// ==UserScript==
// @name         Platform Check
// @namespace    http://tampermonkey.net/
// @version      2026.10.3
// @description  Find a MusicBrainz release on online platforms like Spotify, Discogs, Bandcamp, HDtracks etc.. Uses existing URL relationships when present, otherwise searches for release online using several methods.
// @author       majkinetor
// @icon         data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxMjggMTI4IiB3aWR0aD0iMTI4IiBoZWlnaHQ9IjEyOCI+DQogIDx0aXRsZT5NQiBQbGF0Zm9ybSBDaGVjazwvdGl0bGU+CiAgDQogIDxnIGZpbGw9Im5vbmUiIHN0cm9rZT0iIzJhMWE1MiIgc3Ryb2tlLXdpZHRoPSI5IiBzdHJva2UtbGluZWNhcD0icm91bmQiPg0KICAgIDxwYXRoIGQ9Ik00MCA4OCBBMzQgMzQgMCAwIDEgNDAgNDAiLz4NCiAgICA8cGF0aCBkPSJNMjkgOTkgQTUwIDUwIDAgMCAxIDI5IDI5Ii8+DQogICAgPHBhdGggZD0iTTg4IDg4IEEzNCAzNCAwIDAgMCA4OCA0MCIvPg0KICAgIDxwYXRoIGQ9Ik05OSA5OSBBNTAgNTAgMCAwIDAgOTkgMjkiLz4NCiAgPC9nPg0KICA8Y2lyY2xlIGN4PSI2NCIgY3k9IjY0IiByPSIyMCIgZmlsbD0iI2U4MjAxYSIvPg0KPC9zdmc+DQo=
// @homepageURL  https://github.com/majkinetor/musicbrainz-userscripts/blob/main/userscripts/platform_check/README.md
// @match        https://*.musicbrainz.org/release/*
// @match        https://*.musicbrainz.org/release-group/*
// @grant        GM_xmlhttpRequest
// @grant        GM_setValue
// @grant        GM_getValue
// @grant        GM_deleteValue
// @grant        GM_openInTab
// @grant        unsafeWindow
// @connect      musicbrainz.org
// @connect      beta.musicbrainz.org
// @connect      query.wikidata.org
// @connect      search.brave.com
// @connect      html.duckduckgo.com
// @connect      duckduckgo.com
// @connect      api.discogs.com
// @connect      www.discogs.com
// @connect      open.spotify.com
// @connect      bandcamp.com
// @connect      soundcloud.com
// @connect      api-v2.soundcloud.com
// @connect      a-v2.sndcdn.com
// @connect      api.audiomack.com
// @connect      api.deezer.com
// @connect      itunes.apple.com
// @connect      music.apple.com
// @connect      amp-api.music.apple.com
// @connect      openapi.tidal.com
// @connect      auth.tidal.com
// @connect      volumo.com
// @connect      www.qobuz.com
// @connect      qobuz.com
// @connect      hdtracks.azurewebsites.net
// @connect      music.youtube.com
// @connect      music.amazon.com
// @connect      na.mesk.skill.music.a2z.com
// @connect      api.beatport.com
// @connect      tools.wallstream.com
// @connect      *
// ==/UserScript==
(function () {
'use strict';

// one copy per page: with String Theory and a standalone install both on, the newer one runs (#653)
if (!mbuClaim('platform_check', 'Platform Check')) return;

// the shared MusicBrainz request gate (#633) — first, so nothing can call it before its consts exist
// <ST-NET> — generated by dev/net/sync-gate.mjs from dev/net/mb-gate.mjs — DO NOT EDIT
const MBN_GAP = 1000;
const MBN_BURST = 3;
const MBN_KEY = "mbu:mb-gate";
const MBN_LOCK = "mbu-mb-gate";
const MBN_MAX_HOLD = 60000;
function mbnGated(url) {
    const s = String(url || '');
    return /^\/ws\/2\//.test(s) || /^https?:\/\/([a-z0-9-]+\.)*musicbrainz\.org\/ws\/2\//i.test(s);
}
async function mbnState(fn) {
    const rw = () => {
        let s = null, stored = true;
        try { s = JSON.parse(localStorage.getItem(MBN_KEY) || 'null'); } catch (e) { stored = false; }
        const g = globalThis.__mbnGate || (globalThis.__mbnGate = { tat: 0, cool: 0, hot: 0 });
        if (!stored) s = g;                                                        // no storage: this page's copy only
        else if (!s || typeof s !== 'object') s = { tat: 0, cool: 0, hot: 0 };   // none yet (or cleared): a fresh schedule
        const out = fn(s);
        Object.assign(g, s);
        try { localStorage.setItem(MBN_KEY, JSON.stringify({ tat: s.tat || 0, cool: s.cool || 0, hot: s.hot || 0 })); } catch (e) {}
        return out;
    };
    // The lock is held only for rw()'s synchronous moment, so a wait of seconds means it is
    // stuck (a frozen or sandboxed holder): give up on it and go unlocked rather than hang
    // every request behind it.
    let timer = 0;
    try {
        if (typeof navigator !== 'undefined' && navigator.locks && navigator.locks.request) {
            const ctrl = typeof AbortController === 'function' ? new AbortController() : null;
            if (ctrl) timer = setTimeout(() => ctrl.abort(), 3000);
            return await navigator.locks.request(MBN_LOCK, ctrl ? { signal: ctrl.signal } : {}, rw);
        }
    } catch (e) { /* no Web Locks here (an insecure or sandboxed context), or stuck: unlocked, like a lone script */ } finally { clearTimeout(timer); }
    return rw();
}
async function mbnSlot(o) {
    o = o || {};
    const t0 = Date.now(), background = o.background !== false;
    const booked = await mbnState(s => {
        const now = Date.now(), cool = s.cool || 0, tat = s.tat || 0;
        let at = background ? Math.max(now, tat - (MBN_BURST - 1) * MBN_GAP) : now;
        at = Math.max(at, cool);
        s.tat = Math.max(tat, at) + MBN_GAP;
        return { at, why: cool > now && cool >= at ? 'MusicBrainz asked everyone to wait' : 'pacing, one request a second' };
    });
    let told = false;
    for (;;) {
        if (o.cancelled && o.cancelled()) return { ok: false, waited: Date.now() - t0 };
        let cool = 0;
        try { cool = (JSON.parse(localStorage.getItem(MBN_KEY) || 'null') || {}).cool || 0; } catch (e) { cool = (globalThis.__mbnGate || {}).cool || 0; }
        const until = Math.max(booked.at, cool), left = until - Date.now();   // a hold that appeared while we queued
        if (left <= 0) break;
        if (!told && until - t0 > 1000 && o.log) { told = true; o.log('info', 'MusicBrainz gate: ' + (o.label || 'request') + ' waits ' + Math.round((until - t0) / 100) / 10 + 's (' + (cool > booked.at ? 'MusicBrainz asked everyone to wait' : booked.why) + ')'); }
        await new Promise(r => setTimeout(r, Math.min(left, 250)));   // in slices, so a cancel lands promptly
    }
    return { ok: true, waited: Date.now() - t0 };
}
async function mbnAnswer(status, header, o) {
    o = o || {};
    if (status === 429 || status === 503) {
        const raw = header ? header('Retry-After') : null;
        const secs = Number(raw), date = raw ? Date.parse(raw) : NaN;
        const ra = Number.isFinite(secs) ? secs * 1000 : Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
        const hold = await mbnState(s => {
            const now = Date.now();
            // One throttle, one step: the requests already in flight when it began all answer
            // 503 too, and each must not stretch the hold again. A throttle long gone doesn't
            // count at all: `hot` is shared and persists, and would otherwise slow every later
            // page for good.
            if (now > (s.cool || 0) + 30000) s.hot = 0;
            if (now >= (s.cool || 0)) s.hot = Math.min((s.hot || 0) + 1, 6);
            const ms = Math.min(Math.max(1000, ra) * Math.max(1, s.hot), MBN_MAX_HOLD);
            s.cool = Math.max(s.cool || 0, Date.now() + ms);
            return s.cool - Date.now();
        });
        if (o.log) o.log('warn', 'MusicBrainz gate: HTTP ' + status + (raw != null ? ' (Retry-After: ' + raw + ')' : '') + ' — every script holds ' + Math.round(hold / 100) / 10 + 's');
        return { throttled: true, hold };
    }
    if (status >= 200 && status < 500) await mbnState(s => { if (s.hot) s.hot = Date.now() > (s.cool || 0) + 30000 ? 0 : s.hot - 1; });
    return { throttled: false, hold: 0 };
}
async function mbnFetch(url, init, o) {
    o = o || {};
    if (!mbnGated(url)) return fetch(url, init);
    const tries = o.tries || 4;
    for (let attempt = 1; ; attempt++) {
        const slot = await mbnSlot(o);
        if (!slot.ok) return null;
        const r = await fetch(url, init);
        const a = await mbnAnswer(r.status, n => r.headers.get(n), o);
        if (!a.throttled || attempt >= tries) return r;
    }
}
function mbnHot() {
    let s;
    try { s = JSON.parse(localStorage.getItem(MBN_KEY) || 'null') || {}; } catch (e) { s = globalThis.__mbnGate || {}; }
    return Date.now() > (s.cool || 0) + 30000 ? 0 : (s.hot || 0);   // a throttle long gone is over
}
function mbnRawHeader(raw, name) {
    const want = String(name).toLowerCase();
    for (const line of String(raw || '').split(/\r?\n/)) {
        const i = line.indexOf(':');
        if (i > 0 && line.slice(0, i).trim().toLowerCase() === want) return line.slice(i + 1).trim();
    }
    return null;
}
// </ST-NET>

// MusicBrainz origin of the current page (musicbrainz.org or beta.musicbrainz.org),
// so the script's own MB API calls + edit-page links stay on the same server.
const MB_ORIGIN = location.origin;

// #464: cross-tab signal for the background "right-click add" flow — the opener
// listens for the background tab's "committed" postMessage so it can close that
// tab and refresh, mirroring Credit Hoarder / Apollo Editor's own add-link channel.
const PC_CHANNEL = ('BroadcastChannel' in window) ? new BroadcastChannel('platform-check-inject') : null;

// (#623: the two one-time #501 migrations that used to run here on every load —
// sweeping cache entries out of GM storage, and copying the old bare prov_* toggles
// to pc:prov_* — are retired; every install has long since run them.)

// ─── Release editor sub-pages (/edit, /edit-relationships) ────────────────
// + click on /release stashes OK URLs in `pc:pending:<mbid>` (localStorage)
// and opens the release's /edit page. We fill the "Add another link" input then set the
// type chooser in the next-sibling <tr.relationship-item>'s <select.link-type>.
if (/\/release\/[0-9a-f-]{36}\/edit(?:[?#/]|$)/.test(window.location.pathname)) {
    runInjectHelper('release');
    return;
}
if (/\/release-group\/[0-9a-f-]{36}\/edit(?:[?#/]|$)/.test(window.location.pathname)) {
    runInjectHelper('release-group');
    return;
}
// #464: a background-add tab (right-click on +) marks itself before auto-submitting
// so that once MB redirects here to the clean release page, it can post "committed"
// back to the opener and close itself — the opener never has to poll or refocus.
if (/^\/release\/[0-9a-f-]{36}\/?(?:[?#]|$)/.test(window.location.pathname)) {
    let closeMbid = null;
    try { closeMbid = sessionStorage.getItem('pc:autocommit-close'); } catch (e) {}
    if (closeMbid) {
        try { sessionStorage.removeItem('pc:autocommit-close'); } catch (e) {}
        pcMark('landed back on the release page — edit committed, closing the tab');
        try { sessionStorage.removeItem('pc:bg-t0'); } catch (e) {}
        if (PC_CHANNEL) { try { PC_CHANNEL.postMessage({ type: 'pc-edit-committed', mbid: closeMbid }); } catch (e) {} }
        setTimeout(() => { try { window.close(); } catch (e) {} }, 80);
        return;
    }
}
// #559 (majkinetor): "Discogs master link should be also added in the background
// and tab auto closed when right click is issued on [+] button." The master goes
// onto the release GROUP, and the background flow above never covered it — a
// right-click add opened the release-group editor in a normal, focused tab and
// left it there. Same three-part shape as the release flow: the edit tab marks
// itself, submits, and this landing branch (MB redirects here after a successful
// release-group edit) posts "committed" back and closes the tab.
//
// ⚠ This is why the @match now covers /release-group/* and not just its two edit
// forms — the landing page has to run the script for the tab to close itself.
// Nothing else changes on a release-group page: the guard below stops the
// dashboard mounting anywhere but a release.
if (/^\/release-group\/[0-9a-f-]{36}\/?(?:[?#]|$)/.test(window.location.pathname)) {
    let closeRg = null;
    try { closeRg = sessionStorage.getItem('pc:autocommit-close-rg'); } catch (e) {}
    if (closeRg) {
        try { sessionStorage.removeItem('pc:autocommit-close-rg'); } catch (e) {}
        pcMark('landed back on the release-group page — edit committed, closing the tab');
        try { sessionStorage.removeItem('pc:bg-t0'); } catch (e) {}
        if (PC_CHANNEL) { try { PC_CHANNEL.postMessage({ type: 'pc-rg-edit-committed', mbid: closeRg }); } catch (e) {} }
        setTimeout(() => { try { window.close(); } catch (e) {} }, 80);
        return;
    }
}
// The dashboard belongs on a release page and nowhere else. Every branch above is
// a helper for the other pages the @match list covers (the edit forms and the
// post-commit landing pages) and each returns on its own — but the panel below is
// built at top level, and `mbid` is read positionally from the path, so a
// release-group MBID would have sailed straight through and mounted a dashboard
// there. Making the assumption explicit rather than implicit in the @match. #559
if (!/^\/release\/[0-9a-f-]{36}/.test(window.location.pathname)) return;

