelude::Uuid, ConnectOptions, Database, DatabaseConnection};
+use sea_orm_migration::MigratorTrait;
+use tower::ServiceExt;
+
+const TOKEN: &str = "0123456789abcdef0123456789abcdef";
+const ALLOWED_ORIGIN: &str = "https://ui.example";
+const WEB_APP: &str = include_str!("../../annim-web/app.js");
+
+async fn connected_database() -> DatabaseConnection {
+    let mut options = ConnectOptions::new("sqlite::memory:");
+    options.max_connections(1);
+    Database::connect(options).await.unwrap()
+}
+
+fn config(allowed_origins: Option<&str>, graphiql_enabled: bool) -> ServerConfig {
+    ServerConfig::from_lookup(|name| match name {
+        "ANNIM_ALLOWED_ORIGINS" => allowed_origins.map(str::to_owned),
+        "ANNIM_GRAPHIQL_ENABLED" if graphiql_enabled => Some("true".to_owned()),
+        _ => None,
+    })
+    .unwrap()
+}
+
+fn router(database: DatabaseConnection, config: &ServerConfig) -> Router {
+    let schema = build_schema(database.clone());
+    let auth = AuthConfig::new(TOKEN).unwrap();
+    build_router(ServerState::new(schema, auth, database), config)
+}
+
+fn configured_catalog_router(database: DatabaseConnection, config: &ServerConfig) -> Router {
+    let provisioning = CatalogSyncProvisioningConfig::from_lookup(|name| {
+        (name == APPLE_MUSIC_SECRET_REF_ENV).then(|| "apple/developer-token.jwt".to_owned())
+    })
+    .unwrap();
+    let catalog_sync_service =
+        CatalogSyncService::with_provisioning(database.clone(), provisioning);
+    let schema =
+        schema_builder_with_catalog_sync_service(database.clone(), catalog_sync_service).finish();
+    let auth = AuthConfig::new(TOKEN).unwrap();
+    build_router(ServerState::new(schema, auth, database), config)
+}
+
+fn graphql_request(origin: Option<&str>, authorization: Option<&str>) -> Request<Body> {
+    let mut builder = Request::builder()
+        .method(Method::POST)
+        .uri("/")
+        .header(CONTENT_TYPE, "application/json");
+    if let Some(origin) = origin {
+        builder = builder.header(ORIGIN, origin);
+    }
+    if let Some(authorization) = authorization {
+        builder = builder.header(AUTHORIZATION, authorization);
+    }
+    builder
+        .body(Body::from(r#"{"query":"{ __typename }"}"#))
+        .unwrap()
+}
+
+fn web_query(name: &str) -> &str {
+    let marker = format!("const {name} = `");
+    let start = WEB_APP.find(&marker).expect("embedded query must exist") + marker.len();
+    let remainder = &WEB_APP[start..];
+    let end = remainder
+        .find("`;\n")
+        .expect("embedded query must end with a template literal");
+    &remainder[..end]
+}
+
+async fn execute_web_graphql(
+    app: &Router,
+    query: &str,
+    variables: serde_json::Value,
+) -> serde_json::Value {
+    let body = serde_json::json!({ "query": query, "variables": variables });
+    let response = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri("/")
+                .header(HOST, "127.0.0.1:8000")
+                .header(ORIGIN, "http://127.0.0.1:8000")
+                .header(AUTHORIZATION, format!("Bearer {TOKEN}"))
+                .header(CONTENT_TYPE, "application/json")
+                .body(Body::from(body.to_string()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let response = to_bytes(response.into_body(), 1024 * 1024).await.unwrap();
+    serde_json::from_slice(&response).unwrap()
+}
+
+#[tokio::test]
+async fn graphql_auth_debug_ui_and_health_have_fail_closed_transport_statuses() {
+    let database = connected_database().await;
+    let disabled = config(None, false);
+    let app = router(database, &disabled);
+
+    let unauthorized = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri("/")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(unauthorized.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(
+        unauthorized.headers().get(WWW_AUTHENTICATE).unwrap(),
+        "Bearer realm=\"annim\""
+    );
+
+    let invalid = app
+        .clone()
+        .oneshot(graphql_request(
+            None,
+            Some("Bearer fedcba9876543210fedcba9876543210"),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(invalid.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(
+        invalid.headers().get(WWW_AUTHENTICATE).unwrap(),
+        "Bearer realm=\"annim\""
+    );
+
+    let authorized = app
+        .clone()
+        .oneshot(graphql_request(None, Some(&format!("Bearer {TOKEN}"))))
+        .await
+        .unwrap();
+    assert_eq!(authorized.status(), StatusCode::OK);
+
+    let graphiql_disabled = app
+        .clone()
+        .oneshot(Request::get("/").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(graphiql_disabled.status(), StatusCode::METHOD_NOT_ALLOWED);
+
+    let live = app
+        .clone()
+        .oneshot(Request::get("/health/live").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(live.status(), StatusCode::OK);
+    assert_eq!(live.headers().get(CACHE_CONTROL).unwrap(), "no-store");
+    let ready = app
+        .clone()
+        .oneshot(Request::get("/health/ready").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(ready.status(), StatusCode::OK);
+    assert_eq!(ready.headers().get(CACHE_CONTROL).unwrap(), "no-store");
+
+    let blocked_preflight = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::OPTIONS)
+                .uri("/")
+                .header(ORIGIN, "https://unconfigured.example")
+                .header(ACCESS_CONTROL_REQUEST_METHOD, "POST")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(blocked_preflight.status(), StatusCode::FORBIDDEN);
+
+    let enabled = config(None, true);
+    let debug_app = router(DatabaseConnection::Disconnected, &enabled);
+    let graphiql = debug_app
+        .clone()
+        .oneshot(Request::get("/").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(graphiql.status(), StatusCode::OK);
+    let debug_post_without_auth = debug_app
+        .clone()
+        .oneshot(graphql_request(None, None))
+        .await
+        .unwrap();
+    assert_eq!(debug_post_without_auth.status(), StatusCode::UNAUTHORIZED);
+    let unavailable = debug_app
+        .oneshot(Request::get("/health/ready").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(unavailable.status(), StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(
+        unavailable.headers().get(CACHE_CONTROL).unwrap(),
+        "no-store"
+    );
+}
+
+#[tokio::test]
+async fn exact_origin_policy_is_shared_by_http_cors_and_websocket_handshakes() {
+    let database = connected_database().await;
+    let config = config(Some(ALLOWED_ORIGIN), false);
+    let app = router(database, &config);
+
+    let disallowed_http = app
+        .clone()
+        .oneshot(graphql_request(
+            Some("https://evil.example"),
+            Some(&format!("Bearer {TOKEN}")),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(disallowed_http.status(), StatusCode::FORBIDDEN);
+
+    let disallowed_ws = app
+        .clone()
+        .oneshot(
+            Request::get("/ws")
+                .header(ORIGIN, "https://evil.example")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(disallowed_ws.status(), StatusCode::FORBIDDEN);
+
+    let allowed_http = app
+        .clone()
+        .oneshot(graphql_request(
+            Some(ALLOWED_ORIGIN),
+            Some(&format!("Bearer {TOKEN}")),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(allowed_http.status(), StatusCode::OK);
+    assert_eq!(
+        allowed_http
+            .headers()
+            .get(ACCESS_CONTROL_ALLOW_ORIGIN)
