feat(database): shape the library like files, and shrink the catalog

Plans 013 and 014, the album page that prompted them, and the smaller
fixes they turned up. Changelog, largest first.

## The local library is shaped like files, not like MusicBrainz

`audio_files` carries its own tags and points at `albums` and
`artists`; `file_genres` is the one real many-to-many. `recordings`,
`release_group_recordings`, `artist_credit`, `artist_credit_artist`,
`recording_genres`, `release_groups` and `release_to_rg` are gone from
the local side, and with them a six-way join in every read, a
`MIN(release_group_id)` subquery in eleven queries and a
first-credited-artist subquery in nine. Measured on a real 25,966-file
library, every many-to-many that model expressed was 1:1 in the data.

- Ownership is a file. `GetFilePathsByRecordingMBIDs`,
  `LibraryMBIDIndex.CheckMBIDs`, `collectLibraryEntities` and
  `pruneStaleLocalCrossReferences` all join `audio_files`, so the 812
  orphaned recordings, 216 release groups and 260 artists that library
  carried are now structurally impossible.
- One projection: every track query selects from the `track_metadata`
  view, one row type, one mapper. Nine hand-rolled copies had drifted
  far enough to report different years on different screens.
- `library_id = 0` means every library, so each list query exists once
  instead of scoped and unscoped with a branch at every call site.
- No migration chain. `sql/schemas/` is the one description of the
  shape; `sql/migrations/`, `applyMigrations` and `schema_migrations`
  are squashed away, along with the drift between them that had sqlc
  generating against a stale schema.
- `database.InsertTestTrack` is the one test seeder; twenty test files
  had been assembling the old FK chain each in its own order.

## The catalog stores its ids as bytes

`explore_index`'s three 36-char MBID columns and its entity-type text
are 16 raw bytes and a small integer. The table and its six indexes go
780 MB to 405 MB on a real 2,052,200-row catalog, which is why a fresh
install is ~0.6 GB rather than ~1.0 GB.

- `backend/explore/mbid.go` is the only place the encoding is known;
  everything above it speaks dashed strings.
- `CHECK(length(mbid) = 16)` makes a stringly write fail at the insert
  rather than silently returning no rows, since SQLite does not coerce
  between TEXT and BLOB.
- The importer asks the artifact what encoding it carries and converts
  on the way in, so the artifact already published keeps working and no
  format bump is needed.
- `indexRowColumns`/`scanIndexRow` replace four copies of a 22-column
  list, and `TestStoredEncodingRoundTrips` sweeps every read path.

## An album page that says how much of the album is yours

- One question, asked once: is there a file. `filePaths` is filled by a
  single batched lookup when the tracklist settles, and the badge, the
  Play count, the dimmed rows and every menu item read it — replacing
  four claims of decreasing confidence that could show a green tick on
  an album whose every action did nothing.
- Play, Play 7 of 12, or no play button at all.
- `total_tracks` on `explore_index` (~2 bytes over 400,677 release
  groups) and on `audio_files` from tags that have always carried it:
  a complete MBID-matched album now makes no catalog call at all, where
  it used to spend the most expensive request the app makes.
- A merged cluster shows the running order the most releases agree on,
  and the version list marks the release you own rather than standing a
  synthetic entry in for it.
- `AlbumReleasesFailed`: a slow fetch is no longer reported as a failed
  one by a 12-second timer.
- Rows not in the library are dimmed in place (with `aria-disabled`)
  instead of the owned ones wearing a green tick and a legend.

## Caches and cover art get ceilings

- Only the three tiers of a cover are stored; the full-resolution copy
  nothing rendered was 1,134 MB of a 1.4 GB covers directory.
- One artist portrait is downloaded and the rest are remembered as
  URLs — 4.1 GB of a 5.3 GB cache was candidates no code path reads.
- `browsedArtBudget` and `httpCacheBudget` bound what an age cannot:
  the same install held art for 5,770 artists in a 1,301-artist
  library.
- `OrphanedArtistImagesJob` joined a bare MBID onto a sharded
  directory, so it deleted the rows that were the only record of the
  files it left behind. `explore.ArtistImageDir` is that layout's one
  definition now.