// Safe setTimeout wrapper.  Firefox throws NS_ERROR_NOT_INITIALIZED from
// setTimeout when the script context is being torn down — the Promise
// constructor turns that into an unhandled rejection that aborts everything.
// Catch + fall back to a requestAnimationFrame-driven busy wait so the
// caller still gets a real time delay (not a zero-delay microtask burst
// that would make polling loops exit instantly with "never appeared").
function pcWait(ms) {
    return new Promise(resolve => {
        try { setTimeout(resolve, ms); return; } catch (_) {}
        // Fallback: RAF-based wait. Each frame is ~16ms; loop until elapsed.
        const start = Date.now();
        const tick = () => {
            if (Date.now() - start >= ms) { resolve(); return; }
            try { requestAnimationFrame(tick); }
            catch (_) { resolve(); }
        };
        tick();
    });
}

// #556 (majkinetor): "It seems to work now but it takes around 30s. If I visit
// the tab, the links are set and it looks idle (and finishes immediately)."
//
// A background add is a chain of six or seven waits across TWO documents, and
// until now the console said only that it had finished. "Takes 30s" and "hung
// on step 4 for 28s then flew" are the same line of output, and I have twice
// gone looking in the wrong half of the flow because of it.
//
// So: one timeline, elapsed from the moment the helper starts, carried across
// the submit redirect in sessionStorage so the landing page's entries continue
// the same clock rather than starting a second one. Every entry records whether
// the tab was hidden at the time, because that is the axis the whole bug lives
// on.
// ⚠ the key is a literal, NOT a module-level const: the landing-page branch near
// the top of the IIFE calls pcMark and returns before any `const` down here has
// been initialised, so referencing one would throw from the temporal dead zone.
// The same trap is documented on injectInto's TYPE_FORCE.
function pcT0() {
    try {
        const v = Number(sessionStorage.getItem('pc:bg-t0'));
        if (v > 0) return v;
        const now = Date.now();
        sessionStorage.setItem('pc:bg-t0', String(now));
        return now;
    } catch (e) { return Date.now(); }
}
// ⚠ #556 (majkinetor): "how am I supposed to fetch this log if both original and
// new tab gets killed (first one killed, other one reloaded)". Quite right — a
// console timeline in a tab that closes itself is a timeline nobody can read.
// So every mark goes three places:
//
//   1. the console of the tab it happened in (useful only if you are watching);
//   2. localStorage, which OUTLIVES both the closed tab and the opener's reload;
//   3. the BroadcastChannel, so the opener's activity log shows it LIVE, while
//      the background add is still running.
//
// The dashboard drains (2) when it mounts — i.e. right after the post-commit
// reload — and listens for (3), deduplicating on the entry id so a mark that
// arrives both ways is logged once. Between them, the whole timeline is in the
// Log window by the time the tab is gone, whether or not it was open at the time.
// ⚠ the sequence counter lives on the FUNCTION, not in a module-level `let`.
// runInjectHelper is called from the top of the IIFE and reaches its first mark
// before anything declared down here is initialised, so a `let` here is in the
// temporal dead zone and reading it throws — which is not a broken log line but
// a dead background add, caught by the helper's outer catch and reported as
// "inject helper crashed". Cost me a run to rediscover the trap the comment two
// functions up already warns about. Function declarations are hoisted whole, so
// a property on one is always safe.
//
// The whole body is wrapped, too: diagnostics must never be able to break the
// thing they are diagnosing.
function pcMark(stage, extra) {
    try {
        const ms = Date.now() - pcT0();
        const line = `+${(ms / 1000).toFixed(1)}s  ${stage}${extra === undefined ? '' : '  ' + extra}${document.hidden ? '  (tab hidden)' : ''}`;
        try { console.info('[Platform Check] bg ' + line); } catch (e) {}
        // The id must be unique ACROSS DOCUMENTS. The timeline deliberately spans
        // two — the editor tab and the page MusicBrainz redirects to — and the
        // second one starts a fresh script with the counter back at 0 while
        // pcT0() still reads the same start time out of sessionStorage. `t0-seq`
        // therefore made the landing page's entry collide with the first one, and
        // the reader's dedupe threw away the "edit committed" line: the single
        // most useful entry, missing from both delivery paths. Elapsed ms plus a
        // per-document tag separates them.
        pcMark.seq = (pcMark.seq || 0) + 1;
        pcMark.tag = pcMark.tag || Math.random().toString(36).slice(2, 8);
        const entry = { id: `${pcT0()}-${ms}-${pcMark.seq}-${pcMark.tag}`, line };
        // Capped: a run is a dozen entries, but a loop that never finishes must
        // not grow this without bound.
        try {
            const prev = JSON.parse(localStorage.getItem('pc:bg-log') || '[]');
            const next = (Array.isArray(prev) ? prev : []).concat(entry).slice(-120);
            localStorage.setItem('pc:bg-log', JSON.stringify(next));
        } catch (e) {}
        try { if (PC_CHANNEL) PC_CHANNEL.postMessage({ type: 'pc-bg-log', entry }); } catch (e) {}
    } catch (e) { /* a timeline is never worth failing an edit over */ }
}
// #556 — keeping a background-add tab out of Firefox's timer throttling.
//
// Why at all: majkinetor's timelines of the SAME two-link add, tab never shown
// in any of them, are the controlled trial.
//
//     throttled          field 5.7s · Enter edit -> committed 14.5s · total 20.2s
//     inaudible tone     field 1.5s · Enter edit -> committed  2.1s · total  3.7s
//     webrtc loopback    field 4.6s · Enter edit -> committed 16.8s · total 21.4s
//
// 5.5x for the tone, and not only on the submit — MusicBrainz renders the
// External links field 3.8x faster too, because the throttling was never about
// our code. A background tab has its timers held to one step per second, and
// once it has spent its execution budget individual ones stretch to as much as
// fifteen (measured in his log: a setTimeout(…,1500) that fired 8.3s late).
//
// ⚠ THE WEBRTC LOOPBACK DOES NOT WORK HERE, so do not re-add it. chaban
// suggested it and it is much the nicer trade on paper — a data-channel-only
// loopback between two peers in the same document needs no getUserMedia, so no
// permission, no prompt and no tab indicator. It connects in under a second
// (measured: `webrtc loopback open` at +0.8s) and then makes no difference at
// all: 16.8s to commit against 16.9s with nothing running. Whatever Firefox
// exempts for an active peer connection, it is not the timer throttling — at
// least not for a data channel carrying no media.
//
// So the tone it is. An audible tab IS exempt, and that is measured, not
// assumed. Two costs, both real:
//   - a tab opened by GM_openInTab has no user activation, so Firefox's autoplay
//     policy leaves the context `suspended` until the user grants the site
//     Autoplay > Allow Audio by hand. Hence off by default, and the state is
//     reported into the timeline rather than left to be guessed at;
//   - the tab shows the speaker icon while it runs. Nothing to be done: being
//     audible is the exemption.
//
// Neither exemption can be tested here — Playwright will not produce a genuinely
// backgrounded tab (which is why e2e-556's --suspend models the constraints
// instead) and it relaxes autoplay besides. What the harness DOES check is that
// the mechanism engages and reports itself; the elapsed time in a real run is
// the rest of the answer.
function pcKeepAwake() {
    try {
        const AC = window.AudioContext || window.webkitAudioContext;
        if (!AC) { pcMark('keep-awake', 'no AudioContext in this browser — the tab will be throttled'); return null; }
        const ctx = new AC();
        const osc = ctx.createOscillator();
        const gain = ctx.createGain();
        // Non-zero on purpose: a truly silent stream may not mark the tab
        // audible, which is the entire point. 30Hz at this level is below
        // anything a speaker will reproduce.
        gain.gain.value = 0.0008;
        osc.frequency.value = 30;
        osc.connect(gain);
        gain.connect(ctx.destination);
        osc.start();
        try { const p = ctx.resume && ctx.resume(); if (p && p.catch) p.catch(() => {}); } catch (e) {}
        pcMark('keep-awake audio started', `state=${ctx.state}`);
        // The state right after construction is not the final answer; autoplay
        // blocking shows up a beat later as 'suspended'.
        try {
            setTimeout(() => pcMark('keep-awake audio', ctx.state === 'running'
                ? 'state=running — the tab is audible, so it should not be throttled'
                : `state=${ctx.state} — BLOCKED by the autoplay policy, so this setting is doing nothing. `
                  + 'Allow Audio for musicbrainz.org in the padlock menu to let it try.'), 1500);
        } catch (e) {}
        return ctx;
    } catch (e) {
        pcMark('keep-awake audio failed', String((e && e.message) || e));
        return null;
    }
}
// Called once at the start of a background add, so the Log shows THIS run rather
// than this one appended to every previous one.
function pcMarkReset() {
    try { localStorage.removeItem('pc:bg-log'); } catch (e) {}
    try { sessionStorage.removeItem('pc:bg-t0'); } catch (e) {}
    pcMark.seq = 0;
}

// MutationObserver-backed waiter — resolves the moment `predicate()`
// returns truthy, falls back to a slow poll if observers aren't usable.
// Safer than fixed-cadence polling because it doesn't rely on setTimeout
// running on time, and it picks up the target as soon as MB inserts it.
function pcWaitFor(predicate, timeoutMs = 10000) {
    return new Promise(resolve => {
        const found = predicate();
        if (found) return resolve(found);
        let done = false;
        const finish = result => { if (done) return; done = true; obs?.disconnect(); resolve(result); };
        let obs = null;
        try {
            obs = new MutationObserver(() => {
                const r = predicate();
                if (r) finish(r);
            });
            obs.observe(document.documentElement, { childList: true, subtree: true, attributes: true });
        } catch (_) { /* observer broken — rely on RAF poll below */ }
        // #556 (majkinetor): "It never happens when not invoked as background task"
        // and "when it fails, the links are NEVER added". Both are true of this loop
        // and of nothing else in the flow.
        //
        // It polled with requestAnimationFrame. A background-add tab is opened with
        // GM_openInTab(..., { active:false }), i.e. HIDDEN — and browsers suspend rAF
        // outright in hidden tabs (measured here at 14x throttling even for a merely
        // unfocused one). So the poll stops running while the deadline, being wall
        // clock, keeps advancing. The tab is then either stuck with nothing settled,
        // or — the moment it is looked at — resumes, finds the elapsed time already
        // past the timeout, and gives up on its very first tick. That is exactly an
        // all-or-nothing failure that cannot happen in the foreground.
        //
        // So: poll on a TIMER instead. setTimeout is clamped to ~1s in a hidden tab
        // but it still runs, so the wait observes the element appearing either way.
        // That one change is the whole fix.
        //
        // What is deliberately NOT here, having been tried and reverted: excusing a
        // hidden tab from the deadline (accumulating only "visible" time, with an
        // absolute cap as a backstop). It sounds right — a hidden tab is stopped,
        // not slow — but a wait that legitimately never succeeds then runs to the
        // cap every time, and with the cap at minutes that is far worse than giving
        // up. majkinetor got multi-minute hangs in BOTH foreground and background
        // out of it. The deadline is plain wall clock, as it was.
        //
        // Nor is a "be patient while the page is still mutating" budget, which I
        // built and threw away on the day the real cause turned up: it made the
        // hidden case merely slower to fail, because what the wait was waiting for
        // had been RENAMED (see findAddLinkInput) and was never going to match.
        const started = Date.now();
        const poll = () => {
            if (done) return;
            const r = predicate();
            if (r) return finish(r);
            if (Date.now() - started >= timeoutMs) return finish(null);
            try { setTimeout(poll, 100); } catch (_) { finish(null); }
        };
        poll();
    });
}

// #556: MusicBrainz sometimes serves a "Verifying your browser" challenge instead
// of the page. The URL is unchanged, so the inject helper would run against the
// challenge, find no "Add another link" input, and burn the queued payload. Falcon
// hit exactly this and had to add the same guard (#551). Detected the same way.
// ⚠ The patterns live inside the function. This runs on the editor page, above the
// script's early return, where a const declared out here is never initialised: as
// module consts they threw, the catch below answered "no", and the guard never fired.
function pcIsVerifyInterstitial(doc) {
    const d = doc || document;
    const TITLE = /^\s*Verifying your browser\s*$/i, NOSCRIPT = /JavaScript is required to access this page/i;
    try {
        if (TITLE.test(d.title || '')) return true;
        return [...d.querySelectorAll('noscript')].some(n => NOSCRIPT.test(n.textContent || ''));
    } catch (e) { return false; }
}