+            .unwrap(),
+        ALLOWED_ORIGIN
+    );
+
+    let preflight = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::OPTIONS)
+                .uri("/")
+                .header(ORIGIN, ALLOWED_ORIGIN)
+                .header(ACCESS_CONTROL_REQUEST_METHOD, "POST")
+                .header(ACCESS_CONTROL_REQUEST_HEADERS, "authorization,content-type")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(preflight.status(), StatusCode::OK);
+    assert_eq!(
+        preflight
+            .headers()
+            .get(ACCESS_CONTROL_ALLOW_ORIGIN)
+            .unwrap(),
+        ALLOWED_ORIGIN
+    );
+
+    let allowed_ws_route = app
+        .oneshot(
+            Request::get("/ws")
+                .header(ORIGIN, ALLOWED_ORIGIN)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_ne!(allowed_ws_route.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn embedded_web_client_is_public_but_locked_to_same_origin_assets() {
+    let app = router(connected_database().await, &config(None, false));
+
+    for (path, content_type) in [
+        ("/app", "text/html; charset=utf-8"),
+        ("/app/", "text/html; charset=utf-8"),
+        ("/app/styles.css", "text/css; charset=utf-8"),
+        ("/app/app.js", "text/javascript; charset=utf-8"),
+    ] {
+        let response = app
+            .clone()
+            .oneshot(Request::get(path).body(Body::empty()).unwrap())
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK, "{path}");
+        assert_eq!(
+            response.headers().get(CONTENT_TYPE).unwrap(),
+            content_type,
+            "{path}"
+        );
+        assert_eq!(response.headers().get(CACHE_CONTROL).unwrap(), "no-store");
+        assert_eq!(
+            response.headers().get("x-content-type-options").unwrap(),
+            "nosniff"
+        );
+        let policy = response
+            .headers()
+            .get("content-security-policy")
+            .unwrap()
+            .to_str()
+            .unwrap();
+        assert!(policy.contains("default-src 'none'"));
+        assert!(policy.contains("script-src 'self'"));
+        assert!(policy.contains("connect-src 'self'"));
+
+        let body = to_bytes(response.into_body(), 2 * 1024 * 1024)
+            .await
+            .unwrap();
+        assert!(!body.is_empty(), "{path}");
+    }
+
+    let missing = app
+        .clone()
+        .oneshot(Request::get("/app/unknown.js").body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(missing.status(), StatusCode::NOT_FOUND);
+
+    let missing_host_graphql = app
+        .clone()
+        .oneshot(graphql_request(
+            Some("http://127.0.0.1:8000"),
+            Some(&format!("Bearer {TOKEN}")),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(missing_host_graphql.status(), StatusCode::FORBIDDEN);
+
+    let same_origin_graphql = app
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri("/")
+                .header(HOST, "127.0.0.1:8000")
+                .header(ORIGIN, "http://127.0.0.1:8000")
+                .header(AUTHORIZATION, format!("Bearer {TOKEN}"))
+                .header(CONTENT_TYPE, "application/json")
+                .body(Body::from(r#"{"query":"{ __typename }"}"#))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(same_origin_graphql.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn embedded_client_queries_match_the_live_graphql_schema() {
+    let database = connected_database().await;
+    Migrator::up(&database, None).await.unwrap();
+    let app = router(database, &config(None, false));
+    let missing_id = Uuid::new_v4().to_string();
+
+    for (name, variables) in [
+        (
+            "INTAKE_QUERY",
+            serde_json::json!({ "limit": 1, "offset": 0 }),
+        ),
+        (
+            "INGEST_REVIEW_QUERY",
+            serde_json::json!({ "jobId": missing_id.clone() }),
+        ),
+        (
+            "ARTISTS_QUERY",
+            serde_json::json!({ "search": null, "limit": 1, "offset": 0 }),
+        ),
+        (
+            "COLLECTION_QUERY",
+            serde_json::json!({ "artistId": missing_id, "limit": 1, "offset": 0 }),
+        ),
+    ] {
+        let response = execute_web_graphql(&app, web_query(name), variables).await;
+        assert!(
+            response.get("errors").is_none(),
+            "{name} failed: {response}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn embedded_metadata_review_mutations_use_live_concurrency_contracts() {
+    let database = connected_database().await;
+    Migrator::up(&database, None).await.unwrap();
+    let app = router(database, &config(None, false));
+    let job_id = Uuid::new_v4().to_string();
+    let candidate_id = Uuid::new_v4().to_string();
+    let exact = " 曲名（Booklet） / 曲名(Booklet)・A〜B～C ";
+
+    let created = execute_web_graphql(
+        &app,
+        "mutation WebTestCreate($jobId: UUID!) { createIngestJob(jobId: $jobId) { rowVersion } }",
+        serde_json::json!({ "jobId": job_id.clone() }),
+    )
+    .await;
+    assert_eq!(created["data"]["createIngestJob"]["rowVersion"], "1");
+
+    let reviewing = execute_web_graphql(
+        &app,
+        web_query("EXECUTE_INGEST_COMMAND_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id.clone(),
+                "expectedRowVersion": "1",
+                "command": { "beginReview": "EXECUTE" },
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        reviewing["data"]["executeIngestJobCommand"]["rowVersion"],
+        "2"
+    );
+
+    let configured = execute_web_graphql(
+        &app,
+        web_query("EDIT_METADATA_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id.clone(),
+                "expectedRowVersion": "2",
+                "expectedRevision": "1",
+                "edit": {
+                    "configureReview": { "profile": "STREAMING", "trackCounts": [1] }
+                },
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        configured["data"]["editIngestMetadata"]["job"]["rowVersion"],
+        "3"
+    );
+
+    let added = execute_web_graphql(
+        &app,
+        web_query("EDIT_METADATA_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id.clone(),
+                "expectedRowVersion": "3",
+                "expectedRevision": "1",
+                "edit": {
+                    "addCandidate": {
+                        "candidateId": candidate_id.clone(),
+                        "field": { "scope": "ALBUM", "field": "TITLE" },
+                        "value": { "text": exact },
+                        "evidence": {
+                            "sourceKind": "CD_BOOKLET",
+                            "locator": "booklet.pdf#page=2",
+                            "method": "MANUAL_TRANSCRIPTION",
+                        },
+                        "confidenceBasisPoints": 10000,
+                    }
+                },
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        added["data"]["editIngestMetadata"]["job"]["rowVersion"],
+        "4"
+    );
+
+    let accepted = execute_web_graphql(
+        &app,
+        web_query("EDIT_METADATA_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id.clone(),
+                "expectedRowVersion": "4",
+                "expectedRevision": "1",
+                "edit": { "acceptCandidate": { "candidateId": candidate_id } },
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        accepted["data"]["editIngestMetadata"]["job"]["rowVersion"],
+        "5"
+    );
+
+    let review = execute_web_graphql(