## The autotag queue asks whether there is work

`tagging_items` was a row per album folder, not a queue, and no query
read the `tag_status` column that held the answer. The four queue
queries ask the files, which matters most where it is least visible:
`startPrefetch` was scoring every album in a tagged library against
MusicBrainz.

## Phantom playlist tracks resolve in place

An M3U8 imported before its files leaves phantom rows; they now match
by path and fall back to position, keep their place in the playlist
when resolved, and pair best-first so two phantoms cannot claim the
same file.

## Playing a track plays the list it is in

Double-click, and Play on a single row's menu, queue the list as
displayed with `startIndex` on that row — the album page and the track
list used to queue one track and discard the album around it. A
multi-row selection still plays exactly itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfVYUVExXsx1nSWrXN8mAh

backend/maintenance/maintenance_test.go

@@ -3,6 +3,7 @@ package maintenance
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -319,12 +320,14 @@ func TestOrphanedArtistImagesJob(t *testing.T) {
 		}
 	}
 
-	// The owned artist is in the library.
-	if _, err := db.ExecContext(
-		`INSERT INTO artists (name, mbid) VALUES ('Owned', ?)`, ownedMBID,
-	); err != nil {
-		t.Fatalf("seed artists: %v", err)
-	}
+	// The owned artist is in the library - which means a *file* says
+	// so.  An artists row on its own is the phantom the file-shaped
+	// schema removed, and it is not ownership.
+	database.InsertTestTrack(t, db, database.TestTrack{
+		FilePath:   "/music/owned.mp3",
+		Artist:     "Owned",
+		ArtistMBID: ownedMBID,
+	})
 
 	old := time.Now().Add(-200 * 24 * time.Hour)
 