async function runInjectHelper(entityType) {
    // #556: declared OUT here, not inside the try — the catch below is a
    // different block and could not see a `const` from inside it, so the crash
    // path would have thrown a ReferenceError trying to stop the tone instead of
    // stopping it. See pcKeepAwake for what this is.
    let awake = null;
    const hush = () => { try { awake && awake.close && awake.close(); } catch (e) {} };
    try {
        // Stand down entirely on the browser-check page: the real page loads a
        // moment later and this runs again there, with the payload still intact. #556
        if (pcIsVerifyInterstitial()) {
            try { console.info('[Platform Check] MusicBrainz served its "Verifying your browser" challenge instead of the editor — standing down, the queued links are untouched.'); } catch (e) {}
            return;
        }
        const re   = new RegExp(`/${entityType}/([0-9a-f-]{36})`);
        const mbid = (window.location.pathname.match(re) || [])[1];
        if (!mbid) return;
        const key  = entityType === 'release-group' ? `pc:pending:rg:${mbid}` : `pc:pending:${mbid}`;
        const raw  = localStorage.getItem(key);
        // No pending payload means the user navigated to /edit themselves,
        // not via the panel's + button. Stay silent — banner noise on every
        // direct edit-page visit is worse than the diagnostic value (the
        // 2nd-click-doesn't-work bug it was diagnosing has been fixed).
        if (!raw) return;
        let pending;
        try { pending = JSON.parse(raw); }
        catch (e) {
            showInjectBanner(`Platform Check: pending payload not JSON: ${e.message}`, [], { fail: true });
            return;
        }
        const urls = Object.values(pending || {}).filter(Boolean);
        if (urls.length === 0) return;
        // #556: this lookup used to run ONCE, immediately, and was a no-op besides.
        // Measured live on the release editor: there is no "External links" TAB at
        // all — the wizard's steps are Release information / Tracklist / Recordings
        // / Edit note, and External links is a <legend> inside the first of them.
        // So this never matched anything and the click never happened; the input was
        // reachable only because its step is the default one.
        //
        // It is called once, NOT awaited. Awaiting it was a mistake of mine: on the
        // release editor the tab does not exist, so the wait could only ever run to
        // its full timeout before injectInto even started — pure dead time added to
        // every single background add.
        pcMark(`helper start on ${entityType}`, `${urls.length} url(s) queued, readyState=${document.readyState}`);
        // #556: read the hash HERE rather than after the inject — the keep-awake
        // tone has to start before MusicBrainz's throttled work does, not after.
        const autoCommit = /pc-autocommit/.test(location.hash);
        // On the happy path the tone dies with the document when MusicBrainz
        // redirects, a second or two later. Every OTHER path leaves this tab open
        // on purpose — nothing landed, no submit button, a crash — and a tab left
        // open would be a tab humming away with the audio indicator lit until
        // someone closes it. hush() is called explicitly on each of those.
        // #556: say when it is OFF, too. A run with the setting disabled logged
        // NOTHING about keep-awake, so "it didn't work again" and "the mechanism
        // failed" produced identical output and we both guessed. Silence is not
        // a diagnosis.
        const wantAwake = autoCommit && GM_getValue('pc:bg-audio', false);
        if (autoCommit && !wantAwake) pcMark('keep-awake', 'OFF — enable "Keep background-add tabs awake" in settings to skip the throttling');
        awake = wantAwake ? pcKeepAwake() : null;
        pcOpenExternalLinks();
        await pcWait(200);
        const result = await injectInto(urls, key) || { injected: 0 };
        pcMark('inject finished', `${result.injected} confirmed`);
        // #464: right-click "add in background" — auto-submit once the URLs are in,
        // and mark this tab so the redirect back to the clean /release/<mbid> page
        // (only that landing page is @match'd; release-group has no such page) can
        // post "committed" + close itself. Only the release flow supports this.
        // #559: the release-group editor takes the same route now, for the Discogs
        // master URL. Its form is NOT the release wizard, so the button differs —
        // see findSubmit below.  (`autoCommit` is read at the top of the helper —
        // the keep-awake tone needs it before the inject, not after.)
        // #556 (majkinetor): NEVER submit a run that added nothing. This used to
        // fire unconditionally, and the release editor's submit is enabled by ANY
        // pending change — so with Apollo's auto search-and-replace configured, its
        // edit made the form dirty, Platform Check submitted it as if the links had
        // gone in (edit 152603580: an S&R edit, no link), then closed the tab and
        // reloaded the opener. The user got an edit they did not ask for at that
        // moment, and every diagnostic went with the closed tab. Failing here means
        // the tab stays open with its banner and console intact, and the queued
        // links survive for a retry — which is what actually worked on his 2nd try.
        if (autoCommit && !result.injected) {
            try { console.warn('[Platform Check] background add: nothing landed — NOT submitting. The tab is left open and the links stay queued; press ↻ or the + again to retry.'); } catch (e) {}
            hush();
            showInjectBanner('Platform Check: no link could be added — not submitting. The links are still queued, so you can retry; this tab is left open on purpose.', [], { fail: true });
        } else if (autoCommit) {
            // #465 (chaban-mb): the release editor is the multi-step wizard, not the
            // simple artist/label/place form — its submit button is #enter-edit. Same
            // finder Apollo's compact nav bar already uses for this exact form.
            // #559: the release-GROUP editor is the plain entity form and has no
            // #enter-edit at all (measured on a live page: `#enter-edit` absent,
            // `button.submit.positive` reading "Enter edit" present), so each entity
            // type gets the finder that actually matches its own form.
            const findSubmit = entityType === 'release-group'
                ? () => document.querySelector('button.submit.positive')
                    || [...document.querySelectorAll('button')].find(b => /enter edit/i.test(b.textContent || ''))
                : () => document.querySelector('#enter-edit')
                    || [...document.querySelectorAll('button')].find(b => /enter edit/i.test(b.textContent || ''));
            // #556: wait for it to be ENABLED, not merely present. MusicBrainz
            // disables Enter edit while the editor is validating, and the old
            // wait resolved on the disabled button the instant it appeared —
            // then took the "no submit button found" branch and gave up without
            // ever clicking. Same 5s budget; it just spends it on the right
            // condition. A disabled one that never enables is reported as that,
            // rather than as "not found", which is a different bug entirely.
            let sawDisabled = false;
            const btn = await pcWaitFor(() => {
                const b = findSubmit();
                if (!b) return null;
                if (b.disabled) { sawDisabled = true; return null; }
                return b;
            }, 5000);
            pcMark('submit button', btn ? 'enabled' : (sawDisabled ? 'STILL DISABLED after 5s' : 'not found'));
            if (btn) {
                try { sessionStorage.setItem(entityType === 'release-group' ? 'pc:autocommit-close-rg' : 'pc:autocommit-close', mbid); } catch (e) {}
                btn.click();
                pcMark('Enter edit clicked — waiting for MusicBrainz to submit and redirect');
            } else {
                hush();
                showInjectBanner(sawDisabled
                    ? 'Platform Check: background add — MusicBrainz kept "Enter edit" disabled, review manually'
                    : 'Platform Check: background add — no submit button found, review manually', [], { fail: true });
            }
        }
    } catch (e) {
        // Last-resort surface so the user sees *something* on the page when
        // a Firefox-specific exception kills the inject path silently. A banner
        // is no use in a BACKGROUND add tab, which nobody looks at — so say it
        // in the console too, where it survives for a bug report.
        try { hush(); } catch (_) {}
        try { console.error('[Platform Check] inject helper crashed —', e); } catch (_) {}
        try {
            showInjectBanner(`Platform Check: inject helper crashed — ${e.name || 'Error'}: ${e.message || e}`, [], { fail: true });
        } catch (_) { /* nothing else we can do here */ }
    }
}

// #556: open the release editor's "External links" step. Returns the tab element
// once it exists (so it can be awaited with pcWaitFor), null while it does not.
// Clicking an already-active step is a no-op, so this is safe to call repeatedly.
function pcOpenExternalLinks() {
    const tab = [...document.querySelectorAll('a, button, li')]
        .find(el => /^external\s+links$/i.test(el.textContent?.trim() || ''));
    if (!tab) return null;
    try { tab.click(); } catch (e) { /* not clickable yet — the caller keeps polling */ }
    return tab;
}

// ⚠ #556 — THE bug, after five wrong diagnoses. This used to identify the field
// by its PLACEHOLDER TEXT alone, and Apollo Editor rewrites that text.
//
// Apollo's multi-link paste (majkinetor: "make a hint show that it can be
// multiple links") replaces MusicBrainz's "Add another link" with
// "Paste one or more links", re-applying it from a MutationObserver on
// #external-links-editor so it survives every React re-render. From that moment
// this function matched nothing, Platform Check waited out its 25s and reported
//   no "Add another link" input ever appeared (25s, External links step never rendered)
// — no link added, nothing submitted, exactly what he saw.
//
// Which is a RACE between two of our own scripts, and that is why it looked like
// a hidden-tab bug for a fortnight: whoever gets to the field first wins. In a
// foreground tab Platform Check usually arrives before Apollo has installed its
// observer; in a background tab, where our poll runs on a ~1s clamp, Apollo has
// always won by the time we look. Hence "every time I switch to the tab and
// watch it, it works" — and hence, too, "I repeated it and it worked".
//
// Measured on the sandbox (probe-556-who-eats-the-field.mjs), each script alone
// on the release editor:
//   (none) YES · platform_check YES · art_station YES · credit_hoarder YES
//   group_therapy YES · isrc_scout YES · mammoth YES
//   apollo_editor NO · string_theory NO
//
// So: find the field STRUCTURALLY — the empty url input inside MusicBrainz's own
// #external-links-editor, which is what the row actually is and what Apollo's own
// CSS keys on. Placeholder text is a label for humans; no script should route on
// another script's cosmetics. The old text match stays as a fallback for forms
// that have no #external-links-editor.
function findAddLinkInput() {
    // The editor renders one input[type=url] per link plus a trailing EMPTY one:
    // that empty one is the "add" row, whatever it happens to say today.
    const ed = document.getElementById('external-links-editor');
    if (ed) {
        const empty = [...ed.querySelectorAll('input[type="url"]')].filter(i => !i.value);
        if (empty.length) return empty[empty.length - 1];
    }
    // Fallback: /release/<mbid>/edit uses placeholder "Add another link",
    // /release-group/<rg>/edit uses "Add link" (no "another").
    const all = [...document.querySelectorAll('input[type="text"], input[type="url"], input:not([type])')];
    const RE = /^(?:add (?:another )?link|add another url|paste one or more links)$/i;
    return all.find(i => RE.test((i.placeholder || '').trim()) && !i.value)
        || all.find(i => RE.test((i.placeholder || '').trim()))
        || null;
}

async function injectInto(urls, storageKey) {
    // Force-type providers: MB's URL auto-classifier leaves the type empty
    // for Apple Music + Bandcamp ("Please select a link type" warning). Map
    // host pattern → ordered list of preferred link_type_ids. We pick the
    // first one whose value actually appears as an <option> in the row's
    // <select.link-type>, because MB's chooser only offers types that are
    // applicable to that URL host (Apple Music offers 980 'streaming page'
    // but not 85; Bandcamp offers 85 'stream for free' but not 980). IDs
    // verified live on MB via probe. Inline-local because the IIFE's
    // early-return path calls injectInto before any module-level const
    // after the return is initialised (temporal dead zone).
    const TYPE_FORCE = [
        { test: u => /music\.apple\.com\/.*\/album\//i.test(u),     ids: ['980', '85'], name: 'streaming page' },
        { test: u => /[a-z0-9-]+\.bandcamp\.com\/album\//i.test(u), ids: ['85', '980'], name: 'stream for free' },
        // HDtracks (MBS-9023) and Volumo have no dedicated MB link type, so MB's
        // classifier leaves both blank on insert. Both are paid download stores →
        // 74 'purchase for download' (verified live: MB auto-types Deezer/Spotify/
        // Tidal/Beatport but leaves hdtracks.com and volumo.com unset).
        { test: u => /hdtracks\.com\//i.test(u),                    ids: ['74'],        name: 'purchase for download' },
        { test: u => /volumo\.com\/album\//i.test(u),               ids: ['74'],        name: 'purchase for download' },
        // Qobuz: MB's URLCleanup recognises it but allows BOTH 'purchase for download'
        // and 'streaming page' (paid) — so MB can't auto-pick one and leaves the type
        // blank ("Please select a link type", chaban-mb #201). Qobuz is a hi-res download
        // store first (like HDtracks/Volumo), so prefer 74; fall back to 980 if that's the
        // only one MB offers for the row.
        { test: u => /qobuz\.com\/(?:[a-z]{2}-[a-z]{2}\/)?album\//i.test(u), ids: ['74', '980'], name: 'purchase for download' },
        // SoundCloud (#469, chaban-mb): MB offers the whole "get the music" family
        // for a SoundCloud URL (73/74/75/85/980) and picks none of them, so the row
        // is left with a blank REQUIRED select and "Please select a link type for
        // the URL you've entered" — which blocks the release editor's submit
        // entirely (and therefore also #465's auto-submit), not just this one link.
        // Verified live: both example sets from the issue render exactly this.
        // 85 'stream for free' is the right default — a SoundCloud set is free
        // streaming unless it's Go-only. Picking between 85 and 980 *correctly*
        // needs the per-track monetization_model/policy signal chaban described
        // (policy 'SNIP' + truncated durations => Go-gated => 980); that's a
        // refinement, deliberately out of scope here since the reported problem is
        // the blocked submission, not the choice of type.
        { test: u => /^https?:\/\/(?:www\.|m\.)?soundcloud\.com\//i.test(u), ids: ['85', '980'], name: 'stream for free' },
        // YouTube Music (#639): MB offers 85 and 980 and picks neither — the same blocked
        // submit as SoundCloud (verified on the sandbox). Its free tier plays every album, with ads.
        { test: u => /^https?:\/\/music\.youtube\.com\//i.test(u), ids: ['85', '980'], name: 'stream for free' },
        // Audiomack (#664): MB offers 85 and 980 and picks neither, as for YouTube Music. Free with ads.
        { test: u => /^https?:\/\/(?:www\.)?audiomack\.com\//i.test(u), ids: ['85', '980'], name: 'stream for free' },
    ];
    const setVal = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
    const setSel = Object.getOwnPropertyDescriptor(window.HTMLSelectElement.prototype, 'value').set;
    const reports = [];
    let injected = 0;

    for (const url of urls) {
      // One URL must never be able to end the run. Before this, anything thrown
      // mid-loop (a TDZ ReferenceError, a DOM shape MB changed) aborted every
      // remaining URL and surfaced only as a banner — invisible in a background
      // add tab, which is where this flow actually lives. Now a URL that blows
      // up is reported like any other failure and the next one still gets a go.
      try {
        // MutationObserver-backed wait — resolves the moment MB renders an
        // empty "Add another link" input, regardless of how long the page
        // takes to mount the External Links section.
        // #556 (majkinetor, from the console log the new diagnostics produced):
        //   inject FAILED: <beatport url> — no "Add another link" input ever appeared
        //
        // The 10s budget was simply too short. The External links fieldset is part
        // of the release editor's own async boot, and his page had plenty to get
        // through first: Apollo's log has the editor still loading tracks 6s in, a
        // /ws/2 request timing out outright, and String Theory running seven scripts
        // on the same main thread alongside two other userscripts. Nothing was
        // broken — Platform Check just gave up before MusicBrainz finished.
        //
        // 25s, and the step is re-asserted between polls in case the editor
        // re-renders back to a different one. Throttled so repeated clicking cannot
        // fight the editor's own rendering.
        let _lastOpen = 0, _t0 = Date.now(), _said = 0;
        const input0 = await pcWaitFor(() => {
            const el = findAddLinkInput();
            if (el) return el;
            const now = Date.now();
            if (now - _lastOpen > 700) { _lastOpen = now; pcOpenExternalLinks(); }
            // #556: say so while still waiting. Without this the console is silent
            // until the end, so "gave up at 25s" and "hung for minutes" look the
            // same in a bug report — and I could not tell them apart in his.
            const secs = Math.round((now - _t0) / 1000);
            if (secs >= 10 && secs - _said >= 10) {
                _said = secs;
                try {
                    console.info(`[Platform Check] inject: still waiting for MusicBrainz to render the External links field (${secs}s, hidden=${!!document.hidden})`);
                } catch (e) {}
            }
            return null;
        }, 25000);
        if (input0) pcMark('External links field found', url);
        if (!input0) {
            const secs = Math.round((Date.now() - _t0) / 1000);
            reports.push({ url, ok: false, miss: `no "Add another link" input ever appeared (${secs}s, External links step never rendered)` });
            break;
        }