+        &app,
+        web_query("INGEST_REVIEW_QUERY"),
+        serde_json::json!({ "jobId": job_id.clone() }),
+    )
+    .await;
+    let candidate = &review["data"]["ingestMetadataDraft"]["draft"]["candidates"][0];
+    assert_eq!(candidate["value"]["text"], exact);
+    assert_eq!(candidate["decision"], "ACCEPTED");
+
+    let incomplete = execute_web_graphql(
+        &app,
+        web_query("APPROVE_METADATA_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id.clone(),
+                "expectedRowVersion": "5",
+                "expectedRevision": "1",
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        incomplete["errors"][0]["extensions"]["code"],
+        "INGEST_METADATA_INCOMPLETE"
+    );
+
+    let revised = execute_web_graphql(
+        &app,
+        web_query("REVISE_METADATA_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "jobId": job_id,
+                "expectedRowVersion": "5",
+                "expectedRevision": "1",
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        revised["data"]["reviseIngestMetadata"]["job"]["rowVersion"],
+        "6"
+    );
+    assert_eq!(
+        revised["data"]["reviseIngestMetadata"]["job"]["metadataRevision"],
+        "2"
+    );
+    assert_eq!(
+        revised["data"]["reviseIngestMetadata"]["draft"]["revision"],
+        "2"
+    );
+}
+
+#[tokio::test]
+async fn embedded_catalog_authoring_mutations_preserve_exact_artist_and_release_text() {
+    let database = connected_database().await;
+    Migrator::up(&database, None).await.unwrap();
+    let app = router(database, &config(None, false));
+    let exact_artist = " Artist（公式）・A〜B～C ";
+    let exact_title = " 作品・A〜B～C（初回） ";
+
+    let created_artist = execute_web_graphql(
+        &app,
+        web_query("CREATE_CATALOG_ARTIST_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "displayName": exact_artist,
+                "sortName": "Artist",
+                "notes": "official spelling",
+            }
+        }),
+    )
+    .await;
+    assert!(created_artist.get("errors").is_none(), "{created_artist}");
+    let artist = &created_artist["data"]["createCatalogArtist"];
+    assert_eq!(artist["displayName"], exact_artist);
+    assert_eq!(artist["rowVersion"], "1");
+    let artist_id = artist["artistId"].as_str().unwrap().to_owned();
+
+    let created_release = execute_web_graphql(
+        &app,
+        web_query("CREATE_CATALOG_RELEASE_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "artistId": artist_id.clone(),
+                "title": exact_title,
+                "edition": "初回限定盤（CD＋BD）",
+                "catalog": "TEST-0001",
+                "releaseDate": "2026-07",
+                "kind": "ALBUM",
+                "notes": "manual catalog entry",
+            }
+        }),
+    )
+    .await;
+    assert!(created_release.get("errors").is_none(), "{created_release}");
+    let release = &created_release["data"]["createCatalogRelease"];
+    assert_eq!(release["title"], exact_title);
+    assert_eq!(release["collectionState"], "MISSING");
+    assert_eq!(release["rowVersion"], "1");
+    let release_id = release["releaseId"].as_str().unwrap().to_owned();
+
+    let wanted = execute_web_graphql(
+        &app,
+        web_query("EXECUTE_CATALOG_RELEASE_COMMAND_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "releaseId": release_id.clone(),
+                "expectedRowVersion": "1",
+                "command": { "markWanted": "EXECUTE" },
+            }
+        }),
+    )
+    .await;
+    assert!(wanted.get("errors").is_none(), "{wanted}");
+    assert_eq!(
+        wanted["data"]["executeCatalogReleaseCommand"]["collectionState"],
+        "WANTED"
+    );
+    assert_eq!(
+        wanted["data"]["executeCatalogReleaseCommand"]["rowVersion"],
+        "2"
+    );
+
+    let exact_source = " 天使动漫（群友补档） ";
+    let recorded = execute_web_graphql(
+        &app,
+        web_query("EXECUTE_CATALOG_RELEASE_COMMAND_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "releaseId": release_id,
+                "expectedRowVersion": "2",
+                "command": {
+                    "recordCopy": {
+                        "sourceKind": "ANGEL_ANIME",
+                        "sourceLabel": exact_source,
+                        "privateLocator": "私有/不可公开/PT种子",
+                        "codec": "FLAC",
+                        "sampleRateHz": 96000,
+                        "bitDepth": 24,
+                        "channels": 2,
+                        "trackCount": 12,
+                        "byteLength": "1234567890",
+                        "manifestDigest": "5a".repeat(32),
+                        "qualityVerified": true,
+                        "notes": "原始抓取・A〜B～C",
+                    }
+                },
+            }
+        }),
+    )
+    .await;
+    assert!(recorded.get("errors").is_none(), "{recorded}");
+    let recorded_release = &recorded["data"]["executeCatalogReleaseCommand"];
+    assert_eq!(recorded_release["collectionState"], "ACQUIRED");
+    assert_eq!(recorded_release["rowVersion"], "3");
+    assert_eq!(recorded_release["copies"][0]["sourceLabel"], exact_source);
+    assert_eq!(
+        recorded_release["copies"][0]["qualityTier"],
+        "HI_RES_LOSSLESS"
+    );
+    assert_eq!(recorded_release["copies"][0]["byteLength"], "1234567890");
+    assert_eq!(recorded_release["copies"][0]["qualityVerified"], true);
+    assert!(
+        recorded_release["copies"][0]
+            .as_object()
+            .unwrap()
+            .get("privateLocator")
+            .is_none(),
+        "private locator must not be exposed by the embedded client mutation"
+    );
+
+    let collection = execute_web_graphql(
+        &app,
+        web_query("COLLECTION_QUERY"),
+        serde_json::json!({ "artistId": artist_id, "limit": 10, "offset": 0 }),
+    )
+    .await;
+    assert_eq!(
+        collection["data"]["catalogArtistCollection"]["artist"]["displayName"],
+        exact_artist
+    );
+    assert_eq!(
+        collection["data"]["catalogArtistCollection"]["releases"][0]["title"],
+        exact_title
+    );
+    let collection = &collection["data"]["catalogArtistCollection"];
+    assert_eq!(collection["summary"]["acquired"], "1");
+    assert_eq!(collection["summary"]["collected"], "1");
+    assert_eq!(collection["releases"][0]["collectionState"], "ACQUIRED");
+    assert_eq!(
+        collection["releases"][0]["copies"][0]["sourceLabel"],
+        exact_source
+    );
+    assert_eq!(
+        collection["releases"][0]["copies"][0]["qualityTier"],
+        "HI_RES_LOSSLESS"
+    );
+}
+
+#[tokio::test]
+async fn embedded_catalog_sync_controls_follow_the_live_provisioning_and_concurrency_contract() {
+    let database = connected_database().await;
+    Migrator::up(&database, None).await.unwrap();
+    let app = configured_catalog_router(database, &config(None, false));
+
+    let created_artist = execute_web_graphql(
+        &app,
+        web_query("CREATE_CATALOG_ARTIST_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "displayName": "Catalog Sync Test Artist",
+            }
+        }),
+    )
+    .await;
+    assert!(created_artist.get("errors").is_none(), "{created_artist}");
+    let artist_id = created_artist["data"]["createCatalogArtist"]["artistId"]
+        .as_str()
+        .unwrap()
+        .to_owned();
+
+    let created_source = execute_web_graphql(
+        &app,
+        web_query("CREATE_CATALOG_SYNC_SOURCE_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "artistId": artist_id.clone(),