@@ -521,3 +524,145 @@ func TestStrayArtistImageFilesJobRefusesEmptyKeepSet(t *testing.T) {
 		t.Error("an empty keep set emptied the directory")
 	}
 }
+
+// TestOrphanedArtistImagesJob_EvictsOverBudget pins the ceiling.
+//
+// Age alone bounds nothing: a browsing session fetches portraits for
+// hundreds of artists in an afternoon and every one of them is inside
+// the retention window. A real install held art for 5,770 artists in a
+// 1,301-artist library. Art for an artist the user owns is outside the
+// budget and must survive an eviction that takes everything else.
+func TestOrphanedArtistImagesJob_EvictsOverBudget(t *testing.T) {
+	t.Parallel()
+
+	db := database.NewTestDB(t)
+	dir := t.TempDir()
+
+	const ownedMBID = "aaaaaaaa-0000-0000-0000-000000000000"
+
+	database.InsertTestTrack(t, db, database.TestTrack{
+		FilePath:   "/music/owned.mp3",
+		Artist:     "Owned",
+		ArtistMBID: ownedMBID,
+	})
+
+	// Each artist's art is a quarter of the budget, so four browsed
+	// artists sit exactly on it and the fifth pushes it over.
+	blob := make([]byte, browsedArtBudget/4)
+
+	seed := func(mbid string, created time.Time) {
+		t.Helper()
+
+		artistDir := explore.ArtistImageDir(dir, mbid)
+		if err := os.MkdirAll(artistDir, 0o755); err != nil {
+			t.Fatalf("mkdir %s: %v", mbid, err)
+		}
+
+		if err := os.WriteFile(
+			filepath.Join(artistDir, "primary.jpg"), blob, 0o600,
+		); err != nil {
+			t.Fatalf("write image: %v", err)
+		}
+
+		if _, err := db.ExecContext(
+			`INSERT INTO artist_images
+			   (artist_mbid, source, source_url, file_path, created_at)
+			 VALUES (?, 'test', 'http://x', ?, ?)`,
+			mbid, filepath.Join(artistDir, "primary.jpg"), created,
+		); err != nil {
+			t.Fatalf("seed artist_images for %s: %v", mbid, err)
+		}
+	}
+
+	// All inside the retention window, so only the budget can evict.
+	now := time.Now()
+	seed(ownedMBID, now)
+
+	browsed := []string{
+		"bbbbbbbb-0000-0000-0000-000000000000",
+		"cccccccc-0000-0000-0000-000000000000",
+		"dddddddd-0000-0000-0000-000000000000",
+		"eeeeeeee-0000-0000-0000-000000000000",
+		"ffffffff-0000-0000-0000-000000000000",
+	}
+
+	for i, mbid := range browsed {
+		seed(mbid, now.Add(-time.Duration(len(browsed)-i)*time.Hour))
+	}
+
+	result, err := OrphanedArtistImagesJob(db, dir, explore.ArtistImageDir).
+		Run(context.Background())
+	if err != nil {
+		t.Fatalf("run job: %v", err)
+	}
+
+	if result.FilesDeleted == 0 {
+		t.Error("nothing was evicted despite being over budget")
+	}
+
+	// The oldest browsed artist goes first.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, browsed[0])); !os.IsNotExist(err) {
+		t.Error("the least recently fetched art survived the budget pass")
+	}
+
+	// The owned artist is never in the budget.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, ownedMBID)); err != nil {
+		t.Error("artwork for a library artist was evicted by the budget pass")
+	}
+
+	// And the newest browsed art survives, because eviction stops as
+	// soon as the rest fits.
+	if _, err := os.Stat(explore.ArtistImageDir(dir, browsed[len(browsed)-1])); err != nil {
+		t.Error("eviction did not stop once under budget")
+	}
+}
+
+// TestExpiredHTTPCacheJob_TrimsToBudget pins the ceiling that makes a
+// year-long entity TTL safe: once answers stop expiring, expiry stops
+// being a bound and something else has to be.
+func TestExpiredHTTPCacheJob_TrimsToBudget(t *testing.T) {
+	t.Parallel()
+
+	db := database.NewTestDB(t)
+
+	// Six rows of a third of the budget each: two fit, the rest go.
+	blob := make([]byte, httpCacheBudget/3)
+
+	for i := range 6 {
+		if _, err := db.ExecContext(
+			`INSERT INTO http_cache (url_key, response, expires_at)
+			 VALUES (?, ?, ?)`,
+			fmt.Sprintf("key-%d", i), blob,
+			time.Now().Add(time.Duration(i+1)*24*time.Hour),
+		); err != nil {
+			t.Fatalf("seed http_cache: %v", err)
+		}
+	}
+
+	if _, err := ExpiredHTTPCacheJob(db).Run(context.Background()); err != nil {
+		t.Fatalf("run job: %v", err)
+	}
+
+	var total int64
+	if err := db.QueryRowWriter(
+		"SELECT COALESCE(SUM(LENGTH(response)), 0) FROM http_cache",
+	).Scan(&total); err != nil {
+		t.Fatalf("measure http_cache: %v", err)
+	}
+
+	if total > httpCacheBudget {
+		t.Errorf("http_cache is %d bytes, over the %d budget", total, httpCacheBudget)
+	}
+
+	// The longest-lived answers are the ones kept.
+	var kept string
+	if err := db.QueryRowWriter(
+		"SELECT url_key FROM http_cache ORDER BY expires_at DESC LIMIT 1",
+	).Scan(&kept); err != nil {
+		t.Fatalf("read surviving row: %v", err)
+	}
+
+	if kept != "key-5" {
+		t.Errorf("kept %q, want the longest-lived row", kept)
+	}
+}

backend/maintenance/sweeps.go

@@ -18,9 +18,20 @@ const (
 	// survives after it was fetched.
 	browsedArtRetention = 90 * 24 * time.Hour
 