        // ⚠ #556: `injected` is NOT bumped for a dispatched keystroke. It gates
        // whether the pending payload is consumed below, and counting the
        // keystroke rather than a confirmed row meant a run where nothing landed
        // still ate the queue — so the failure could not retry and did not
        // self-heal. It is incremented once the row is actually confirmed.
        const typeAndEnter = (el) => {
            el.focus();
            setVal.call(el, url);
            el.dispatchEvent(new Event('input',  { bubbles: true }));
            el.dispatchEvent(new Event('change', { bubbles: true }));
            el.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', code: 'Enter', bubbles: true }));
            el.dispatchEvent(new KeyboardEvent('keyup',   { key: 'Enter', code: 'Enter', bubbles: true }));
            el.blur();
        };
        typeAndEnter(input0);

        // Wait for the URL row + type row to materialise.
        const appleId = url.match(/music\.apple\.com\/[^/]+\/album\/(?:[^/?#]+\/)?(\d+)\b/)?.[1];
        // #556: MusicBrainz REWRITES the URL as it creates the row (locale segment,
        // www., trailing slash, stripped query). An exact `h === url` therefore
        // missed rows that had been created perfectly well, reported them as "URL
        // row never appeared", and — because the payload was consumed regardless —
        // left the tab open with nothing retryable. Compare on resource identity.
        // The appleId clause is kept as a belt-and-braces fallback.
        const matchRowByUrl = r => {
            const a = r.querySelector('a[href]');
            const h = a?.getAttribute('href') || '';
            return h === url || pcSameUrl(h, url) || (appleId && new RegExp(`/album/(?:[^/]+/)?${appleId}\\b`).test(h));
        };
        const findRow = () => [...document.querySelectorAll('tr.external-link-item')].find(matchRowByUrl);
        // #556 (majkinetor): "tab opened, nothing in tab […] I repeated it and it
        // worked" — the same URL that fails once succeeds on a plain retry, which
        // is the signature of losing the keystroke to a React re-render rather
        // than of MusicBrainz rejecting the link. So retry it here instead of
        // making the user do it: re-query the input (the old node is often gone by
        // now) and type again. Three attempts, ~4s each.
        let urlRow = await pcWaitFor(findRow, 4000);
        for (let attempt = 2; !urlRow && attempt <= 3; attempt++) {
            const again = findAddLinkInput();
            if (!again) break;
            try { console.warn(`[Platform Check] inject: no row for ${url} yet — retry ${attempt}/3`); } catch (e) {}
            typeAndEnter(again);
            urlRow = await pcWaitFor(findRow, 4000);
        }
        if (!urlRow) { reports.push({ url, ok: false, miss: 'URL row never appeared after Enter (3 attempts)' }); continue; }
        injected++;   // #556: a CONFIRMED row — see the note where Enter is dispatched
        pcMark('row confirmed', url);

        // Type-force if applicable.  The Type chooser lives in the NEXT
        // sibling <tr.relationship-item> (verified live on MB).
        const force = TYPE_FORCE.find(t => t.test(url));
        if (!force) { reports.push({ url, ok: true, note: 'auto-typed' }); continue; }

        const typeRow = await pcWaitFor(() => {
            const s = urlRow.nextElementSibling;
            return (s && s.classList?.contains('relationship-item')) ? s : null;
        }, 3000);
        const select = typeRow?.querySelector('select.link-type');
        if (!select) {
            reports.push({ url, ok: false, miss: `no <select.link-type> in next sibling (got ${typeRow?.tagName}.${typeRow?.className || ''})` });
            continue;
        }
        const opt = force.ids.map(id => [...select.options].find(o => o.value === id)).find(Boolean);
        if (!opt) {
            const optsList = [...select.options].map(o => `${o.value}=${o.textContent.trim()}`).join(', ').slice(0, 400);
            reports.push({ url, ok: false, miss: `none of ids=[${force.ids.join(',')}] in options. Options: ${optsList}` });
            continue;
        }
        setSel.call(select, opt.value);
        select.dispatchEvent(new Event('change', { bubbles: true }));
        const report = { url, ok: true, type: opt.textContent.trim(), linkTypeId: opt.value };
        reports.push(report);

        // #423: a Bandcamp album that also has a DIGITAL release is both streamable AND
        // purchasable, so it deserves a SECOND relationship on the same URL — 74 'purchase
        // for download' next to 85 'stream for free' — via MB's own "Add another
        // relationship" row. Gated on the format the Bandcamp scan parsed from the page's
        // JSON-LD musicReleaseFormat ("Digital", "Digital, CD", …), so a physical-only
        // page doesn't get a bogus download rel. cacheGet/cacheKey are hoisted function
        // declarations, safe to call from this pre-return path.
        if (opt.value === '85' && /[a-z0-9-]+\.bandcamp\.com\/album\//i.test(url)) {
            const relMbid = (storageKey.match(/^pc:pending:([0-9a-f-]{36})$/) || [])[1];
            const bc = relMbid ? cacheGet(relMbid, 'bandcamp') : null;
            if (bc && /\b(digital|file)\b/i.test(bc.format || '')) {
                const addBtn = await pcWaitFor(() => {
                    const s = typeRow.nextElementSibling;
                    return (s && s.classList?.contains('add-relationship')) ? s.querySelector('button.add-item') : null;
                }, 3000);
                let ok2 = false;
                if (addBtn) {
                    addBtn.click();
                    // the fresh relationship row lands right after the first one
                    const sel2 = await pcWaitFor(() => {
                        const s = typeRow.nextElementSibling;
                        if (!s || !s.classList?.contains('relationship-item')) return null;
                        const el = s.querySelector('select.link-type');
                        return (el && el !== select && !el.value) ? el : null;
                    }, 3000);
                    if (sel2 && [...sel2.options].some(o => o.value === '74')) {
                        setSel.call(sel2, '74');
                        sel2.dispatchEvent(new Event('change', { bubbles: true }));
                        report.type += ' + purchase for download';
                        ok2 = true;
                    }
                }
                if (!ok2) report.note = 'digital release detected but the second rel (purchase for download) could not be added';
            }
        }
      } catch (e) {
        reports.push({ url, ok: false, miss: `threw — ${e && e.name || 'Error'}: ${e && e.message || e}` });
      }
    }

    // #556: a background add tab has no panel and therefore no log — "it did
    // nothing and said nothing" was most of what made this hard to diagnose.
    // Leave a trace in the tab's own console either way, naming each URL and what
    // became of it, so a failing run in the wild can actually be read back.
    const okUrls = reports.filter(r => r.ok).map(r => r.url);
    try {
        console.info(`[Platform Check] inject: ${okUrls.length}/${reports.length} link(s) landed on ${storageKey}`);
        reports.filter(r => !r.ok).forEach(r => console.warn(`[Platform Check] inject FAILED: ${r.url} — ${r.miss}`));
        if (!injected) console.warn('[Platform Check] inject: nothing was confirmed — the queued links are kept for a retry');
    } catch (e) {}

    // #556 (majkinetor): consume ONLY what actually landed. `injected > 0` used to
    // drop the whole payload, so a partial run silently lost every URL that had
    // failed — the 2-of-3 case, unrecoverable in exactly the same way the 0-of-3
    // case was. What's left stays queued and the next attempt picks it up.
    try {
        const raw = localStorage.getItem(storageKey);
        const pend = raw ? JSON.parse(raw) : null;
        if (pend && typeof pend === 'object') {
            const left = {};
            for (const [k, v] of Object.entries(pend)) {
                if (v && !okUrls.some(u => pcSameUrl(u, v) || u === v)) left[k] = v;
            }
            if (Object.keys(left).length) localStorage.setItem(storageKey, JSON.stringify(left));
            else localStorage.removeItem(storageKey);
        } else if (injected > 0) {
            localStorage.removeItem(storageKey);
        }
    } catch (e) {
        if (injected > 0) { try { localStorage.removeItem(storageKey); } catch (_) {} }
    }

    // #641: links added by a middle click, over link confidence ({ url: reason }), so the note
    // doesn't claim they passed it. Read once, then dropped with the queue.
    let forced = {};
    const forcedKey = storageKey.replace(/^pc:pending:/, 'pc:forced:');
    try { forced = JSON.parse(localStorage.getItem(forcedKey) || '{}') || {}; if (injected > 0) localStorage.removeItem(forcedKey); } catch (_) {}
    // Set the edit note (as the script used to), and report the result quietly
    // inline next to the External links heading instead of a centred popup.
    if (okUrls.length) setEditNote(pcEditNote(okUrls, forced));
    showInlineSummary(reports);
    return { injected, reports, okUrls };
}

// Build the edit note: a header line (name/version/author/homepage from GM_info,
// with fallbacks) + the links that were added — same shape as the other scripts.
// forced (#641): { url: reason } for links added by a middle click over link confidence — each is
// marked in the list, so the note never claims they passed it. A link that passed is listed plain.
function pcEditNote(urls, forced) {
    const s = (typeof GM_info !== 'undefined' && GM_info.script) || {};
    const homepage = s.homepageURL || s.homepage ||
        'https://github.com/majkinetor/musicbrainz-userscripts/blob/main/userscripts/platform_check/README.md';
    const header = (s.name || 'MB Platform Check') + ' v' + (s.version || '?') +
        ' by ' + (s.author || 'majkinetor') + ' - ' + homepage;
    // Record the link-confidence settings that gated which links were added, so a reviewer can see why
    // (e.g. strict barcode/format withholding). Lists each enabled check with its mode; 'off' when none.
    const modeWord = k => GM_getValue(k, 'exists') === 'strict' ? 'strictly' : 'if they exist';
    const conf = [];
    if (GM_getValue('pc:respect-format', true))  conf.push('formats ' + modeWord('pc:format-mode'));
    if (GM_getValue('pc:respect-barcode', true)) conf.push('barcodes ' + modeWord('pc:barcode-mode'));
    const confLine = 'Link confidence: ' + (conf.length ? conf.join(', ') : 'off');
    const lines = [header, confLine, '', 'Added ' + urls.length + ' external link' + (urls.length === 1 ? '' : 's') + ':'];
    const why = u => { const k = Object.keys(forced || {}).find(x => pcSameUrl(x, u) || x === u); return k ? forced[k] : null; };
    urls.forEach(u => { const w = why(u); lines.push(w ? u + '  (added by hand over link confidence: ' + w + ')' : u); });
    return lines.join('\n');
}

// Fill MB's edit-note textarea via the native setter so React picks it up.
// Appends to anything already typed there.
function setEditNote(text) {
    const ta = document.querySelector(
        'textarea.edit-note, textarea[name="edit-note"], textarea[name="edit_note"], #id-edit-note, .edit-note textarea');
    if (!ta) return false;
    try {
        const setVal = Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, 'value').set;
        const existing = (ta.value || '').trim();
        setVal.call(ta, existing ? existing + '\n' + text : text);
        ta.dispatchEvent(new Event('input',  { bubbles: true }));
        ta.dispatchEvent(new Event('change', { bubbles: true }));
        return true;
    } catch (_) { return false; }
}