+                "kind": "APPLE_MUSIC",
+                "locator": "1370700",
+                "storefront": "jp",
+                "locale": "ja-JP",
+            }
+        }),
+    )
+    .await;
+    assert!(created_source.get("errors").is_none(), "{created_source}");
+    let source = &created_source["data"]["createCatalogSyncSource"];
+    assert_eq!(source["provisioningState"], "READY_TO_QUEUE");
+    assert_eq!(source["rowVersion"], "1");
+    assert_eq!(source["enabled"], true);
+    let source_id = source["sourceId"].as_str().unwrap().to_owned();
+
+    let sources = execute_web_graphql(
+        &app,
+        web_query("CATALOG_SYNC_SOURCES_QUERY"),
+        serde_json::json!({ "artistId": artist_id }),
+    )
+    .await;
+    assert!(sources.get("errors").is_none(), "{sources}");
+    let sources = sources["data"]["catalogSyncSources"].as_array().unwrap();
+    assert_eq!(sources.len(), 1);
+    assert_eq!(sources[0]["sourceId"], source_id);
+    assert_eq!(sources[0]["rowVersion"], "1");
+
+    let source_by_id = execute_web_graphql(
+        &app,
+        web_query("CATALOG_SYNC_SOURCE_QUERY"),
+        serde_json::json!({ "sourceId": source_id.clone() }),
+    )
+    .await;
+    assert!(source_by_id.get("errors").is_none(), "{source_by_id}");
+    assert_eq!(
+        source_by_id["data"]["catalogSyncSource"]["sourceId"],
+        source_id
+    );
+
+    let started = execute_web_graphql(
+        &app,
+        web_query("START_CATALOG_SYNC_RUN_MUTATION"),
+        serde_json::json!({ "input": { "sourceId": source_id.clone() } }),
+    )
+    .await;
+    assert!(started.get("errors").is_none(), "{started}");
+    let run = &started["data"]["startCatalogSyncRun"];
+    assert_eq!(run["sourceId"], source_id);
+    assert_eq!(run["status"], "QUEUED");
+    assert_eq!(run["rowVersion"], "1");
+    let run_id = run["runId"].as_str().unwrap().to_owned();
+
+    let run_by_id = execute_web_graphql(
+        &app,
+        web_query("CATALOG_SYNC_RUN_QUERY"),
+        serde_json::json!({ "runId": run_id.clone() }),
+    )
+    .await;
+    assert!(run_by_id.get("errors").is_none(), "{run_by_id}");
+    assert_eq!(run_by_id["data"]["catalogSyncRun"]["runId"], run_id);
+    assert_eq!(run_by_id["data"]["catalogSyncRun"]["status"], "QUEUED");
+
+    let sources_after_enqueue = execute_web_graphql(
+        &app,
+        web_query("CATALOG_SYNC_SOURCES_QUERY"),
+        serde_json::json!({ "artistId": artist_id }),
+    )
+    .await;
+    assert!(
+        sources_after_enqueue.get("errors").is_none(),
+        "{sources_after_enqueue}"
+    );
+    let source_after_enqueue = &sources_after_enqueue["data"]["catalogSyncSources"][0];
+    assert_eq!(source_after_enqueue["sourceId"], source_id);
+    assert_eq!(source_after_enqueue["rowVersion"], "2");
+
+    let history = execute_web_graphql(
+        &app,
+        web_query("CATALOG_SYNC_RUNS_QUERY"),
+        serde_json::json!({
+            "sourceId": source_id.clone(),
+            "limit": 10,
+            "offset": 0,
+        }),
+    )
+    .await;
+    assert!(history.get("errors").is_none(), "{history}");
+    let runs = history["data"]["catalogSyncRuns"].as_array().unwrap();
+    assert_eq!(runs.len(), 1);
+    assert_eq!(runs[0]["runId"], run_id);
+    assert_eq!(runs[0]["sourceId"], source_id);
+    assert_eq!(runs[0]["status"], "QUEUED");
+
+    let disabled = execute_web_graphql(
+        &app,
+        web_query("SET_CATALOG_SYNC_SOURCE_ENABLED_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "sourceId": source_id.clone(),
+                "expectedRowVersion": "2",
+                "enabled": false,
+            }
+        }),
+    )
+    .await;
+    assert!(disabled.get("errors").is_none(), "{disabled}");
+    let disabled = &disabled["data"]["setCatalogSyncSourceEnabled"];
+    assert_eq!(disabled["enabled"], false);
+    assert_eq!(disabled["provisioningState"], "DISABLED");
+    assert_eq!(disabled["rowVersion"], "3");
+
+    let stale_reenable = execute_web_graphql(
+        &app,
+        web_query("SET_CATALOG_SYNC_SOURCE_ENABLED_MUTATION"),
+        serde_json::json!({
+            "input": {
+                "sourceId": source_id,
+                "expectedRowVersion": "2",
+                "enabled": true,
+            }
+        }),
+    )
+    .await;
+    assert_eq!(
+        stale_reenable["errors"][0]["extensions"]["code"],
+        "CATALOG_SYNC_SOURCE_CONFLICT"
+    );
+}
diff --git a/docs/annim-production-operations-and-disaster-recovery.md b/docs/annim-production-operations-and-disaster-recovery.md
new file mode 100644
index 00000000..7ac3977f
--- /dev/null
+++ b/docs/annim-production-operations-and-disaster-recovery.md
@@ -0,0 +1,819 @@
+# Annim 生产运维与灾备 Runbook
+
+本文面向 Annim、catalog worker、cover worker 和 Anni workspace 的生产运维人员。内容以仓库当前实现为准，说明如何启动服务、轮换密钥、备份和恢复数据，以及如何定期验证备份确实可用。
+
+文中的 `/srv/...`、`/mnt/...`、systemd unit 名称、PostgreSQL service 名称和对象存储产品均为部署方占位符，必须按实际环境替换。不要直接复制一个尚未替换占位符的命令到生产环境。
+
+## 1. 不可破坏的安全规则
+
+以下规则优先于恢复速度和运维便利性：
+
+1. 备份账号对源音频只能拥有读取和遍历权限，不得拥有写入、重命名或删除权限。
+2. 优先从存储平台提供的只读 snapshot/mount 读取音频。若只能读取生产挂载点，应由存储管理员确认其使用 `noatime`/等价策略；某些 `strictatime` 文件系统会因普通读取更新 atime，这也不符合“源数据零变更”的严格要求。
+3. 每次备份都写入一个全新的、不可变的 generation 目录或对象存储前缀。不得把生产目录当作 rsync 目标。
+4. 禁止在备份命令中使用 `rsync --delete`、`rsync --remove-source-files`、`mv`、`rm`、`cp -al` 或任何“同步后清理源文件”的选项。
+5. 不得用源目录与备份目录之间的硬链接代替备份。两者共享 inode 时，后续写入会同时改变“备份”。文件系统原生的只读快照或 copy-on-write 快照可以使用，但需要由存储平台确认隔离语义。
+6. 恢复必须落到新的数据库、新的 cover root 和新的音频目录。校验完成后通过配置或挂载切换；不得直接覆盖现有生产音频。
+7. 备份和恢复验证期间禁止运行会改变工作区的命令，包括 `anni workspace fsck --gc`、`anni workspace fsck --fix-dangling`、`anni workspace publish`、`anni workspace revert` 和音频标签写入工具。
+8. 用户可见的 workspace 目录可能只保存指向 `.anni/objects` 的符号链接。备份这些符号链接不能替代备份其实际音频目标。
+
+如果任何脚本无法证明“源路径只读、目标路径为新 generation”，应立即停止，而不是尝试自动修复路径。
+
+## 2. 当前运行边界和数据面
+
+### 2.1 组件
+
+| 组件 | 当前职责 | 写入位置 |
+| --- | --- | --- |
+| `annim` | GraphQL API、认证、迁移、健康检查、Tantivy 搜索 | Annim 数据库、`ANNIM_SEARCH_DIRECTORY` |
+| `catalog-worker` | 领取 catalog sync run，从外部目录抓取版本化 observation | Annim 数据库；只读取 catalog secret root |
+| `cover-worker` | 领取 cover candidate，安全下载并验证图片 | Annim 数据库、`ANNIM_COVER_ASSET_ROOT` |
+| Anni workspace/repository | 保存传统 TOML 元数据、受控音频和发布后的音频 | `.anni/repo`、`.anni/objects`、配置中的 library root |
+
+当前 `catalog-worker` 只注册了 Apple Music adapter。数据库模型可以记录其他信源，但不能因此假设 VGMDB、唱片公司或艺人官网已有可运行的 worker adapter。
+
+当前 `anni-ingest-worker` 是供调用方集成的 Rust library，没有可直接部署的 worker binary、队列轮询器或环境变量契约。Annim 会保存 ingest job 状态、metadata revision 正文，以及 manifest/plan/verification 的 digest；它不保存 input manifest、execution plan 和 execution receipt 的完整正文。实际部署若已由外部协调器执行 ingest，协调器的 immutable artifact store、source root 和 staging/publish receipt 也是恢复面，不能只备份 Annim 数据库。
+
+Apple Music 的 credential binding 由 Annim server 的受信任配置完成。GraphQL 不接收或返回 `secret_ref`；`CatalogSyncService` 会在建立 Apple source 时附加配置好的引用，并在启动时幂等补齐旧记录中仍为 `NULL` 的引用。未配置引用时 Apple source 创建会失败，已有非法非空引用也不会被自动覆盖。当前 Web UI 尚未提供 catalog source 管理界面，其他信源仍没有可运行 adapter。
+
+Catalog sync 控制面会保留并分页返回每个 source 的 run 历史，同一 source 同时只允许一个 `queued` 或 `running` run。停用 source 使用 row-version CAS；已经 queued 的 run 会保留并暂停，worker 轮询会跳过它，重新启用后可以继续领取。已经取得有效 lease 的 worker 可以完成当前 run，停用操作不会隐式删除历史或伪造取消状态。
+
+实现入口：
+
+- Annim 启动和迁移：[annim/src/main.rs](../annim/src/main.rs)
+- 网络与 CORS 配置：[annim/src/config.rs](../annim/src/config.rs)
+- Bearer token 规则：[annim/src/auth.rs](../annim/src/auth.rs)