+	// browsedArtBudget bounds what browsing costs on disk.  Age alone
+	// is not a ceiling: a real install had portraits for 5,770 artists
+	// in a 1,301-artist library - 1.2 GB - because every artist page
+	// opened in Explore fetches one and nothing was counting.  Art for
+	// artists the user owns is not in this budget and is never evicted.
+	browsedArtBudget = 256 << 20 // 256 MB
+
 	// proxyCacheRetention is how long an Explore cover-art thumbnail
 	// survives after it was last written.
 	proxyCacheRetention = 30 * 24 * time.Hour
+
+	// httpCacheBudget bounds the response cache.  Entity answers are
+	// kept for a year, so expiry no longer bounds anything.
+	httpCacheBudget = 128 << 20 // 128 MB
 )
 
 // Default intervals.  These are minimums, not schedules — the runner
@@ -30,11 +41,18 @@ const (
 	dailyInterval    = 24 * time.Hour
 )
 
-// ExpiredHTTPCacheJob deletes HTTP cache rows past their TTL.
+// ExpiredHTTPCacheJob deletes HTTP cache rows past their TTL, then
+// enforces a size ceiling on what is left.
 //
 // Reads already filter on expires_at, so expired rows are inert — but
 // nothing was deleting them, so the table grew without bound for the
 // life of the install.
+//
+// The ceiling is the other half, and it is what makes a long TTL safe:
+// MusicBrainz entity data is cached for a year now, because it does not
+// change and re-fetching it spends someone else's rate limit for
+// nothing. Expiry therefore stops being a bound, and something has to
+// be.
 func ExpiredHTTPCacheJob(db *database.DB) Job {
 	return Job{
 		Name:        "http-cache-evict",
@@ -51,11 +69,56 @@ func ExpiredHTTPCacheJob(db *database.DB) Job {
 
 			rows, _ := res.RowsAffected()
 
-			return Result{RowsDeleted: rows}, nil
+			trimmed, err := trimHTTPCache(db)
+			if err != nil {
+				return Result{RowsDeleted: rows}, err
+			}
+
+			return Result{RowsDeleted: rows + trimmed}, nil
 		},
 	}
 }
 
+// trimHTTPCache evicts the oldest responses until the cache fits
+// httpCacheBudget, and returns how many rows it removed.
+//
+// "Oldest" is by expiry, which orders by fetch time within a TTL class
+// and puts the shortest-lived answers first across classes — a search
+// result before an entity lookup, which is the right order to lose them
+// in.
+func trimHTTPCache(db *database.DB) (int64, error) {
+	var total int64
+
+	if err := db.QueryRowWriter(
+		"SELECT COALESCE(SUM(LENGTH(response)), 0) FROM http_cache",
+	).Scan(&total); err != nil {
+		return 0, fmt.Errorf("measure http_cache: %w", err)
+	}
+
+	if total <= httpCacheBudget {
+		return 0, nil
+	}
+
+	res, err := db.ExecContext(`
+		DELETE FROM http_cache WHERE url_key IN (
+			SELECT url_key FROM (
+				SELECT url_key,
+				       SUM(LENGTH(response)) OVER (
+				           ORDER BY expires_at DESC
+				           ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
+				       ) AS running
+				FROM http_cache
+			) WHERE running > ?
+		)`, httpCacheBudget)
+	if err != nil {
+		return 0, fmt.Errorf("trim http_cache: %w", err)
+	}
+
+	rows, _ := res.RowsAffected()
+
+	return rows, nil
+}
+
 // OrphanedCoverFilesJob removes files from the covers directory that no
 // cover_art row references.
 //
@@ -196,11 +259,86 @@ func OrphanedArtistImagesJob(
 				result.RowsDeleted += rows
 			}
 
+			// Then the ceiling.  Age alone bounds nothing: a browsing
+			// session can fetch hundreds of portraits in an afternoon,
+			// and all of them are within the retention window.
+			evicted, err := evictOverBudget(ctx, db, artistImagesDir, dirFor, &result)
+			if err != nil {
+				return result, err
+			}
+
+			if len(evicted) > 0 {
+				rows, delErr := deleteArtistImageRows(db, evicted)
+				if delErr != nil {
+					return result, delErr
+				}
+
+				result.RowsDeleted += rows
+			}
+
 			return result, nil
 		},
 	}
 }
 