// Quiet inline confirmation placed next to the "External links" heading (replaces
// the old intrusive centred banner). Failures still surface here so nothing's lost.
function showInlineSummary(reports) {
    const ok = reports.filter(r => r.ok).length;
    const fail = reports.length - ok;
    let el = document.getElementById('pc-inline-summary');
    if (!el) {
        el = document.createElement('span');
        el.id = 'pc-inline-summary';
        el.style.cssText = 'margin-left: 10px; font-size: 12px; font-weight: 600; font-family: sans-serif; ' +
            'padding: 1px 8px; border-radius: 10px; vertical-align: middle; display: inline-block;';
    }
    el.style.color      = fail ? 'var(--mbu-warn)' : 'var(--mbu-ok)';
    el.style.background = fail ? 'var(--mbu-warn-bg)' : 'var(--mbu-ok-bg)';
    el.style.border     = '1px solid ' + (fail ? '#FFC107' : '#81C784');
    el.title = reports.map(r => ((r.url || '').replace(/^https?:\/\//, '')) + ' — ' + (r.ok ? 'OK' + (r.type ? ' · ' + r.type : '') : 'FAIL · ' + r.miss)).join('\n');
    el.textContent = '✓ Platform Check added ' + ok + (fail ? ', ' + fail + ' failed' : '') + ' — edit note set, review & Enter edit';
    const re = /^\s*external links\s*$/i;
    const heading = [...document.querySelectorAll('h2, h3, legend, label')].find(h => re.test(h.textContent || ''));
    if (heading) { heading.appendChild(el); return; }
    const tab = [...document.querySelectorAll('a, button, li')].find(h => re.test(h.textContent || ''));
    if (tab) tab.after(el); else document.body.appendChild(el);
}

function showInjectBanner(text, reports = [], opts = {}) {
    document.getElementById('pc-inject-status')?.remove();
    const overlay = document.createElement('div');
    overlay.id = 'pc-inject-status';
    const fail = !!opts.fail;
    const palette = fail
        ? { bg: '#FFF8E1', border: '#FFB300', accent: '#7B5E00', title: '#5D4400', tagOk: '#1B5E20', tagFail: '#B71C1C' }
        : { bg: '#E8F5E9', border: '#66BB6A', accent: '#1B5E20', title: '#0E4814', tagOk: '#1B5E20', tagFail: '#B71C1C' };
    overlay.style.cssText = `
        position: fixed; top: 16px; left: 50%; transform: translateX(-50%);
        z-index: 999999; padding: 12px 36px 12px 14px; border-radius: 8px;
        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
        font-size: 13px; line-height: 1.4; max-width: 520px; min-width: 280px;
        background: ${palette.bg};
        border: 1px solid ${palette.border};
        color: ${palette.accent};
        box-shadow: 0 6px 20px rgba(0,0,0,0.18), 0 2px 4px rgba(0,0,0,0.08);`;

    const closeBtn = `<button id="pc-inject-close" type="button" aria-label="Close" style="
        position: absolute; top: 6px; right: 6px;
        width: 22px; height: 22px; padding: 0; border: 0; border-radius: 50%;
        background: transparent; color: ${palette.accent}; font-size: 16px; line-height: 1;
        cursor: pointer; opacity: 0.6;">×</button>`;
    let body = `<div style="font-weight: 600; color: ${palette.title}; margin-right: 6px;">${text}</div>`;
    if (reports.length) {
        body += '<ul style="margin: 8px 0 0 0; padding: 0; list-style: none; font-size: 12px;">';
        for (const r of reports) {
            const host = (r.url || '').match(/^https?:\/\/([^/]+)/)?.[1] || '';
            const tail = r.ok
                ? `<span style="color: ${palette.tagOk}; font-weight: 600;">OK</span>${r.type ? ` <span style="color:var(--mbu-text-dim);">· ${r.type}</span>` : ''}${r.note ? ` <span style="color:var(--mbu-text-weak);">· ${r.note}</span>` : ''}`
                : `<span style="color: ${palette.tagFail}; font-weight: 600;">FAIL</span> <span style="color:var(--mbu-text-dim);">· ${r.miss}</span>`;
            body += `<li style="padding: 2px 0; display: flex; gap: 6px;"><span style="color:var(--mbu-text-weak); min-width: 0;">${host}</span><span style="color:var(--mbu-text-dim);">·</span><span style="flex: 1;">${tail}</span></li>`;
        }
        body += '</ul>';
        body += `<div style="margin-top: 10px; padding-top: 8px; border-top: 1px solid ${palette.border}; font-size: 11px; color: var(--mbu-text-dim);">Remember to set an edit note and click <strong style="color: ${palette.accent};">Enter edit</strong> to save.</div>`;
    }
    overlay.innerHTML = body + closeBtn;
    document.body.appendChild(overlay);
    const close = document.getElementById('pc-inject-close');
    close?.addEventListener('mouseenter', () => { close.style.opacity = '1'; close.style.background = 'rgba(0,0,0,0.06)'; });
    close?.addEventListener('mouseleave', () => { close.style.opacity = '0.6'; close.style.background = 'transparent'; });
    close?.addEventListener('click', () => overlay.remove());
}

// ─── UI ────────────────────────────────────────────────────────────────────
// The dashboard is for a /release/<mbid> page ONLY. Standalone the @match scopes it; in the String
// Theory bundle this script runs on every MB page (Mammoth matches /*), so guard the entity type before
// building any UI — `\/release\/` won't match `/release-group/`, so the RG overview no longer mounts it. (#343)
if (!/^\/release\/[0-9a-f-]{36}/i.test(window.location.pathname)) return;
const sidebar = document.querySelector('#sidebar');
if (!sidebar) return;

const container = document.createElement('div');
container.id = 'mb-pc-panel';
container.className = 'online-search-box';
// min-width:0 + max-width + overflow:hidden so a long, no-wrap meta line (e.g. an
// Apple Music licence string) can't stretch the panel — and the whole sidebar — wide.
container.style.cssText = 'margin-bottom: 12px; padding: 8px 6px; background: var(--mbu-bg); border: 1px solid var(--mbu-border); border-radius: 6px; font-size: 13px; font-family: sans-serif; box-shadow: 0 1px 3px rgba(0,0,0,0.05); min-width: 0; max-width: 100%; box-sizing: border-box; overflow: hidden;';
// MB's site CSS adds an external-link icon to every `target="_blank"` anchor
// (`a[rel~="external"]::after` / similar). On the dark-themed sidebar it
// renders as a missing-image red square next to each platform name. Suppress
// it on our anchors via inline ::after override scoped to the panel.
const iconBtn = 'cursor: pointer; user-select: none; color: var(--mbu-text-dim); padding: 2px 6px; border-radius: 4px; line-height: 1; font-size: 14px;';