+- Catalog worker 配置和 secret resolver：[anni-catalog-worker/src/bin/catalog-worker.rs](../anni-catalog-worker/src/bin/catalog-worker.rs)
+- Cover worker 配置：[annim/src/bin/cover-worker.rs](../annim/src/bin/cover-worker.rs)
+- Cover 内容寻址规则：[anni-catalog/src/cover.rs](../anni-catalog/src/cover.rs)
+- Workspace 目录语义：[anni-workspace/src/lib.rs](../anni-workspace/src/lib.rs)
+- 传统元数据仓库语义：[anni-repo/src/manager.rs](../anni-repo/src/manager.rs)
+
+### 2.2 必须纳入恢复集的数据
+
+一个可以恢复的 Annim generation 至少包含：
+
+| 数据 | 权威性和恢复要求 |
+| --- | --- |
+| Annim 数据库 | 权威数据。包含元数据、证据和修订、ingest job 状态与 digest、catalog observation、cover candidate/selection 及文件引用；不包含完整 ingest manifest/plan/receipt 正文 |
+| `ANNIM_COVER_ASSET_ROOT` | 权威图片字节。已验证文件使用 `sha256/aa/bb/<64 位小写 SHA-256>.<ext>`；必须和数据库属于同一 generation |
+| `ANNIM_SEARCH_DIRECTORY` | Tantivy 派生索引，可通过受保护的 GraphQL `rebuildSearchIndex` mutation 从数据库重建。备份仅用于缩短恢复时间，不能作为权威数据 |
+| Catalog secret | 不进入普通文件备份。由 secret manager 单独做版本化、加密和访问审计；恢复时重新物化为普通文件 |
+| `.anni/repo` | 传统 Anni TOML 元数据仓库。Git remote 不能替代本地备份，因为可能存在未提交或未推送内容 |
+| `.anni/config.toml` | Workspace 布局和发布目标。远程 metadata 模式下可能含 token，必须按 secret 处理 |
+| `.anni/objects` | 尚未硬发布的受控音频原件 |
+| 每个 library root | 硬发布后音频可能只存在于这里；路径来自 `.anni/config.toml` 的 library 配置 |
+| Workspace 用户区 | 目录和符号链接拓扑。它有助于恢复操作视图，但不能替代 `.anni/objects` 和 library root |
+| 外部 ingest artifact store（若已部署） | 保存完整 input manifest、execution plan、execution receipt 和协调器审计记录；其字节必须能重新计算出 Annim 数据库中的 digest |
+| CD/Booklet evidence store | 保存原始 CUE/WAV、抓轨日志、Booklet/包装扫描或 PDF。Metadata revision 只保存 evidence 的 locator/detail，不保存这些二进制原件 |
+
+“Anni repository”在现有代码中主要指 `repo.toml`、album/tag TOML 等元数据；它本身不是完整音频库。灾备必须同时覆盖元数据仓库和真实音频根目录。
+
+Annim 数据库还可能包含 private locator、提交/生效 URL、catalog raw document、source configuration 和 evidence locator。数据库 dump、row-count 附件和演练日志都应按敏感数据加密、最小授权和审计，不能上传到普通 CI artifact 或公开对象存储。
+
+## 3. 上线前参数表
+
+### 3.1 先确定恢复目标
+
+生产负责人应在上线前填写以下值。没有明确的 RPO/RTO 时，不应声称系统已具备灾备能力。
+
+| 项目 | 生产值 |
+| --- | --- |
+| 数据库 RPO | `[待填写，例如 15 分钟]` |
+| Cover / metadata repo RPO | `[待填写]` |
+| 新入库音频 RPO | `[待填写；不得晚于删除唯一上游副本的时间]` |
+| Annim API RTO | `[待填写]` |
+| 全量音频恢复 RTO | `[待填写]` |
+| 不可变备份保留期 | `[待填写]` |
+| 恢复演练频率 | `[待填写；建议至少每季度]` |
+| 灾备负责人和替补 | `[待填写]` |
+
+### 3.2 Annim server 环境变量
+
+| 变量 | 必需 | 当前规则 |
+| --- | --- | --- |
+| `ANNIM_DATABASE_URL` | 是 | SQLite 或 PostgreSQL SeaORM URL。不要把含密码的 URL 写入仓库或日志 |
+| `ANNIM_AUTH_TOKEN` | 是 | 至少 32 个字符，不允许空白；只在进程启动时读取 |
+| `ANNIM_SEARCH_DIRECTORY` | 是 | Tantivy 目录；进程会创建目录，但运行用户必须拥有安全的读写权限 |
+| `ANNIM_BIND_ADDR` | 否 | 默认 `127.0.0.1:8000`；非 loopback 监听必须放在受信任的 TLS reverse proxy 后 |
+| `ANNIM_ALLOWED_ORIGINS` | 否 | 逗号分隔的精确 `http`/`https` origin；默认空。不能使用 `*`、`null`、路径、凭据或尾随 `/` |
+| `ANNIM_GRAPHIQL_ENABLED` | 否 | 只能是 `true` 或 `false`，默认 `false` |
+| `ANNIM_CATALOG_APPLE_MUSIC_SECRET_REF` | 否 | Apple token 文件相对于 worker secret root 的引用；不是 token。缺失时 Annim 仍可启动，但不能从 Web 控制面建立 Apple source |
+
+健康检查不需要 token：
+
+```bash
+curl --fail --silent --show-error http://127.0.0.1:8000/health/live
+curl --fail --silent --show-error http://127.0.0.1:8000/health/ready
+```
+
+`live` 只证明进程能响应；`ready` 还会执行数据库 ping。两者返回 `Cache-Control: no-store`。
+
+### 3.3 Catalog worker 环境变量
+
+| 变量 | 必需 | 默认值 / 当前边界 |
+| --- | --- | --- |
+| `ANNIM_DATABASE_URL` | 是 | 必须指向与 Annim server 相同的数据库 |
+| `ANNIM_CATALOG_SECRET_ROOT` | 是 | 必须是已存在的绝对目录 |
+| `ANNIM_CATALOG_POLL_INTERVAL_SECONDS` | 否 | 默认 5；范围 1–3600 |
+| `ANNIM_CATALOG_LEASE_SECONDS` | 否 | 默认 600；范围 30–3600 |
+| `ANNIM_CATALOG_PAGE_TIMEOUT_SECONDS` | 否 | 默认 60；范围 2–600，且必须小于 lease |
+| `ANNIM_CATALOG_CONNECT_TIMEOUT_SECONDS` | 否 | 默认 10；范围 1–60，不得大于 request timeout |
+| `ANNIM_CATALOG_REQUEST_TIMEOUT_SECONDS` | 否 | 默认 30；范围 1–300，且必须小于 page timeout |
+| `ANNIM_CATALOG_MAX_RESPONSE_BYTES` | 否 | 默认 4 MiB；范围 64 KiB–32 MiB |
+| `ANNIM_CATALOG_MAX_SECRET_BYTES` | 否 | 默认 16 KiB；范围 256 B–64 KiB |
+
+Apple Music source 的 `secret_ref` 是相对于 secret root 的普通文件路径。Annim 启动配置会拒绝绝对路径、`.`、`..`、反斜杠、控制字符、超长值和形似直接填入的 compact JWT；worker resolver 还会拒绝符号链接、非普通文件、越界路径和非 UTF-8 内容。文件内容本身必须是合法 compact JWT，且不能带尾随换行。数据库只保存引用，不保存 token 本身。
+
+### 3.4 Cover worker 环境变量
+
+| 变量 | 必需 | 当前规则 |
+| --- | --- | --- |
+| `ANNIM_DATABASE_URL` | 是 | 必须指向同一 Annim 数据库 |
+| `ANNIM_COVER_ASSET_ROOT` | 是 | 必须预先存在；生产中应使用绝对路径和专用挂载点 |
+| `ANNIM_COVER_POLL_INTERVAL_SECONDS` | 否 | 默认 5；范围 1–3600 |
+
+Worker 会在 cover root 下创建 `.incoming`，下载完成后再把已验证文件提交到内容寻址路径。备份不应把 `.incoming` 中的 partial 文件当作有效资产。
+
+### 3.5 构建和启动顺序
+
+默认 feature 是 PostgreSQL：
+
+```bash
+cargo build --locked --release -p annim --bins
+cargo build --locked --release -p anni-catalog-worker --bin catalog-worker
+```
+
+SQLite 部署应分别显式构建：
+
+```bash
+cargo build --locked --release -p annim --no-default-features --features sqlite --bins
+cargo build --locked --release -p anni-catalog-worker --no-default-features --features sqlite --bin catalog-worker
+```
+
+当前 SQLite 路径没有单独的 WAL/busy-timeout 运维配置，而 server、catalog worker 和 cover worker 都会连接同一数据库。多进程生产部署应优先 PostgreSQL；选择 SQLite 时必须在目标负载下验证锁等待，并在备份/恢复期间完整停止 writer。
+
+二进制名称为 `annim`、`cover-worker` 和 `catalog-worker`。生产中应由 systemd、容器编排器或等价 supervisor 管理，并把环境变量放在权限受控的 secret/config 文件中。
+
+启动顺序：
+
+1. 确认数据库、search root、cover root 和 secret root 已挂载到预期设备，并确认 `ANNIM_CATALOG_APPLE_MUSIC_SECRET_REF` 能在 catalog worker 的 secret root 下解析到预期文件。
+2. 启动 `annim`。它会先执行数据库 migration，再只对 `secret_ref IS NULL` 的既有 Apple source 执行幂等 credential binding；不会覆盖非空旧值。
+3. 等待 `/health/ready` 成功。
+4. 启动 `catalog-worker`。它也会执行 migration；此时应为 no-op。
+5. 启动 `cover-worker`。
+6. 确认 worker 日志没有持续 retry 或 cycle failure。
+
+停止时使用相反顺序：先停止 catalog/cover worker，再阻断 API 写流量并停止 Annim。应等待 supervisor 报告进程已退出，不要直接发送不可捕获的强制终止信号。
+
+由于 Annim 和 catalog worker 当前会在启动时自动 migration，它们使用的数据库身份需要相应 DDL 权限。若生产安全基线要求运行身份仅有 DML 权限，需要先建设独立 migration job；在此之前不能简单移除 DDL 权限并期待服务仍能启动。
+
+## 4. Secret 和 token 轮换
+
+### 4.1 通用规则
+
+- Secret manager 是权威来源；环境文件和 catalog secret root 只是运行时物化副本。
+- 不在 shell history、工单、日志、进程参数截图或备份 manifest 中记录 secret 值。
+- 轮换前确认旧值仍可短期回滚，轮换成功后再在上游撤销旧值。
+- 轮换窗口内暂停相关 worker，避免一个多页 run 同时使用新旧凭据。
+- 每次轮换记录负责人、时间、secret version 和验证结果，不记录明文。
+
+### 4.2 `ANNIM_AUTH_TOKEN`
+
+当前实现只接受一个 token，没有双 token 过渡期，而且只在 Annim 启动时读取。轮换需要维护窗口：
+
+1. 在 secret manager 中生成至少 32 字符且无空白的新 token。例如 `openssl rand -hex 32` 会生成 64 个十六进制字符。
+2. 先把新版本分发到客户端的受控配置，但暂不让客户端切换请求。
+3. 阻断新写请求并停止 Annim。
+4. 更新 Annim 的 `ANNIM_AUTH_TOKEN` secret version，然后启动 Annim。
+5. 检查 live/ready；用新 token 发起一个只读 GraphQL 请求，确认 HTTP 200。
+6. 确认旧 token 得到 HTTP 401 和 `WWW-Authenticate: Bearer realm="annim"`。
+7. 切换客户端并撤销旧 token。WebSocket 客户端需要重新连接并在 connection-init 中发送新的 Bearer 值。
+
+如果验证失败，恢复 secret manager 中的旧 version 并重启 Annim。不要为了临时恢复服务而设置短 token 或默认 token。
+
+### 4.3 Apple Music developer token
+
+推荐使用稳定的 `secret_ref` 文件名，由 secret manager 在同一文件系统内原子替换文件。示例中的路径仅为部署占位符：
+
+```bash
+export CATALOG_SECRET_ROOT=/run/secrets/annim/catalog
+export APPLE_SECRET_PATH="$CATALOG_SECRET_ROOT/apple/developer-token"
+export ANNIM_CATALOG_APPLE_MUSIC_SECRET_REF=apple/developer-token
+
+# [按部署平台替换] NEW_APPLE_TOKEN_FILE 是 secret manager 物化的新版本。
+install -m 0600 -- /run/secrets/NEW_APPLE_TOKEN_FILE "$APPLE_SECRET_PATH.next"
+mv -f -- "$APPLE_SECRET_PATH.next" "$APPLE_SECRET_PATH"
+```
+
+执行前停止 `catalog-worker`；执行后确认文件和每一级父目录都不是符号链接，再启动 worker。旧 token 仅保留在 secret manager 的受控版本历史中，不在 secret root 留明文副本。验证一次 Apple sync 成功后再撤销旧 token。
+
+### 4.4 数据库凭据
+
+1. 在数据库或托管平台中创建可重叠使用的新凭据，不先撤销旧凭据。
+2. 更新 Annim、catalog worker 和 cover worker 的 `ANNIM_DATABASE_URL` secret version。
+3. 按“worker 停止 → Annim 重启并 ready → worker 启动”的顺序重启。
+4. 确认三个进程均已建立新连接，再撤销旧凭据。
+