+// evictOverBudget removes the least recently fetched non-library artist
+// art until what is left fits browsedArtBudget, and returns the MBIDs it
+// removed so their rows can go too.
+func evictOverBudget(
+	ctx context.Context,
+	db *database.DB,
+	artistImagesDir string,
+	dirFor func(baseDir, mbid string) string,
+	result *Result,
+) ([]string, error) {
+	browsed, err := browsedArtistsByAge(db)
+	if err != nil {
+		return nil, err
+	}
+
+	sizes := make([]int64, len(browsed))
+
+	var total int64
+
+	for i, mbid := range browsed {
+		bytes, _ := dirSize(dirFor(artistImagesDir, mbid))
+		sizes[i] = bytes
+		total += bytes
+	}
+
+	if total <= browsedArtBudget {
+		return nil, nil
+	}
+
+	var evicted []string
+
+	// browsed is oldest first, so this drops the least recently wanted.
+	for i, mbid := range browsed {
+		if total <= browsedArtBudget {
+			break
+		}
+
+		if ctx.Err() != nil {
+			return evicted, nil
+		}
+
+		dir := dirFor(artistImagesDir, mbid)
+
+		bytes, files := dirSize(dir)
+		if err := os.RemoveAll(dir); err != nil && !os.IsNotExist(err) {
+			continue
+		}
+
+		total -= sizes[i]
+		result.FilesDeleted += files
+		result.BytesFreed += bytes
+
+		evicted = append(evicted, mbid)
+	}
+
+	return evicted, nil
+}
+
 // StrayArtistImageFilesJob removes downloaded image candidates that
 // were never the artist's portrait.
 //
@@ -279,6 +417,56 @@ func StrayArtistImageFilesJob(artistImagesDir string, keep map[string]bool) Job
 
 // staleArtistMBIDs returns artist MBIDs whose cached artwork may be
 // evicted: fetched before the cutoff and not an artist in the library.
+// ownedArtistMBIDs is the ownership test, asked the way every other one
+// is: an artist is the user's if a *file* says so.  An artists row on
+// its own is not ownership - that was the bug the file-shaped schema
+// removed, and this is the same rule one table over.
+const ownedArtistMBIDs = `
+	SELECT a.mbid FROM artists a
+	WHERE a.mbid IS NOT NULL AND a.mbid != ''
+	  AND (
+	    EXISTS (SELECT 1 FROM audio_files af WHERE af.artist_id = a.id)
+	    OR EXISTS (
+	      SELECT 1 FROM albums al
+	      JOIN audio_files af2 ON af2.album_id = al.id
+	      WHERE al.artist_id = a.id
+	    )
+	  )`
+
+// browsedArtistsByAge lists non-library artists with cached art, oldest
+// first, so the budget pass evicts the least recently wanted.
+func browsedArtistsByAge(db *database.DB) ([]string, error) {
+	rows, err := db.QueryContext(
+		`SELECT artist_mbid FROM artist_images
+		 WHERE artist_mbid NOT IN (` + ownedArtistMBIDs + `)
+		 GROUP BY artist_mbid
+		 ORDER BY MAX(created_at) ASC`,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("query browsed artist images: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var mbids []string
+
+	for rows.Next() {
+		var mbid string
+
+		if err := rows.Scan(&mbid); err != nil {
+			return nil, fmt.Errorf("scan artist mbid: %w", err)
+		}
+
+		mbids = append(mbids, mbid)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate browsed artist images: %w", err)
+	}
+
+	return mbids, nil
+}
+
 func staleArtistMBIDs(
 	db *database.DB,
 	cutoff time.Time,
@@ -286,10 +474,7 @@ func staleArtistMBIDs(
 	rows, err := db.QueryContext(
 		`SELECT DISTINCT artist_mbid FROM artist_images
 		 WHERE created_at < ?
-		   AND artist_mbid NOT IN (
-		       SELECT mbid FROM artists
-		       WHERE mbid IS NOT NULL AND mbid != ''
-		   )`,
+		   AND artist_mbid NOT IN (`+ownedArtistMBIDs+`)`,
 		cutoff,
 	)
 	if err != nil {