// Provider order is user-configurable from the providers modal. Stored as a
// JSON array under `pc:provider-order`. getProviderOrder() always returns
// every known platform — unknown stored values are dropped, missing ones
// are appended — so adding a new platform (like Apple Music) doesn't break
// stored preferences.
// Default visual order — Discogs first since it's the most reliable rich
// metadata source, then the streaming services, with Deezer last because it
// has the worst catalogue coverage of the four. Users can override via the
// providers panel (drag-and-drop) and the choice persists in pc:provider-order.
const ALL_PROVIDERS = ['discogs', 'bandcamp', 'spotify', 'apple', 'deezer', 'tidal', 'ytmusic', 'amazonmusic', 'qobuz', 'beatport', 'volumo', 'hdtracks', 'soundcloud', 'audiomack'];
function getProviderOrder() {
    const raw = GM_getValue('pc:provider-order', null);
    if (!raw) return ALL_PROVIDERS.slice();
    try {
        const arr = JSON.parse(raw);
        const out = [];
        for (const p of arr) if (ALL_PROVIDERS.includes(p) && !out.includes(p)) out.push(p);
        for (const p of ALL_PROVIDERS) if (!out.includes(p)) out.push(p);
        return out;
    } catch { return ALL_PROVIDERS.slice(); }
}
const PROVIDER_ORDER = getProviderOrder();
// A provider the user has unchecked in Settings is hidden from the dash, but its
// result may still be cached from an earlier enabled run. Anything that consumes the
// cache (inject +, open-all ↗) must skip disabled providers or it queues/opens links
// for a provider the user turned off. (#255)
const providerEnabled = p => GM_getValue(`pc:prov_${p}`, true);
const PROVIDER_NAME  = { spotify:'Spotify', discogs:'Discogs', bandcamp:'Bandcamp', deezer:'Deezer', apple:'Apple', tidal:'Tidal', qobuz:'Qobuz', beatport:'Beatport', volumo:'Volumo', hdtracks:'HDtracks', soundcloud:'SoundCloud', audiomack:'Audiomack', ytmusic:'YouTube Music', amazonmusic:'Amazon Music' };
// Tidal and Discogs are black-and-white brands: their names take the theme's text colour, so they read on a dark theme too
const PROVIDER_COLOR = { spotify:'#1DB954', discogs:'var(--mbu-text)', bandcamp:'#629AA9', deezer:'#A238FF', apple:'#FA243C', tidal:'var(--mbu-text)', qobuz:'#0070ef', beatport:'#0a8754', volumo:'#7c4dff', hdtracks:'#e63329', soundcloud:'#ff5500', audiomack:'#FFA200', ytmusic:'#FF0000', amazonmusic:'#1FA8B0' };
// Shared platform icons (#404) — `stIcon(name, size)` / `stColor(name)`. Source of truth is
// dev/ui/platform-icons.mjs; the block below is generated by dev/ui/sync-icons.mjs (pre-commit hook).
// <ST-ICONS> — generated by dev/ui/sync-icons.mjs from dev/ui/platform-icons.mjs — DO NOT EDIT
const ST_ICONS = {"musicbrainz":{"color":"#eb743b","svg":"<svg viewBox=\"0 0 30 30\" xmlns=\"http://www.w3.org/2000/svg\"><g transform=\"translate(1.5)\"><path d=\"m13 1-12 7v14l12 7z\" fill=\"#ba478f\"/><path d=\"m14 1 12 7v14l-12 7z\" fill=\"#eb743b\"/></g></svg>"},"discogs":{"color":"#333333","svg":"<svg viewBox=\"0 0 1024 1024\" xmlns=\"http://www.w3.org/2000/svg\"><g transform=\"translate(512 512) scale(0.86) translate(-512 -512)\"><circle cx=\"512\" cy=\"512\" r=\"496\" fill=\"#333\" stroke=\"#9a9a9a\" stroke-width=\"32\"/><path fill=\"#fff\" d=\"M439.84 511.58A72.58 72.58 0 0 1 512.41 439 72.54 72.54 0 0 1 585 511.58a72.56 72.56 0 0 1-72.57 72.56 72.56 72.56 0 0 1-72.57-72.56zm3.18 0A69.48 69.48 0 0 0 512.41 581a69.4 69.4 0 0 0 69.4-69.38 69.49 69.49 0 0 0-69.4-69.43A69.44 69.44 0 0 0 443 511.58zm69.42-11.44a11.43 11.43 0 1 0 11.47 11.45 11.45 11.45 0 0 0-11.48-11.45zm-131.08 11.43a130.68 130.68 0 0 0 40.3 94.43l24.68-26.69.33.3a94.59 94.59 0 0 1 113.08-149.95l17.51-31.95a130.23 130.23 0 0 0-64.82-17.22c-72.27.01-131.08 58.81-131.08 131.08zm225.73 0a94.6 94.6 0 0 1-138.64 83.79l-17.83 31.74a130.26 130.26 0 0 0 61.82 15.53c72.28 0 131.08-58.8 131.08-131.08a130.63 130.63 0 0 0-37.73-91.9L581 446.39a94.3 94.3 0 0 1 26.1 65.2zm-267.34 0a172.17 172.17 0 0 0 53.68 125l25-27.07a135.38 135.38 0 0 1-41.82-97.89c0-74.88 60.92-135.8 135.8-135.8a134.92 134.92 0 0 1 67.08 17.8l17.73-32.34a171.57 171.57 0 0 0-84.81-22.35c-95.19-.03-172.66 77.43-172.66 172.65zm308.49 0c0 74.88-60.92 135.8-135.8 135.8a135 135 0 0 1-64.14-16.14l-18.07 32.17a171.62 171.62 0 0 0 82.21 20.86c95.22 0 172.69-77.47 172.69-172.69a172.15 172.15 0 0 0-51-122.4l-25.12 27a135.35 135.35 0 0 1 39.23 95.4zm41.61 0c0 97.83-79.58 177.43-177.41 177.43a176.32 176.32 0 0 1-84.52-21.46l-18.18 32.36a213.21 213.21 0 0 0 102.7 26.23C630.74 726.11 727 629.87 727 511.57a213.87 213.87 0 0 0-64.38-153l-25.26 27.18a176.85 176.85 0 0 1 52.49 125.82zm-392 0A213.9 213.9 0 0 0 365 667.24L390.23 640A176.88 176.88 0 0 1 335 511.57c0-97.82 79.59-177.41 177.41-177.41a176.26 176.26 0 0 1 87.08 22.93l17.84-32.55A213.14 213.14 0 0 0 512.44 297c-118.3 0-214.54 96.28-214.54 214.57zm392.55-183-24.64 26.49a218.57 218.57 0 0 1 65.94 156.51c0 120.9-98.36 219.26-219.26 219.26a217.9 217.9 0 0 1-105-26.84l-18.24 32.47A255.43 255.43 0 0 0 512 768c141.39 0 256-114.64 256-256a255.23 255.23 0 0 0-77.55-183.41zm-397.27 183c0-120.9 98.36-219.26 219.26-219.26a217.84 217.84 0 0 1 107.19 28.09L637 288.65A254.46 254.46 0 0 0 516.12 256H512c-140.54.22-254.42 113.26-256 253.5v2.5a255.69 255.69 0 0 0 80.51 186.08l25.31-27.36a218.61 218.61 0 0 1-68.64-159.15z\"/></g></svg>"},"spotify":{"color":"#1DB954","svg":"<svg viewBox=\"0 0 24 24\" fill=\"#1DB954\"><path transform=\"translate(12 12) scale(.875) translate(-12 -12)\" d=\"M12 0C5.4 0 0 5.4 0 12s5.4 12 12 12 12-5.4 12-12S18.66 0 12 0zm5.521 17.34c-.24.359-.66.48-1.021.24-2.82-1.74-6.36-2.101-10.561-1.141-.418.122-.779-.179-.899-.539-.12-.421.18-.78.54-.9 4.56-1.021 8.52-.6 11.64 1.32.42.18.479.659.301 1.02zm1.44-3.3c-.301.42-.841.6-1.262.3-3.239-1.98-8.159-2.58-11.939-1.38-.479.12-1.02-.12-1.14-.6-.12-.48.12-1.021.6-1.141C9.6 9.9 15 10.561 18.72 12.84c.361.181.54.78.241 1.2zm.12-3.36C15.24 8.4 8.82 8.16 5.16 9.301c-.6.179-1.2-.181-1.38-.721-.18-.601.18-1.2.72-1.381 4.26-1.26 11.28-1.02 15.721 1.621.539.3.719 1.02.42 1.56-.299.421-1.02.599-1.559.3z\"/></svg>"},"apple":{"color":"#FA243C","svg":"<svg viewBox=\"0 0 24 24\" fill=\"#FA243C\"><path d=\"M17.05 12.04c-.03-2.5 2.04-3.7 2.13-3.76-1.16-1.7-2.97-1.93-3.61-1.96-1.54-.16-3 .9-3.78.9-.78 0-1.97-.88-3.24-.86-1.67.03-3.21.97-4.07 2.46-1.73 3.01-.44 7.47 1.24 9.92.82 1.2 1.8 2.54 3.08 2.49 1.24-.05 1.71-.8 3.21-.8 1.5 0 1.92.8 3.23.77 1.33-.02 2.18-1.22 3-2.42.94-1.39 1.33-2.73 1.35-2.8-.03-.01-2.59-.99-2.62-3.93zM14.6 4.59c.68-.83 1.14-1.97 1.01-3.11-.98.04-2.17.65-2.87 1.47-.63.73-1.18 1.9-1.03 3.02 1.09.08 2.21-.55 2.89-1.38z\"/></svg>"},"deezer":{"color":"#A238FF","svg":"<svg viewBox=\"0 0 24 24\"><path transform=\"translate(12 12) scale(.74) translate(-12 -12)\" d=\"M4 2h6v2h-6zM14 2h6v2h-6zM2 4h20v2h-20zM0 6h24v2h-24zM0 8h24v2h-24zM0 10h24v2h-24zM2 12h20v2h-20zM4 14h16v2h-16zM6 16h12v2h-12zM8 18h8v2h-8zM10 20h4v2h-4z\" fill=\"#A238FF\"/></svg>"},"tidal":{"color":"#000000","svg":"<svg viewBox=\"0 0 24 24\"><path d=\"M6 6l3 3-3 3-3-3zM12 6l3 3-3 3-3-3zM18 6l3 3-3 3-3-3zM12 12l3 3-3 3-3-3z\" style=\"fill:var(--mbu-text,currentColor)\"/></svg>"},"qobuz":{"color":"#0070ef","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#0070ef\"/><circle cx=\"12\" cy=\"12\" r=\"5\" fill=\"none\" stroke=\"#fff\" stroke-width=\"2.2\"/><path d=\"M14.5 14.5 19 19\" stroke=\"#fff\" stroke-width=\"2.2\" stroke-linecap=\"round\"/></svg>"},"beatport":{"color":"#01FF95","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"11\" fill=\"#000\"/><g transform=\"translate(12 12) scale(0.84) translate(-12 -12)\" fill=\"none\" stroke=\"#01FF95\" stroke-width=\"2.5\"><path d=\"M10.9 3V8.3c0 1.2-.4 1.9-1.1 2.6L5.6 15.1\"/><circle cx=\"13.9\" cy=\"15.8\" r=\"4.05\" stroke-width=\"2.35\"/></g></svg>"},"bandcamp":{"color":"#629AA9","svg":"<svg viewBox=\"0 0 24 24\" fill=\"#629AA9\"><path transform=\"translate(12 12) scale(.8) translate(-12 -12)\" d=\"M0 18.75l7.437-13.5H24l-7.438 13.5z\"/></svg>"},"volumo":{"color":"#7c4dff","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#7c4dff\"/><path d=\"M7 8h2.2l2.8 6 2.8-6H17l-4 9h-2z\" fill=\"#fff\"/></svg>"},"hdtracks":{"color":"#e63329","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#e63329\"/><path d=\"M5 7.5h1.7v3.1h2.6V7.5H11v8H9.3v-3.2H6.7v3.2H5zm7.2 0h2.9c2 0 3.4 1.6 3.4 4s-1.4 4-3.4 4h-2.9zm1.7 1.5v5h1.1c1.1 0 1.8-1 1.8-2.5s-.7-2.5-1.8-2.5z\" fill=\"#fff\"/></svg>"},"soundcloud":{"color":"#ff5500","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#ff5500\"/><g fill=\"#fff\"><rect x=\"6\" y=\"12\" width=\"1.4\" height=\"4\" rx=\".6\"/><rect x=\"8.5\" y=\"10\" width=\"1.4\" height=\"6\" rx=\".6\"/><rect x=\"11\" y=\"8.5\" width=\"1.4\" height=\"7.5\" rx=\".6\"/><rect x=\"13.5\" y=\"10.5\" width=\"1.4\" height=\"5.5\" rx=\".6\"/><rect x=\"16\" y=\"11.5\" width=\"1.4\" height=\"4.5\" rx=\".6\"/></g></svg>"},"audiomack":{"color":"#FFA200","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#FFA200\"/><path d=\"M5 13.5l2-2 1.6 2.4 2.2-5.4 2.4 6.6 2.2-4 1.6 2.4H19\" fill=\"none\" stroke=\"#fff\" stroke-width=\"1.6\" stroke-linejoin=\"round\" stroke-linecap=\"round\"/></svg>"},"ytmusic":{"color":"#FF0000","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#FF0000\"/><circle cx=\"12\" cy=\"12\" r=\"5.6\" fill=\"none\" stroke=\"#fff\" stroke-width=\"1.4\"/><path d=\"M10.4 9.5v5l4.2-2.5z\" fill=\"#fff\"/></svg>"},"amazonmusic":{"color":"#25D1DA","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#25D1DA\"/><path d=\"M5.8 11.2c3.5 3.2 8.9 3.5 12.4.9\" fill=\"none\" stroke=\"#0F1111\" stroke-width=\"1.9\" stroke-linecap=\"round\"/><path d=\"M15.5 10.7l3 1.3-.9 3.1\" fill=\"none\" stroke=\"#0F1111\" stroke-width=\"1.7\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/></svg>"},"soundexchange":{"color":"#6f42c1","svg":"<svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"10\" fill=\"#6f42c1\"/><path d=\"M6.5 12h1.3l1-3 1.6 6 1.6-9 1.6 12 1.4-6h1.5\" fill=\"none\" stroke=\"#fff\" stroke-width=\"1.4\" stroke-linejoin=\"round\" stroke-linecap=\"round\"/></svg>"},"globe":{"color":"#6f7d75","svg":"<svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#6f7d75\" stroke-width=\"1.8\"><circle cx=\"12\" cy=\"12\" r=\"9\"/><path d=\"M3 12h18M12 3a15 15 0 0 1 0 18M12 3a15 15 0 0 0 0 18\"/></svg>"}};
function stIcon(name, size) { var i = ST_ICONS[name]; if (!i) return ''; size = size || 16; return i.svg.replace(/<svg\b([^>]*)>/, function (m, a) { a = a.replace(/\s(?:width|height)="[^"]*"/g, ''); var ns = /\bxmlns=/.test(a) ? '' : ' xmlns="http://www.w3.org/2000/svg"'; return '<svg' + a + ns + ' width="' + size + '" height="' + size + '">'; }); }
function stColor(name) { return (ST_ICONS[name] && ST_ICONS[name].color) || ''; }
// </ST-ICONS>
// The shared design tokens (#562). Values live in dev/tokens/design-tokens.mjs and are
// inlined here by dev/tokens/sync-tokens.mjs — edit them THERE, never in this block.
// <ST-TOKENS> — generated by dev/tokens/sync-tokens.mjs from dev/tokens/design-tokens.mjs — DO NOT EDIT
const MBU_TOKENS = ':root{--mbu-bg:var(--background, #fff);--mbu-bg-raised:#faf9fe;--mbu-bg-raised:color-mix(in srgb, var(--mbu-bg) 96%, var(--mbu-accent));--mbu-bg-sunken:#f4f2f9;--mbu-bg-sunken:color-mix(in srgb, var(--mbu-bg) 94%, var(--mbu-text));--mbu-bg-hover:#f3eefe;--mbu-bg-hover:color-mix(in srgb, var(--mbu-bg) 91%, var(--mbu-accent));--mbu-text:var(--text, #222);--mbu-text-dim:#555;--mbu-text-dim:color-mix(in srgb, var(--mbu-text) 78%, var(--mbu-bg));--mbu-text-weak:#999;--mbu-text-weak:color-mix(in srgb, var(--mbu-text) 52%, var(--mbu-bg));--mbu-text-on-accent:#fff;--mbu-border:var(--border, #cfc6e6);--mbu-border-soft:#e2dcef;--mbu-border-strong:#9a8ccb;--mbu-border-strong:color-mix(in srgb, var(--mbu-border) 70%, var(--mbu-text));--mbu-divider:#eee;--mbu-divider:color-mix(in srgb, var(--mbu-bg) 92%, var(--mbu-text));--mbu-accent:#5f3ec0;--mbu-accent-hover:#4e329f;--mbu-accent-deep:#3b2c70;--mbu-accent-soft:#ece4ff;--mbu-accent-soft:color-mix(in srgb, var(--mbu-bg) 86%, var(--mbu-accent));--mbu-accent-fg:#fff;--mbu-accent-text:#5f3ec0;--mbu-accent-deep-text:#3b2c70;--mbu-ok:#1f9d6b;--mbu-ok:color-mix(in srgb, #1f9d6b 78%, var(--mbu-text));--mbu-ok-bg:#eef7f1;--mbu-ok-bg:color-mix(in srgb, var(--mbu-bg) 88%, var(--mbu-ok));--mbu-ok-border:#9bd3b6;--mbu-warn:#a05a00;--mbu-warn:color-mix(in srgb, #b4791f 78%, var(--mbu-text));--mbu-warn-bg:#fff7e6;--mbu-warn-bg:color-mix(in srgb, var(--mbu-bg) 88%, var(--mbu-warn));--mbu-warn-border:#f0c877;--mbu-error:#c0392b;--mbu-error:color-mix(in srgb, #d0473a 78%, var(--mbu-text));--mbu-error-bg:#fdecec;--mbu-error-bg:color-mix(in srgb, var(--mbu-bg) 90%, var(--mbu-error));--mbu-error-border:#e2a1a1;--mbu-info:#2f7fbf;--mbu-info:color-mix(in srgb, #3f8fd0 78%, var(--mbu-text));--mbu-info-bg:#eef4fb;--mbu-info-bg:color-mix(in srgb, var(--mbu-bg) 90%, var(--mbu-info));--mbu-info-border:#a9c8e6;--mbu-font:-apple-system,Segoe UI,Roboto,Arial,sans-serif;--mbu-font-mono:ui-monospace,SFMono-Regular,Consolas,Menlo,monospace;--mbu-fs:14px;--mbu-fs-sm:12px;--mbu-fs-xs:11px;--mbu-radius:6px;--mbu-radius-lg:10px;--mbu-shadow:0 1px 5px rgba(60,40,110,.07);--mbu-shadow-lg:0 8px 30px rgba(40,20,80,.3);--mbu-z-panel:30;--mbu-z-pop:99998;--mbu-z-modal:2147483000;--mbu-z-modal-panel:2147483001}:root[data-mbu-theme="dark"]{--mbu-bg:#1e1b24;--mbu-text:#e9e5f2;--mbu-border:#3b3548;--mbu-accent-text:#b9a7f0;--mbu-accent-deep-text:#a493e0}:root[data-mbu-theme="dark"][data-mbu-seed="theme"]{--mbu-bg:var(--background, #1e1b24);--mbu-text:var(--text, #e9e5f2);--mbu-border:var(--border, #3b3548)}';
// </ST-TOKENS>