+PostgreSQL CLI 建议通过权限为 `0600` 的 `PGPASSFILE` 和 `PGSERVICE` 使用凭据，避免把密码直接写进命令行。SQLite 文件权限应限制到服务账号和备份只读账号。
+
+## 5. 3-2-1 备份策略
+
+每个已验证 generation 应满足：
+
+- **3 份副本**：生产数据、同站点快速恢复副本、异地副本。
+- **2 个故障域或介质**：例如生产 NVMe + 独立备份存储，而不是同一文件系统中的两个目录。
+- **1 份异地且不可变**：启用对象锁/WORM 或离线介质，使用独立凭据并加密。
+
+建议的起始调度如下，最终频率以第 3.1 节的 RPO 为准：
+
+| 数据 | 起始调度 | 说明 |
+| --- | --- | --- |
+| PostgreSQL | 每日 custom dump；若 RPO 小于一天，再配置托管 PITR/WAL 归档 | PITR 命令和保留策略由数据库提供商实现并演练 |
+| SQLite | 至少每日 `.backup`；高频写入时提高频率 | 不能用在线复制 `db`/`-wal`/`-shm` 文件代替 `.backup` |
+| Cover/search/repo | 每日 generation；重大 ingest 后额外生成 | 必须与可识别的数据库 generation 关联 |
+| 音频 objects/library | 每次入库完成后进入增量备份；至少每日封存 | 在满足音频 RPO 前，不得删除抓轨、下载或分享来源中的唯一副本 |
+| Secret | 由 secret manager 自动版本化和异地加密 | 不与普通文件备份放在同一权限域 |
+
+每个 generation 保存以下 manifest：
+
+- UTC backup ID、应用 commit/version、数据库类型和数据库版本；
+- 所有数据 root 的明确路径和存储卷 ID；
+- 数据库 row-count 摘要；
+- 数据库 dump 和文件树 SHA-256；
+- metadata repo 的 Git HEAD、`git status --porcelain` 和 lint 结果；
+- 备份开始/结束时间、停写窗口、执行人和验证结果；
+- 对象存储 version/retention ID，但不包含任何 secret。
+
+## 6. 一致性备份流程
+
+### 6.1 创建新 generation
+
+以下是 GNU/Linux + Bash 示例。`BACKUP_BASE` 必须是独立备份设备或备份 agent 的 staging 区，不得位于任何源 audio root 内。
+
+```bash
+set -euo pipefail
+umask 077
+
+export BACKUP_ID="$(date -u +%Y%m%dT%H%M%SZ)"
+export BACKUP_BASE=/mnt/annim-backup
+export BACKUP_ROOT="$BACKUP_BASE/$BACKUP_ID"
+
+: "${BACKUP_ROOT:?BACKUP_ROOT is required}"
+test ! -e "$BACKUP_ROOT"
+install -d -m 0700 -- "$BACKUP_ROOT/database" "$BACKUP_ROOT/manifests"
+```
+
+如果 generation 已存在，命令应失败。不得“继续写入”旧 generation。
+
+### 6.2 进入停写窗口
+
+1. 在 reverse proxy 或维护开关中阻断 GraphQL 写请求。
+2. 停止 `catalog-worker` 和 `cover-worker`，等待当前操作退出。
+3. 停止所有外部 ingest/归位进程。
+4. 停止 Annim。
+5. 用部署平台的进程和连接检查确认没有 writer。
+6. 记录数据库、cover、search、workspace、objects 和所有 library root 的真实挂载点。
+
+若部署存在外部 ingest artifact store，还要冻结并备份其 immutable manifests/plans/receipts、source locator 映射和 staging receipt。仓库当前没有统一路径或命令，必须在部署方 SOP 中明确，且 artifact backup 账号同样不得写入源音频。
+
+`systemctl stop ...`、Kubernetes scale-down、云数据库 snapshot 等命令因部署平台而异，必须在本地 SOP 中填写；不要把本文中的组件名误认为已存在的 unit 名称。
+
+### 6.3 SQLite 备份
+
+`ANNIM_SQLITE_DB` 是从 `ANNIM_DATABASE_URL` 中人工确认出的绝对文件路径，不要用脆弱的 shell 字符串替换自动解析 URL。
+
+```bash
+export ANNIM_SQLITE_DB=/srv/annim/database/annim.sqlite3
+export SQLITE_BACKUP="$BACKUP_ROOT/database/annim.sqlite3"
+
+test -f "$ANNIM_SQLITE_DB"
+test ! -e "$SQLITE_BACKUP"
+sqlite3 -batch "$ANNIM_SQLITE_DB" ".timeout 5000" ".backup \"$SQLITE_BACKUP\""
+
+sqlite3 -batch "$SQLITE_BACKUP" "PRAGMA quick_check;"
+sqlite3 -batch "$SQLITE_BACKUP" "PRAGMA foreign_key_check;"
+sha256sum -- "$SQLITE_BACKUP" > "$BACKUP_ROOT/manifests/annim-sqlite.sha256"
+```
+
+`quick_check` 必须只输出 `ok`，`foreign_key_check` 必须没有输出。SQLite 的 `.backup` 使用在线 backup API 生成一致快照；即使已停写，也不要用 `cp` 直接复制正在打开的主数据库、WAL 和 SHM 文件。
+
+保存关键 row count：
+
+```bash
+sqlite3 -batch -header -csv "$SQLITE_BACKUP" \
+  "SELECT 'album' AS entity, COUNT(*) AS rows FROM album
+   UNION ALL SELECT 'ingest_job', COUNT(*) FROM ingest_job
+   UNION ALL SELECT 'catalog_artist', COUNT(*) FROM catalog_artist
+   UNION ALL SELECT 'catalog_source', COUNT(*) FROM catalog_source
+   UNION ALL SELECT 'cover_asset', COUNT(*) FROM cover_asset
+   ORDER BY entity;" \
+  > "$BACKUP_ROOT/manifests/database-row-counts.csv"
+```
+
+### 6.4 PostgreSQL 备份
+
+以下命令假定部署方已配置 `[annim]` libpq service 和权限为 `0600` 的 `PGPASSFILE`。`service=annim` 是占位符，不是仓库内置配置。
+
+```bash
+export PG_BACKUP="$BACKUP_ROOT/database/annim.dump"
+
+test ! -e "$PG_BACKUP"
+pg_dump \
+  --dbname="service=annim" \
+  --format=custom \
+  --no-owner \
+  --no-acl \
+  --file="$PG_BACKUP"
+
+pg_restore --list "$PG_BACKUP" > "$BACKUP_ROOT/manifests/annim-pg-archive.list"
+sha256sum -- "$PG_BACKUP" > "$BACKUP_ROOT/manifests/annim-pg.sha256"
+```
+
+必须检查 `pg_dump` 的 stderr 和退出码。Custom format 可由 `pg_restore` 检查目录并恢复；不要仅凭 dump 文件大小判断成功。
+
+该 dump 使用 `--no-owner --no-acl`，不会恢复数据库 role、密码或原 ACL。它们必须由受版本控制的基础设施配置和 secret manager 重建，且不能依赖 dump 中的生产身份。
+
+保存 row count：
+
+```bash
+psql --dbname="service=annim" --csv --set=ON_ERROR_STOP=1 \
+  --command="SELECT 'album' AS entity, COUNT(*) AS rows FROM album
+             UNION ALL SELECT 'ingest_job', COUNT(*) FROM ingest_job
+             UNION ALL SELECT 'catalog_artist', COUNT(*) FROM catalog_artist
+             UNION ALL SELECT 'catalog_source', COUNT(*) FROM catalog_source
+             UNION ALL SELECT 'cover_asset', COUNT(*) FROM cover_asset
+             ORDER BY entity;" \
+  > "$BACKUP_ROOT/manifests/database-row-counts.csv"
+```
+
+托管 PostgreSQL 的 PITR、WAL archive、跨区副本和 snapshot 命令属于 **提供商特定配置**。它们应作为 custom dump 之外的恢复层，并且必须用独立数据库做实际恢复演练。
+
+### 6.5 Cover、search、metadata repo 和音频
+
+下面的示例假定 workspace 使用 `type = "repo"`。若使用 remote metadata，`.anni/repo` 可以不存在：省略 repo 专用命令，保留 `.anni/config.toml`，并确保远端 Annim 数据库已进入同一灾备计划。先显式设置实际路径：
+
+```bash
+export COVER_ROOT=/srv/annim/covers
+export SEARCH_ROOT=/srv/annim/search
+export ANNI_WORKSPACE_ROOT=/srv/anni/workspace
+export ANNI_REPO_ROOT="$ANNI_WORKSPACE_ROOT/.anni/repo"
+export ANNI_OBJECTS_ROOT="$ANNI_WORKSPACE_ROOT/.anni/objects"
+export LIBRARY_ROOT=/srv/anni/library-main
+
+for source in "$COVER_ROOT" "$SEARCH_ROOT" "$ANNI_REPO_ROOT" "$ANNI_OBJECTS_ROOT" "$LIBRARY_ROOT"; do
+  test -d "$source"
+done
+test ! -e "$ANNI_REPO_ROOT/.repo_lock"
+```
+
+存在 `.repo_lock` 表示某个 owned repository manager 仍可能活动。不要删除 lock 来强行继续；先找到并停止持有者。
+
+每个 library root 都要单独列出和备份；不要只保留一个示例变量。使用全新的目标目录：
+
+```bash
+install -d -m 0700 -- \
+  "$BACKUP_ROOT/cover-assets" \
+  "$BACKUP_ROOT/search-index" \
+  "$BACKUP_ROOT/workspace-layout" \
+  "$BACKUP_ROOT/metadata-repo" \
+  "$BACKUP_ROOT/audio-objects" \
+  "$BACKUP_ROOT/library-main"
+
+rsync -aH --numeric-ids --exclude='/.incoming/' -- \
+  "$COVER_ROOT/" "$BACKUP_ROOT/cover-assets/"
+rsync -aH --numeric-ids -- "$SEARCH_ROOT/" "$BACKUP_ROOT/search-index/"
+rsync -aH --numeric-ids \
+  --exclude='/.anni/repo/' \
+  --exclude='/.anni/objects/' \
+  -- "$ANNI_WORKSPACE_ROOT/" "$BACKUP_ROOT/workspace-layout/"
+rsync -aH --numeric-ids -- "$ANNI_REPO_ROOT/" "$BACKUP_ROOT/metadata-repo/"
+rsync -aH --numeric-ids -- "$ANNI_OBJECTS_ROOT/" "$BACKUP_ROOT/audio-objects/"
+rsync -aH --numeric-ids -- "$LIBRARY_ROOT/" "$BACKUP_ROOT/library-main/"
+```
+
+这些命令没有删除或移动源文件。`-H` 只在目标中保留源树内部已有的硬链接关系，不会在生产与备份之间创建硬链接。若平台需要 ACL/xattr，请先在演练环境验证 rsync 版本，再加入 `-A`/`-X`；不要猜测不同平台的选项兼容性。
+
+如果原始 CD/CUE/WAV、抓轨日志和 Booklet 扫描位于 workspace 之外，为每个 source/evidence root 重复同样的只读复制。示例中的路径是部署方占位符：
+
+```bash
+export SOURCE_EVIDENCE_ROOT=/srv/anni/source-evidence
+test -d "$SOURCE_EVIDENCE_ROOT"
+install -d -m 0700 -- "$BACKUP_ROOT/source-evidence"
+rsync -aH --numeric-ids -- "$SOURCE_EVIDENCE_ROOT/" "$BACKUP_ROOT/source-evidence/"
+```
+
+`rsync -a` 会保留但不会跟随 evidence root 中的符号链接。若发现链接，单独登记其目标为新的只读 source root；不要用全局 `--copy-links` 让备份进程越过已审核边界。
+
+`workspace-layout` 保存 `.anni/config.toml`、用户区符号链接和尚未进入受控 objects 的普通文件，但排除已单独备份的 repo/objects。由于 config 可能含远程 token，这部分 generation 必须加密并限制访问。
+
+Workspace 的 `.album` 和 track 链接可能保存绝对目标。Rsync 会原样保存链接而不会跟随它们；这正是备份时需要的行为。恢复到不同根目录后必须先审计并在 **恢复副本内** 重建或 rebase 这些链接，不能让 drill 链接继续指向生产 objects。
+
+### 6.6 文件 hash manifest
+
+以下 Bash helper 只读取源文件，并把相对路径 SHA-256 写入备份 generation。大型音频库会消耗大量 I/O，应在停写窗口或存储只读快照上执行。
+
+```bash
+hash_tree() (
+  set -euo pipefail
+  root=$1
+  output=$2
+  cd -- "$root"
+  find . -type f -print0 \
+    | LC_ALL=C sort -z \
+    | while IFS= read -r -d '' path; do sha256sum -- "$path"; done \
+    > "$output"
+)
+
+# Cover backup deliberately excludes .incoming, so hash the completed target tree.
+hash_tree "$BACKUP_ROOT/cover-assets" "$BACKUP_ROOT/manifests/cover-tree.sha256"
+hash_tree "$BACKUP_ROOT/workspace-layout" "$BACKUP_ROOT/manifests/workspace-layout-tree.sha256"
+hash_tree "$ANNI_REPO_ROOT" "$BACKUP_ROOT/manifests/metadata-repo-tree.sha256"
+hash_tree "$ANNI_OBJECTS_ROOT" "$BACKUP_ROOT/manifests/audio-objects-tree.sha256"
+hash_tree "$LIBRARY_ROOT" "$BACKUP_ROOT/manifests/library-main-tree.sha256"
+if [[ -n ${SOURCE_EVIDENCE_ROOT:-} ]]; then
+  hash_tree "$SOURCE_EVIDENCE_ROOT" "$BACKUP_ROOT/manifests/source-evidence-tree.sha256"
+fi
+```
+
+然后在备份副本上验证：
+
+```bash
+(cd -- "$BACKUP_ROOT/cover-assets" && sha256sum --check "$BACKUP_ROOT/manifests/cover-tree.sha256")
+(cd -- "$BACKUP_ROOT/workspace-layout" && sha256sum --check "$BACKUP_ROOT/manifests/workspace-layout-tree.sha256")
+(cd -- "$BACKUP_ROOT/metadata-repo" && sha256sum --check "$BACKUP_ROOT/manifests/metadata-repo-tree.sha256")
+(cd -- "$BACKUP_ROOT/audio-objects" && sha256sum --check "$BACKUP_ROOT/manifests/audio-objects-tree.sha256")
+(cd -- "$BACKUP_ROOT/library-main" && sha256sum --check "$BACKUP_ROOT/manifests/library-main-tree.sha256")
+if [[ -n ${SOURCE_EVIDENCE_ROOT:-} ]]; then
+  (cd -- "$BACKUP_ROOT/source-evidence" && sha256sum --check "$BACKUP_ROOT/manifests/source-evidence-tree.sha256")
+fi
+```
+
+在 metadata repo 是 Git 仓库时，再记录：
+
+```bash
+git -C "$ANNI_REPO_ROOT" rev-parse HEAD > "$BACKUP_ROOT/manifests/metadata-repo-head.txt"
+git -C "$ANNI_REPO_ROOT" status --porcelain=v1 > "$BACKUP_ROOT/manifests/metadata-repo-status.txt"
+git -C "$ANNI_REPO_ROOT" fsck --full
+```
+
+`git fsck` 不验证未跟踪文件，因此 rsync generation 和文件 hash 仍是必须项。
+
+### 6.7 封存并恢复服务
+
+1. 把 generation manifest、dump digest 和备份执行日志写入不可变备份目录。
+2. 由 **提供商特定工具** 将 generation 复制到异地加密、不可变存储；检查 object count 和 retention lock。
+3. 先启动 Annim 并等待 ready，再启动 catalog/cover worker。
+4. 解除 API 维护模式。
+5. 记录实际停写时间和 generation ID。
+
+不得在异地复制成功之前删除本地 generation，也不得把“备份任务进程退出 0”当作恢复验证的替代品。
+
+## 7. 恢复到隔离环境
+
+所有恢复演练都应使用与生产网络隔离的新路径和新数据库。Catalog/cover worker 初始保持停止，防止演练环境发出外部请求或改变恢复数据。
+
+### 7.1 SQLite 恢复
+
+```bash
+set -euo pipefail
+umask 077
+
+export DRILL_ROOT=/srv/annim-drill/2026Q3
+export RESTORED_SQLITE="$DRILL_ROOT/database/annim.sqlite3"
+
+test ! -e "$DRILL_ROOT"
+install -d -m 0700 -- "$DRILL_ROOT/database"
+install -m 0600 -- "$BACKUP_ROOT/database/annim.sqlite3" "$RESTORED_SQLITE"
+
+sqlite3 -batch "$RESTORED_SQLITE" "PRAGMA integrity_check;"
+sqlite3 -batch "$RESTORED_SQLITE" "PRAGMA foreign_key_check;"
+```
+
+`integrity_check` 必须只输出 `ok`，foreign key check 必须无输出。演练 Annim URL 示例为：
+
+```text
+sqlite:///srv/annim-drill/2026Q3/database/annim.sqlite3?mode=rwc
+```
+
+不要让演练服务连接生产 SQLite 文件。
+
+### 7.2 PostgreSQL 恢复
+
+1. **[提供商特定]** 创建一个全新的空数据库和最小权限 restore role。
+2. 配置新的 `service=annim-restore`，确认它不能解析到生产数据库。
+3. 恢复 custom dump：
+
+```bash
+pg_restore \
+  --dbname="service=annim-restore" \
+  --no-owner \
+  --no-acl \
+  --single-transaction \
+  --exit-on-error \
+  "$BACKUP_ROOT/database/annim.dump"
+```
+
+目标数据库必须为空。不要对生产数据库使用 `--clean` 或 `--create`。大型数据库若因锁数量无法单事务恢复，可以在演练确认后去掉 `--single-transaction`，但必须保留 `--exit-on-error` 并在失败时丢弃整个目标数据库，而不是继续使用部分恢复结果。
+
+PostgreSQL 14+ 可在隔离库执行结构检查：
+
+```bash
+pg_amcheck --on-error-stop "service=annim-restore"
+```
+
+`pg_amcheck` 需要数据库具备 `amcheck` 支持和足够权限。命令刻意不使用会安装 extension 的 `--install-missing`；如需安装，只能由数据库管理员在可丢弃恢复库完成并记录。`pg_amcheck` 不能替代业务 row count 和文件引用检查。
+
+### 7.3 恢复文件数据
+
+把 cover、repo 和音频恢复到全新目录。Search index 是派生数据，演练默认创建空目录并在 Annim 启动后重建，不复制旧 index。以下仍以 repo metadata 模式为例；remote 模式省略 `.anni/repo` 的创建、复制、hash 和 lint。示例使用 rsync 从只读 generation 复制到新 drill root；仍然不使用 `--delete`：
+
+```bash
+install -d -m 0700 -- \
+  "$DRILL_ROOT/cover-assets" \
+  "$DRILL_ROOT/search-index" \
+  "$DRILL_ROOT/workspace" \
+  "$DRILL_ROOT/workspace/.anni/repo" \
+  "$DRILL_ROOT/workspace/.anni/objects" \
+  "$DRILL_ROOT/library-main"
+
+rsync -aH --numeric-ids -- "$BACKUP_ROOT/cover-assets/" "$DRILL_ROOT/cover-assets/"
+rsync -aH --numeric-ids -- "$BACKUP_ROOT/workspace-layout/" "$DRILL_ROOT/workspace/"
+rsync -aH --numeric-ids -- "$BACKUP_ROOT/metadata-repo/" "$DRILL_ROOT/workspace/.anni/repo/"
+rsync -aH --numeric-ids -- "$BACKUP_ROOT/audio-objects/" "$DRILL_ROOT/workspace/.anni/objects/"
+rsync -aH --numeric-ids -- "$BACKUP_ROOT/library-main/" "$DRILL_ROOT/library-main/"
+if [[ -d "$BACKUP_ROOT/source-evidence" ]]; then
+  install -d -m 0700 -- "$DRILL_ROOT/source-evidence"
+  rsync -aH --numeric-ids -- "$BACKUP_ROOT/source-evidence/" "$DRILL_ROOT/source-evidence/"
+fi
+```
+
+对恢复副本执行 hash，而不是对生产源执行任何修复：
+
+```bash
+(cd -- "$DRILL_ROOT/cover-assets" && sha256sum --check "$BACKUP_ROOT/manifests/cover-tree.sha256")
+(cd -- "$DRILL_ROOT/workspace" && sha256sum --check "$BACKUP_ROOT/manifests/workspace-layout-tree.sha256")
+(cd -- "$DRILL_ROOT/workspace/.anni/repo" && sha256sum --check "$BACKUP_ROOT/manifests/metadata-repo-tree.sha256")
+(cd -- "$DRILL_ROOT/workspace/.anni/objects" && sha256sum --check "$BACKUP_ROOT/manifests/audio-objects-tree.sha256")
+(cd -- "$DRILL_ROOT/library-main" && sha256sum --check "$BACKUP_ROOT/manifests/library-main-tree.sha256")
+if [[ -f "$BACKUP_ROOT/manifests/source-evidence-tree.sha256" ]]; then
+  (cd -- "$DRILL_ROOT/source-evidence" && sha256sum --check "$BACKUP_ROOT/manifests/source-evidence-tree.sha256")
+fi
+```
+
+对恢复的 FLAC 副本做流校验：
+
+```bash
+find "$DRILL_ROOT/workspace/.anni/objects" "$DRILL_ROOT/library-main" \
+  -type f -iname '*.flac' -print0 \
+  | xargs -0 --no-run-if-empty -n 1 flac --test --silent --
+```
+
+`flac --test` 只对 drill 副本运行。任一文件失败都应使 generation 标记为不可用于无损恢复，并触发上一个 generation 的复验。
+
+在运行任何 workspace 命令前，先确认恢复的符号链接没有逃出 drill root。以下是 GNU `readlink` 示例；若发现逃逸，停止并用部署方审核过的 rebase 工具只修改恢复副本：
+
+```bash
+while IFS= read -r -d '' link; do
+  resolved=$(readlink -f -- "$link")
+  case "$resolved" in
+    "$DRILL_ROOT/workspace/"*) ;;
+    *) printf 'link escapes drill root: %s -> %s\n' "$link" "$resolved" >&2; exit 1 ;;
+  esac
+done < <(find "$DRILL_ROOT/workspace" -type l -print0)
+```
+
+该检查本身只读。本文不提供生产链接的批量重写命令，因为错误前缀替换可能把链接指向生产或错误专辑；rebase 必须由部署方在隔离副本演练并双人复核。
+
+### 7.4 数据库与 cover 文件交叉校验
+
+SQLite 恢复库可导出所有数据库引用的 cover identity：
+
+```bash
+sqlite3 -batch -noheader -separator '|' "$RESTORED_SQLITE" \
+  "SELECT lower(hex(content_sha256)), storage_key, byte_length, media_type
+   FROM cover_asset ORDER BY storage_key;" \
+  > "$DRILL_ROOT/cover-db-assets.tsv"
+```
+
+PostgreSQL 使用等价查询：
+
+```bash
+psql --dbname="service=annim-restore" --tuples-only --no-align \
+  --field-separator='|' --set=ON_ERROR_STOP=1 \
+  --command="SELECT encode(content_sha256, 'hex'), storage_key, byte_length, media_type
+             FROM cover_asset ORDER BY storage_key;" \
+  > "$DRILL_ROOT/cover-db-assets.tsv"
+```
+
+对两种数据库都执行同一文件检查：
+
+```bash
+while IFS='|' read -r expected_digest storage_key expected_bytes media_type; do
+  [[ $storage_key =~ ^sha256/[0-9a-f]{2}/[0-9a-f]{2}/[0-9a-f]{64}\.(jpg|png|webp)$ ]]
+  case "$media_type" in