// The shared UI components (#563). Definitions live in dev/ui/ui-components.mjs
// and are inlined here by dev/ui/sync-ui.mjs — edit them THERE, never here.
// <ST-UI> — generated by dev/ui/sync-ui.mjs from dev/ui/ui-components.mjs — DO NOT EDIT
const MBU_UI_CSS = '.mbu-help{font-size:12px;color:var(--mbu-accent-text);text-decoration:none;border:1px solid var(--mbu-border);border-radius:var(--mbu-radius);padding:1px 8px;white-space:nowrap;line-height:1.6;background:none}.mbu-help:hover{background:var(--mbu-bg-hover);border-color:var(--mbu-accent);text-decoration:none}h4>.mbu-help,.mbu-cfg-h>.mbu-help{margin-left:8px;flex:0 0 auto;font-weight:normal}#mbu-toast{position:fixed;left:50%;bottom:24px;transform:translateX(-50%);z-index:var(--mbu-z-pop);background:var(--mbu-accent-deep);color:var(--mbu-text-on-accent);padding:10px 16px;border-radius:9px;font:13px/1.35 var(--mbu-font);box-shadow:var(--mbu-shadow-lg);opacity:0;transition:opacity .2s;pointer-events:none;max-width:80vw;text-align:center;white-space:pre-wrap}#mbu-toast.mbu-toast-on{opacity:1}#mbu-toast.mbu-toast-act{pointer-events:auto}#mbu-toast .mbu-toast-btn{margin-left:10px;padding:2px 9px;border:1px solid currentColor;border-radius:5px;background:transparent;color:inherit;font:inherit;cursor:pointer}#mbu-toast .mbu-toast-btn:hover{background:rgba(255,255,255,.18)}#mbu-toast.mbu-toast-ok{background:var(--mbu-ok)}#mbu-toast.mbu-toast-warn{background:var(--mbu-warn)}#mbu-toast.mbu-toast-error{background:var(--mbu-error)}.mbu-cfg-h{display:flex;align-items:center;gap:8px;margin:0 0 10px;padding:0 0 9px;border-bottom:1px solid var(--mbu-border-soft);font:600 15px/1.3 var(--mbu-font);color:var(--mbu-text)}.mbu-cfg-ic{flex:0 0 auto;display:inline-flex;align-items:center;width:22px;height:22px}.mbu-cfg-ic img,.mbu-cfg-ic svg{width:22px;height:22px;object-fit:contain;display:block}.mbu-cfg-name{flex:0 0 auto;font-weight:700;color:var(--mbu-accent-text)}.mbu-cfg-ver{flex:0 0 auto;font:400 11px var(--mbu-font);color:var(--mbu-text-weak);white-space:nowrap}.mbu-cfg-sp{flex:1 1 auto;min-width:8px}.mbu-cfg-log{flex:0 0 auto;font:400 12px var(--mbu-font);color:var(--mbu-accent-text);cursor:pointer;background:none;border:1px solid transparent;border-radius:var(--mbu-radius);padding:1px 8px;line-height:1.6}.mbu-cfg-log:hover{background:var(--mbu-bg-hover);border-color:var(--mbu-border)}#mbu-logpop{position:fixed;top:74px;left:50%;transform:translateX(-50%);z-index:var(--mbu-z-modal);display:flex;flex-direction:column;width:min(720px,94vw);max-height:72vh;background:var(--mbu-bg);border:1px solid var(--mbu-border);border-radius:11px;box-shadow:var(--mbu-shadow-lg);font:13px var(--mbu-font);color:var(--mbu-text);overflow:hidden}.mbu-logpop-h{display:flex;align-items:center;gap:8px;padding:10px 13px;border-bottom:1px solid var(--mbu-border-soft);color:var(--mbu-accent-text);cursor:move;user-select:none}.mbu-logpop-sp{margin-left:auto}.mbu-logpop-clear,.mbu-logpop-copy,.mbu-logpop-x,.mbu-logpop-min{font-size:12px;color:var(--mbu-accent-text);background:var(--mbu-bg-hover);border:1px solid var(--mbu-border);border-radius:5px;padding:2px 9px;cursor:pointer;font-family:inherit}.mbu-logpop-clear:hover,.mbu-logpop-copy:hover,.mbu-logpop-x:hover,.mbu-logpop-min:hover{background:var(--mbu-accent-soft)}#mbu-logpop.min .mbu-log-list,#mbu-logpop.min .mbu-logpop-clear,#mbu-logpop.min .mbu-logpop-copy,#mbu-logpop.min .mbu-logpop-x{display:none}#mbu-logpop.min{max-height:none;width:auto}#mbu-logpop.min .mbu-logpop-sp{display:none}.mbu-log-badge{color:var(--mbu-border-strong);font-size:11px}.mbu-log-list{flex:1 1 auto;overflow:auto;overscroll-behavior:contain;padding:9px 13px;display:flex;flex-direction:column;gap:3px}.mbu-log-li{display:flex;gap:9px;white-space:pre-wrap;word-break:break-word}.mbu-log-t{color:var(--mbu-text-weak);flex:0 0 auto;font-variant-numeric:tabular-nums}.mbu-log-m{flex:1 1 auto;color:var(--mbu-text-dim)}#mbu-logpop .mbu-log-m a{color:var(--mbu-accent-text)}.mbu-log-ok .mbu-log-m{color:var(--mbu-ok)}.mbu-log-warn .mbu-log-m{color:var(--mbu-warn)}.mbu-log-error .mbu-log-m{color:var(--mbu-error)}.mbu-log-debug{opacity:.85}.mbu-log-debug .mbu-log-m{color:var(--mbu-text-weak)}.mbu-log-empty{color:var(--mbu-text-weak)}.mbu-ov{position:fixed;inset:0;z-index:var(--mbu-z-modal);background:rgba(15,12,28,.45);display:flex;align-items:center;justify-content:center;padding:24px}.mbu-ov-panel{background:var(--mbu-bg);color:var(--mbu-text);border-radius:var(--mbu-radius-lg);box-shadow:var(--mbu-shadow-lg);max-width:94vw;max-height:88vh;display:flex;flex-direction:column;overflow:hidden}.mbu-ov-h{display:flex;align-items:center;gap:10px;padding:12px 16px;border-bottom:1px solid var(--mbu-border-soft);font-weight:700}.mbu-ov-h .mbu-ov-title{flex:1 1 auto;min-width:0}.mbu-ov-x{flex:0 0 auto;width:26px;height:26px;display:inline-flex;align-items:center;justify-content:center;font-size:15px;line-height:1;cursor:pointer;color:var(--mbu-text-dim);background:none;border:none;border-radius:var(--mbu-radius)}.mbu-ov-x:hover{background:var(--mbu-bg-hover);color:var(--mbu-text)}.mbu-ov-body{flex:1 1 auto;overflow:auto;padding:14px 16px}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) ::placeholder{color:var(--mbu-text-weak);opacity:1;font-style:italic}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu){color:var(--mbu-text)}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) :is(table,td,th,div,span,label)[style*=background]{color:var(--mbu-text)}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) input:not(:where([type=checkbox],[type=radio],[type=range],[type=color],[type=file])),:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) textarea,:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) select{background:var(--mbu-bg-sunken);color:var(--mbu-text);border-color:var(--mbu-border)}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) input:focus-visible,:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) textarea:focus-visible,:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) select:focus-visible{outline:2px solid var(--mbu-accent);outline-offset:1px}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) :where(input[type=checkbox],input[type=radio],input[type=range]){accent-color:var(--mbu-accent)}:root[data-mbu-theme=dark] :where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu){color-scheme:dark;--invert-value:none;--invert:none}:where(.mbu-ov,.mbu-ui,#mbu-logpop,.discogs-bar,.discogs-review-panel-li,#as-root,#as-setup,.as-pop,#as-switch-wrap,#ii-btn,.fs-launch,#tc-bar,#tc-nav-bar,#tc-settings,#tc-anno-wrap,.tc-panel,.tc-toolcfg,.tc-acpop,.tc-recpop,.tc-lppop,.tc-tpppop,.tc-tpp-mpop,.tc-anno-help-pop,.tc-mirror,.tc-addrow,.tc-medopts,.tc-tools,#tc-recwrap,#tc-ri-toolbar,.tc-fmt-flat,.gt-toolbar,.gt-cons,.gt-menu,.gt-pop,.gt-cfg-pop,.gt-wm-pop,#ii-modal,#ii-sxpanel,#mb-pc-panel,#mb-provider-modal-card,.fs-cons,#fs-settings,.fs-overlay,.mmth-pop,.mmth-cfg,.mmth-side,.mmth-pinbar,.mmthf-pop,.mmthf-bar,#falcon-panel,#falcon-launcher,#falcon-item-popup,#falcon-add-page,.falcon-bar,.falcon-addmenu) button{background-color:var(--mbu-bg-raised);color:var(--mbu-text);border-color:var(--mbu-border)}.mbu-compact .mbu-bt{display:none}:is(.mbu-video,body.tc-ri-on #external-links-editor tr.relationship-item .attribute-container input){-webkit-appearance:none;-moz-appearance:none;appearance:none;width:18px;height:18px;margin:0;border:none;border-radius:3px;cursor:pointer;background:transparent url("data:image/svg+xml,%3Csvg%20xmlns=%27http://www.w3.org/2000/svg%27%20viewBox=%270%200%2016%2016%27%20fill=%27%23888%27%3E%3Crect%20x=%271%27%20y=%273.5%27%20width=%2710%27%20height=%279%27%20rx=%271.5%27/%3E%3Cpath%20d=%27M11.5%207L15%204.8v6.4L11.5%209z%27/%3E%3C/svg%3E") center/13px no-repeat;opacity:.45;box-shadow:none;flex:0 0 auto;vertical-align:middle}:is(.mbu-video,body.tc-ri-on #external-links-editor tr.relationship-item .attribute-container input):hover{opacity:1}:is(.mbu-video,body.tc-ri-on #external-links-editor tr.relationship-item .attribute-container input):checked{opacity:1;background-color:var(--mbu-accent);background-image:url("data:image/svg+xml,%3Csvg%20xmlns=%27http://www.w3.org/2000/svg%27%20viewBox=%270%200%2016%2016%27%20fill=%27%23fff%27%3E%3Crect%20x=%271%27%20y=%273.5%27%20width=%2710%27%20height=%279%27%20rx=%271.5%27/%3E%3Cpath%20d=%27M11.5%207L15%204.8v6.4L11.5%209z%27/%3E%3C/svg%3E")}:is(.mbu-video,body.tc-ri-on #external-links-editor tr.relationship-item .attribute-container input):focus-visible{outline:1px solid var(--mbu-accent);outline-offset:1px}:is(.mbu-video,body.tc-ri-on #external-links-editor tr.relationship-item .attribute-container input):disabled{cursor:default;opacity:.3}';
// Help link markup. Every script's help link is this, pointing at its own README.
// `name` is the userscript folder, e.g. mbuHelpHref('art_station').
function mbuHelpHref(name) {
    return 'https://github.com/majkinetor/musicbrainz-userscripts/blob/main/userscripts/' + name + '/README.md';
}
function mbuHelpHtml(name, label) {
    return '<a class="mbu-help" href="' + mbuHelpHref(name) + '" target="_blank" rel="noopener"'
        + ' title="open the README in a new tab">' + (label || '? Help') + '</a>';
}
function mbuHelpEl(name, label) {
    var a = document.createElement('a');
    a.className = 'mbu-help';
    a.href = mbuHelpHref(name);
    a.target = '_blank';
    a.rel = 'noopener';
    a.title = 'open the README in a new tab';
    a.textContent = label || '? Help';
    return a;
}

// The config (settings) icon every script's settings button shows: the gear in text
// presentation (U+FE0E), so it takes the button's colour instead of an emoji's. #650
var MBU_CFG_ICON = '\u2699\uFE0E';

// HTML for an innerHTML on a page that enforces Trusted Types (YouTube Music, #650): there a
// plain string is refused ("This document requires 'TrustedHTML' assignment"). The policy
// passes the string through; the markup is the script's own. Elsewhere it is the string.
var _mbuTT;
function mbuHtml(s) {
    if (_mbuTT === undefined) {
        _mbuTT = null;
        try {
            var tt = (typeof window !== 'undefined' && window.trustedTypes) || null;
            if (tt && tt.createPolicy) _mbuTT = tt.createPolicy('mbu-' + Math.random().toString(36).slice(2, 8), { createHTML: function (x) { return x; } });
        } catch (e) { /* the page allows no new policy: plain strings, as before */ }
    }
    return _mbuTT ? _mbuTT.createHTML(String(s)) : String(s);
}

// The first line of every script's log: the script, its version, and what runs it, so a
// pasted log says which manager and browser it came from (#282 started it in Art Station):
//   Log.info(mbuStartupInfo('Fusion'));
//   -> Fusion v2026.10.1 · Violentmonkey 2.31.0 · firefox 143.0 (win)
// Inside String Theory GM_info describes the bundle, so the line names it:
//   -> Fusion (String Theory v2026.10.1) · Tampermonkey 5.3.3 · chrome 140.0 (win)
function mbuStartupInfo(name) {
    var g = null;
    try { g = (typeof GM_info !== 'undefined' && GM_info) || null; } catch (e) { /* no GM_info */ }
    var s = (g && g.script) || {}, p = (g && g.platform) || {};
    var host = String(s.name || '').replace(/\*$/, ''), ver = s.version || '?';
    var line = !name ? (host || 'Script') + ' v' + ver
        : (host && host !== name) ? name + ' (' + host + ' v' + ver + ')'
        : name + ' v' + ver;
    if (g) line += ' · ' + (g.scriptHandler || 'unknown manager') + (g.version ? ' ' + g.version : '');
    if (p.browserName) line += ' · ' + p.browserName + (p.browserVersion ? ' ' + p.browserVersion : '') + (p.os ? ' (' + p.os + ')' : '');
    else { try { line += ' · ' + navigator.userAgent; } catch (e) { /* no navigator */ } }
    return line;
}

// One copy per page (#653). With String Theory and a standalone install of the same script
// both on, two copies build the same element ids and fight over them: each settings window
// fills in the other's checkboxes, rows flip between two rule sets. So one copy runs, the
// one with the higher version, and the other stays off without a word; only the running
// copy notes it in its log (majkinetor: "disable copy that has lower version without any
// info (except in log of active copy)"):
//   if (!mbuClaim('platform_check', 'Platform Check')) return;   // first line of the script
// The claim is a data- attribute on <html>, which every copy sees whatever its sandbox.
// It is decided at once, so no script starts late. The copy that starts first takes the
// page. When it is the older one, the newer copy stays off for this page and leaves a note
// in localStorage, and from the next page load the older copy finds the note and steps
// aside. A note whose copy has gone (uninstalled) is cleared by the older copy after the
// page loads, so it runs again from the load after.
function mbuClaimVer(v) {
    return String(v || '').split('.').map(function (n) { return parseInt(n, 10) || 0; });
}
function mbuClaimCmp(a, b) {
    var x = mbuClaimVer(a), y = mbuClaimVer(b);
    for (var i = 0; i < Math.max(x.length, y.length); i++) { var d = (x[i] || 0) - (y[i] || 0); if (d) return d < 0 ? -1 : 1; }
    return 0;
}
function mbuClaim(key, label) {
    var info = (typeof GM_info !== 'undefined' && GM_info && GM_info.script) || {};
    var name = String(info.name || label || key), ver = String(info.version || '0');
    var mine = (name.slice(-1) === '*' ? 'String Theory' : 'standalone') + ' v' + ver;
    var root = document.documentElement, attr = 'data-mbu-run-' + key, ev = 'mbu-claim-' + key, noteKey = 'mbu-newer-' + key;
    var log = function (msg) { try { if (typeof mbuLog !== 'undefined' && mbuLog.active) mbuLog.active.info(msg); else if (typeof mbuToast !== 'undefined' && typeof mbuToast.log === 'function') mbuToast.log('info', msg); else console.info('[' + (label || key) + '] ' + msg); } catch (e) { /* no log */ } };
    var note = null;
    try { note = JSON.parse(localStorage.getItem(noteKey) || 'null'); } catch (e) { /* storage blocked */ }
    if (note && mbuClaimCmp(note.ver, ver) <= 0) { try { localStorage.removeItem(noteKey); } catch (e) { /* storage blocked */ } note = null; }
    var held = root && root.getAttribute(attr);
    var off = function (why) {
        // tell the running copy (any sandbox hears a DOM event), or the copy that runs after
        // this one (it reads the attribute), and stay quiet
        try { if (root) root.setAttribute(attr + '-off', JSON.stringify({ mine: mine, why: why })); } catch (e) { /* no attribute */ }
        try { document.dispatchEvent(new CustomEvent(ev, { detail: JSON.stringify({ mine: mine, ver: ver, why: why }) })); } catch (e) { /* no event */ }
        return false;
    };
    if (held) {
        var heldVer = (root.getAttribute(attr + '-ver') || '0');
        if (mbuClaimCmp(ver, heldVer) > 0) {
            try { localStorage.setItem(noteKey, JSON.stringify({ ver: ver, mine: mine, at: Date.now() })); } catch (e) { /* storage blocked */ }
            return off('newer, from the next page load');
        }
        return off('older or the same');
    }
    if (note) {
        // a newer copy said it is installed: leave the page to it, unless it never shows up
        var watch = function () {
            setTimeout(function () {
                if (root.getAttribute(attr)) return;
                try { localStorage.removeItem(noteKey); } catch (e) { /* storage blocked */ }
                try { console.info('[' + (label || key) + '] the newer copy (' + note.mine + ') did not start: this copy runs again from the next page load'); } catch (e) { /* no console */ }
            }, 3000);
        };
        if (document.readyState === 'complete') watch(); else window.addEventListener('load', watch, { once: true });
        return off('older: a newer copy runs');
    }
    if (root) { root.setAttribute(attr, mine); root.setAttribute(attr + '-ver', ver); }
    var told = function (o) {
        log((label || key) + ' is installed twice: ' + mine + ' runs, ' + (o.mine || 'another copy') + ' is switched off'
            + (o.why === 'newer, from the next page load' ? ' for this page (it is newer and runs from the next page load)' : '') + '.');
    };
    document.addEventListener(ev, function (e) { var o = {}; try { o = JSON.parse(e.detail); } catch (x) { /* not ours */ } told(o); });
    // a copy that stepped aside before this one started (it found a note): log it once the script's log is up
    var before = root && root.getAttribute(attr + '-off');
    if (before) setTimeout(function () { var o = {}; try { o = JSON.parse(before); } catch (x) { /* not ours */ } told(o); }, 0);
    return true;
}