+    image/jpeg) expected_extension=jpg ;;
+    image/png) expected_extension=png ;;
+    image/webp) expected_extension=webp ;;
+    *) printf 'unexpected cover media type: %s\n' "$media_type" >&2; exit 1 ;;
+  esac
+  expected_key="sha256/${expected_digest:0:2}/${expected_digest:2:2}/$expected_digest.$expected_extension"
+  [[ $storage_key == "$expected_key" ]]
+
+  file="$DRILL_ROOT/cover-assets/$storage_key"
+  [[ -f $file && ! -L $file ]]
+  actual_bytes=$(wc -c < "$file")
+  [[ $actual_bytes -eq $expected_bytes ]]
+  actual_digest=$(sha256sum -- "$file")
+  [[ ${actual_digest%% *} == "$expected_digest" ]]
+done < "$DRILL_ROOT/cover-db-assets.tsv"
+```
+
+该检查证明每个数据库引用的 key 具有正确 fan-out 形式，文件名 digest、实际字节数和实际 SHA-256 均与数据库一致。文件树 manifest 还会发现数据库未引用但 generation 中存在的额外文件。
+
+### 7.5 元数据和业务校验
+
+1. 在 repo metadata 模式下，对可丢弃的恢复 repo 运行内容 lint：
+
+   ```bash
+   anni repo --root "$DRILL_ROOT/workspace/.anni/repo" lint
+   ```
+
+   `repo lint` 会在恢复 repo 内短暂创建并删除 `.repo_lock`。因此只对可丢弃的恢复副本运行，不对不可变 generation 或生产 metadata repo 运行。
+
+2. 对恢复 workspace 运行只读状态扫描：
+
+   ```bash
+   cd -- "$DRILL_ROOT/workspace"
+   anni workspace status --json
+   ```
+
+   不要添加 `fsck --gc` 或 `fsck --fix-dangling`。
+
+3. 在恢复数据库重新生成第 6 节的 row count，并与 `database-row-counts.csv` 比较。
+4. 检查 queued/running ingest、catalog sync 和 cover candidate 的数量；恢复后先由人工决定是否重新启动 worker。
+5. 若生产使用外部 ingest coordinator，从恢复 artifact store 重新计算 manifest/plan/receipt digest，并与 `ingest_job` 中的 digest 对比。正文缺失时只能审计状态，不能声称可重放该 job。
+6. 使用专用 drill token、`ANNIM_BIND_ADDR=127.0.0.1:18000`、空 Origin allowlist、空的 drill search directory 和关闭的 GraphiQL 启动 Annim。
+7. 确认 live/ready 和一个带 Bearer 的只读 GraphQL 请求成功。
+8. 使用权限为 `0600` 的 curl config 提供 `Authorization: Bearer ...` header，在 drill 实例重建搜索索引：
+
+   ```bash
+   set -o pipefail
+   curl --fail-with-body --silent --show-error \
+     --config /run/secrets/annim-drill-curl.conf \
+     --header 'Content-Type: application/json' \
+     --data '{"query":"mutation { rebuildSearchIndex }"}' \
+     http://127.0.0.1:18000/ \
+     | jq --exit-status '.errors == null and .data.rebuildSearchIndex == true'
+   ```
+
+9. 抽样打开艺人 collection、metadata revision、catalog observation 和已选 cover，确认 Unicode 原文与证据链可读。
+
+Annim 和 catalog worker 启动会执行 migration。若需要保留一份完全未改变的取证副本，应先复制恢复数据库，再在可丢弃副本上做启动验证。
+
+### 7.6 演练通过条件
+
+以下条件必须全部满足：
+
+- 数据库结构检查、foreign key 检查和 row count 对比通过；
+- 数据库 dump、cover、repo 和音频 hash 全部通过；
+- 已部署的 ingest artifact store 完整，正文 digest 与 Annim job 引用一致；未部署 artifact store 时明确记录“历史 job 不可重放”；
+- 恢复 FLAC 的流校验通过；
+- metadata repo lint 通过或所有既有告警已被记录并与生产基线一致；
+- Annim ready、认证、关键只读查询通过；
+- 实际恢复耗时不超过 RTO；恢复点不早于 RPO；
+- 演练过程中没有连接生产数据库、写入生产目录或发出 catalog/cover worker 外部任务；
+- 结果、失败项和改进负责人已记录。
+
+## 8. 生产恢复和回滚
+
+### 8.1 切换前
+
+1. 宣布事故窗口，冻结所有 writer。
+2. 对故障现场做只读快照，保留取证和回滚能力。
+3. 选择最近一个已通过恢复演练或完整校验的 generation。
+4. 在新的数据库和文件 root 完成第 7 节全部检查。
+5. 保存旧配置、旧数据库 endpoint、旧 cover/search/audio mount ID。
+
+### 8.2 切换
+
+1. 先切数据库、cover root、search root 和 workspace/library mount 的配置或挂载引用，不覆盖旧路径。
+2. 从 secret manager 重新物化 Annim token、数据库凭据和 catalog secret root。Catalog secret 必须是权限受控的普通文件，路径中不得含符号链接；不要从普通数据 generation 恢复明文 token。
+3. 只启动 Annim，等待 ready 并做只读查询。
+4. 小范围恢复写流量，观察数据库错误、磁盘和认证失败。
+5. 人工检查队列后再启动 catalog worker 和 cover worker。
+6. 最后解除维护模式。
+
+### 8.3 回滚触发条件
+
+出现任一情况立即回滚：
+
+- ready 持续失败；
+- 数据库 row count 或 foreign key 不一致；
+- cover reference hash 失败；
+- 元数据关键查询出现损坏或大量缺失；
+- 恢复音频 hash/FLAC 测试失败；
+- worker 重复产生不可解释的失败或队列状态跳变。
+
+### 8.4 回滚动作
+
+1. 再次阻断写流量并停止 worker、Annim。
+2. 保存失败恢复环境的只读 snapshot，不在其中做就地修补。
+3. 把配置和挂载引用切回切换前保存的数据库和文件 root。
+4. 先启动 Annim 并只读验证，再决定是否启动 worker。
+5. 记录恢复窗口内是否已经接受新写入。若有，不要自动双向合并；由数据负责人基于 revision/manifest 做人工补录或重新 ingest。
+
+旧生产路径至少保留到新环境超过观察期并完成一次新 generation + restore drill。清理旧路径属于独立、需人工审批的变更，不是恢复流程的一部分。
+
+旧版本二进制不一定理解新 migration 后的 schema。应用版本回滚前必须在恢复副本验证兼容性；不能把旧二进制直接指向已升级的生产数据库。必要时切回升级前的数据库 generation，并明确处理升级后新增写入。
+
+## 9. 监控和告警
+
+当前实现没有完整 metrics endpoint。生产监控应先组合 supervisor、HTTP probe、结构化日志、数据库只读查询和备份平台指标；不要在文档中假设尚不存在的 Prometheus 指标。
+
+表中的 ingest queue 指 Annim 持久化的 job 状态和部署方外部协调器，不代表仓库当前已有可监控的 ingest daemon。
+
+### 9.1 初始告警基线
+
+| 信号 | 建议初始告警 |
+| --- | --- |
+| `/health/live` | 连续 2 次失败或 1 分钟不可达 |
+| `/health/ready` | 连续 2 次非 2xx；优先检查数据库 |
+| 进程 | Annim、catalog worker、cover worker 意外退出或频繁重启 |
+| Catalog queue | `running` 的 lease 过期后仍持续超过两个 poll 周期；可执行 run 长时间无成功 |
+| Cover queue | `fetching` lease 过期后仍持续；queued age 超过业务 SLA；rejected/retry 比例突增 |
+| Ingest queue | 状态长时间无变化；计划/manifest 冲突持续出现 |
+| 日志 | `catalog worker cycle failed`、cover worker cycle failure、数据库迁移失败、digest collision |
+| 存储 | DB/search/cover/audio 任一卷可用空间低于 20%，或按增长速度不足 7 天 |
+| 备份 | 最新成功 generation 超过目标间隔的 2 倍；异地复制、object lock 或 checksum 失败 |
+| 恢复演练 | 超过计划周期未完成，或最近一次未满足 RPO/RTO |
+| Secret | Apple developer token 或数据库凭据将在 7 天内过期 |
+| 安全 | 401/403 突增、Origin 配置漂移、GraphiQL 在生产被启用、服务直接暴露明文 HTTP |
+
+阈值需要在获得真实吞吐和运行时间分布后调整，但 checksum、数据库完整性、备份不可变性和磁盘耗尽类告警应始终为高优先级。
+
+### 9.2 只读队列检查
+
+以下 SQL 不包含 secret，可用于 dashboard 或人工检查：
+
+```sql
+SELECT status, COUNT(*)
+FROM catalog_sync_run
+GROUP BY status
+ORDER BY status;
+
+SELECT run_id, status, lease_expires_at, next_attempt_at, attempt_count
+FROM catalog_sync_run
+WHERE status IN ('queued', 'running')
+ORDER BY created_at
+LIMIT 50;
+
+SELECT state, COUNT(*)
+FROM cover_candidate
+GROUP BY state
+ORDER BY state;
+
+SELECT candidate_id, state, lease_expires_at, next_attempt_at, attempt_count,
+       last_error_code
+FROM cover_candidate
+WHERE state IN ('queued', 'fetching')
+ORDER BY updated_at
+LIMIT 50;
+```
+
+比较 lease 时使用数据库服务器时间，避免监控主机时钟漂移。不得把 `submitted_url`、`effective_url`、catalog locator、configuration document、secret reference 或数据库 URL 采集到普通监控标签。
+
+## 10. 事故值班清单
+
+### 服务不可用
+
+1. 看 live，再看 ready。
+2. 若 live 失败，检查 Annim 进程和监听地址；若 ready 失败，先检查数据库连通性和 migration。
+3. 检查磁盘空间和 inode，尤其是 DB、search 和 cover root。
+4. 保持 worker 停止，直到 Annim 和数据库稳定。
+5. 不通过删除 search、cover 或音频文件来“释放空间”；先扩容或切只读。
+
+### 数据或文件疑似损坏
+
+1. 立即冻结 writer，不做就地修复。
+2. 对故障现场做只读 snapshot。
+3. 从最近 generation 在隔离环境执行完整 restore drill。
+4. 通过 hash、DB integrity 和 row count 决定恢复点。
+5. 按第 8 节切换，保留故障现场。
+
+### Backup job 失败
+
+1. 不删除上一个成功 generation。
+2. 确认失败命令没有对任何源 audio root 获得写权限。
+3. 重新创建新的 generation ID，不复用半成品目录。
+4. 在恢复 RPO 前暂停会删除唯一上游副本的 ingest 清理操作。
+5. 修复后执行实际 restore，而不仅是重新跑 backup。
+
+## 11. 外部工具依据
+
+- SQLite `.backup` 使用官方 online backup 机制生成一致快照：[SQLite Backup API](https://www.sqlite.org/backup.html)、[SQLite CLI `.backup`](https://www.sqlite.org/cli.html)
+- PostgreSQL custom dump 和 restore：[PostgreSQL `pg_dump`](https://www.postgresql.org/docs/current/app-pgdump.html)、[PostgreSQL `pg_restore`](https://www.postgresql.org/docs/current/app-pgrestore.html)
+- PostgreSQL 14+ 物理结构检查：[PostgreSQL `pg_amcheck`](https://www.postgresql.org/docs/current/app-pgamcheck.html)
+- FLAC `--test` 会解码校验流和已保存的 MD5，但不写出音频：[Xiph FLAC command-line tool](https://xiph.org/flac/documentation_tools_flac.html)
+
+外部工具版本必须与生产数据库版本兼容。每次数据库大版本升级、存储平台迁移、路径变更或 backup agent 变更后，都要重新执行完整恢复演练。