// Toast. mbuToast(msg) or mbuToast(msg, { ms, kind, at:{x,y}, action:{ label, onClick } }).
//
// An action adds one button to the toast (e.g. "Copy log"): the toast is then clickable,
// stays up longer (12 s unless ms says otherwise), and closes when the button is used.
//
// Severity is inferred from a leading warning/tick glyph when not given — Art
// Station already did that and it is why its toasts reached its log with the
// right level. Set mbuToast.log = function (level, message) {...} once at
// startup and every toast mirrors into that script's own log; leave it unset
// and the toast still shows.
var _mbuToastT = null;
function mbuToast(msg, opts) {
    opts = opts || {};
    var s = String(msg);
    var kind = opts.kind || (/^\s*[⚠✗×]/.test(s) ? 'warn' : /[✓✅]/.test(s) ? 'ok' : 'info');
    try {
        if (typeof mbuToast.log === 'function') mbuToast.log(kind, s.replace(/^\s*[⚠✗×✓✅]\s*/, ''));
    } catch (e) { /* a broken log sink must never swallow the toast */ }
    var el = document.getElementById('mbu-toast');
    if (!el) {
        el = document.createElement('div');
        el.id = 'mbu-toast';
        (document.body || document.documentElement).appendChild(el);
    }
    el.className = 'mbu-toast-on' + (kind !== 'info' ? ' mbu-toast-' + kind : '') + (opts.action ? ' mbu-toast-act' : '');
    el.textContent = s;
    if (opts.action) {
        var b = document.createElement('button');
        b.type = 'button'; b.className = 'mbu-toast-btn'; b.textContent = opts.action.label || 'OK';
        b.onclick = function () {
            try { if (opts.action.onClick) opts.action.onClick(b); } catch (e) { /* the toast still closes */ }
            clearTimeout(_mbuToastT); _mbuToastT = setTimeout(function () { el.className = ''; }, 900);
        };
        el.appendChild(b);
    }
    // Anchor above a click point when asked, clamped into the viewport; otherwise
    // fall back to the centred default by clearing the inline placement.
    if (opts.at) {
        var w = el.offsetWidth, h = el.offsetHeight;
        el.style.left = Math.max(6, Math.min(window.innerWidth - w - 6, opts.at.x - w / 2)) + 'px';
        el.style.top = Math.max(6, Math.min(window.innerHeight - h - 6, opts.at.y - h - 10)) + 'px';
        el.style.bottom = 'auto';
        el.style.transform = 'none';
    } else {
        el.style.left = ''; el.style.top = ''; el.style.bottom = ''; el.style.transform = '';
    }
    clearTimeout(_mbuToastT);
    _mbuToastT = setTimeout(function () { el.className = ''; }, opts.ms || (opts.action ? 12000 : 2600));
    return el;
}

// Config-window title bar.
//
//   mbuCfgHeader({ script:'art_station', name:'Art Station', version:'2026.9.2',
//                  icon:'<svg…>' | '<img…>', log:true, logClass:'as-setup-logbtn' })
//
// Returns the markup for the whole bar. 'log' adds the Log button; a script with
// no log window leaves it out rather than shipping a dead control. logClass /
// logId are carried through IN ADDITION to the shared class so a script's
// existing click handler keeps working — adopting the component must not mean
// rewiring every listener at the same time.
function mbuCfgHeader(o) {
    o = o || {};
    var esc = function (s) {
        return String(s == null ? '' : s).replace(/[&<>"]/g, function (c) {
            return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c];
        });
    };
    var html = '<div class="mbu-cfg-h">';
    if (o.icon) html += '<span class="mbu-cfg-ic">' + o.icon + '</span>';
    html += '<span class="mbu-cfg-name">' + esc(o.name) + '</span>';
    if (o.version) html += '<span class="mbu-cfg-ver" title="installed script version">v' + esc(o.version) + '</span>';
    html += '<span class="mbu-cfg-sp"></span>';
    if (o.log) {
        html += '<button type="button" class="mbu-cfg-log' + (o.logClass ? ' ' + esc(o.logClass) : '') + '"'
            + (o.logId ? ' id="' + esc(o.logId) + '"' : '')
            + ' title="Open the activity log">Log</button>';
    }
    html += mbuHelpHtml(o.script);
    return html + '</div>';
}

// Test hooks. A script puts its test hook on window only when the test harness has
// marked the page (dev/test/harness.mjs sets window.__mbuTest before any script runs):
//   if (mbuTestHooks()) window.__fooTest = { … };
// On a user's page the hooks are never built. (#623)
function mbuTestHooks() {
    try { return typeof window !== 'undefined' && window.__mbuTest === true; } catch (e) { return false; }
}

// Corner slots (#468). Every floating launcher (Apollo Editor, Art Station, Falcon,
// Fusion, Scribe) tags its element with data-mb-corner (which screen corner: 'br',
// 'bl', 'tr', 'tl') and data-mb-corner-order (lower sits closer to the corner), and
// calls mbRestackCorner(corner) right after it shows, hides, creates or removes it.
// That recomputes every element in the corner, whichever script owns it and
// whatever order they loaded in, so two launchers never land on the same pixel.
// Orders in use: Apollo and Art Station 10 (never on the same page), Falcon 20,
// Fusion above Falcon. Scribe is not on the shared block and keeps a copy of this.
function mbRestackCorner(corner) {
    var bottom = corner[0] === 'b', right = corner[1] === 'r';
    var els = Array.prototype.slice.call(document.querySelectorAll('[data-mb-corner="' + corner + '"]'))
        // offsetParent is always null for position:fixed, so it can't tell visibility here
        .filter(function (el) { return getComputedStyle(el).display !== 'none'; })
        .sort(function (a, b) { return (Number(a.dataset.mbCornerOrder) || 0) - (Number(b.dataset.mbCornerOrder) || 0); });
    var pos = 14;
    els.forEach(function (el) {
        el.style[bottom ? 'bottom' : 'top'] = pos + 'px';
        el.style[right ? 'right' : 'left'] = '14px';
        pos += el.getBoundingClientRect().height + 8;
    });
}

// Activity log: the session's log lines plus the floating window that shows them
// (#283's viewer, shared since X12 of #623). A script makes its log once:
//
//   var LOG = mbuLog({ name: 'Fusion', version: VERSION, key: 'fusion.logwin' });
//   LOG.info('…'); LOG.warn(…); LOG.err(…) (or .error); LOG.ok(…); LOG.debug(…)
//   LOG.open(); LOG.close(); LOG.reopen()   // reopen: only if it was left open
//   LOG.markdown(); LOG.copy(btn); LOG.clear(); LOG.lines(); LOG.messages(); LOG.counts()
//
// o.name / o.version  the Markdown summary's title (version may be a function)
// o.subtitle          optional function; its text follows the title (e.g. the release)
// o.header            the window's title (default 'Activity log')
// o.key               storage key for the window's open/minimised/position state
// o.load / o.save     that storage (default GM_getValue / GM_setValue)
// o.before            called before the window opens (e.g. to inject the script's CSS)
// o.max               lines kept (default 20000: about 4 MB; 2000 dropped a long session's start)
//
// A long run keeps only the last o.max lines, and the Markdown says how many went
// before them; the copies this replaced grew for the whole session. An open
// window appends each new line and drops the oldest row past the cap; the copies
// rebuilt the whole list with innerHTML on every line, which is quadratic over a
// long matching run.
function mbuLog(o) {
    o = o || {};
    var max = o.max || 20000, buf = [], dropped = 0, warn = 0, error = 0, win = null;
    var pad = function (n, w) { return String(n).padStart(w || 2, '0'); };
    var ts = function (d) { return pad(d.getHours()) + ':' + pad(d.getMinutes()) + ':' + pad(d.getSeconds()) + '.' + pad(d.getMilliseconds(), 3); };
    var str = function (v) {
        if (typeof v === 'string') return v;
        if (v instanceof Error) return v.message || String(v);
        if (v && v.nodeType) return '<' + (v.tagName || 'node').toLowerCase() + '>';
        try { return typeof v === 'object' ? JSON.stringify(v) : String(v); } catch (e) { return String(v); }
    };
    var esc = function (s) {
        return String(s).replace(/[&<>"]/g, function (c) { return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]; });
    };
    // escape, then make http(s) URLs clickable, keeping trailing punctuation out of them
    var linkify = function (s) {
        return esc(s).replace(/(https?:\/\/[^\s<]+)/g, function (m) {
            var t = (m.match(/[.,;:!?)\]]+$/) || [''])[0];
            var url = m.slice(0, m.length - t.length);
            return '<a href="' + url + '" target="_blank" rel="noopener">' + url + '</a>' + t;
        });
    };
    var load = o.load || function (k) { try { return GM_getValue(k, undefined); } catch (e) { return undefined; } };
    var save = o.save || function (k, v) { try { GM_setValue(k, v); } catch (e) { /* no storage: the window just forgets */ } };
    var state = function () { try { return JSON.parse(load(o.key) || '{}') || {}; } catch (e) { return {}; } };
    var remember = function (patch) { try { save(o.key, JSON.stringify(Object.assign(state(), patch))); } catch (e) { /* see save */ } };
    var tally = function (e, d) { if (e.sev === 'warn') warn += d; else if (e.sev === 'error') error += d; };
    var PRE = { info: '', ok: 'OK   ', warn: 'WARN ', error: 'ERR  ', debug: 'DBG  ' };
    var line = function (e) { return ts(e.t) + '  ' + (PRE[e.sev] || '') + e.msg; };

    function add(sev, args) {
        var msg = Array.prototype.map.call(args, str).join(' ').replace(/\s+/g, ' ').trim();
        if (!msg) return;
        var e = { t: new Date(), sev: sev === 'err' ? 'error' : sev, msg: msg };
        buf.push(e); tally(e, 1);
        // trim in chunks, not one shift per line
        if (buf.length > max + Math.ceil(max / 10)) {
            var gone = buf.splice(0, buf.length - max);
            gone.forEach(function (g) { tally(g, -1); });
            dropped += gone.length;
        }
        if (win) win.append(e);
    }
    function title() {
        var v = typeof o.version === 'function' ? (function () { try { return o.version(); } catch (e) { return ''; } })() : o.version;
        var t = (o.name || 'Log') + (v ? ' v' + v : '');
        try { var s = o.subtitle && o.subtitle(); if (s) t += ' — ' + s; } catch (e) { /* no subtitle */ }
        return t;
    }
    function markdown() {
        var body = buf.length ? buf.map(line).join('\n') : '(no activity logged)';
        if (dropped) body = '(' + dropped + ' earlier line' + (dropped === 1 ? '' : 's') + ' not kept)\n' + body;
        var n = (warn || error) ? ' (' + warn + ' warning' + (warn === 1 ? '' : 's') + ', ' + error + ' error' + (error === 1 ? '' : 's') + ')' : '';
        var fence = String.fromCharCode(96, 96, 96);
        return '<details><summary>' + title() + ' — session log' + n + '</summary>\n\n' + fence + 'log\n' + body + '\n' + fence + '\n\n</details>';
    }
    function copy(btn) {
        var md = markdown();
        var done = function (ok) {
            if (!btn) return;
            var was = btn.dataset.lbl || btn.textContent; btn.dataset.lbl = was;
            btn.textContent = ok ? 'Copied ✓' : 'Copy failed';
            setTimeout(function () { btn.textContent = was; }, 1500);
        };
        var fallback = function () {
            var ok = false;
            try {
                var ta = document.createElement('textarea'); ta.value = md; ta.style.position = 'fixed'; ta.style.opacity = '0';
                document.body.appendChild(ta); ta.select(); ok = document.execCommand('copy'); ta.remove();
            } catch (x) { /* nothing left to try */ }
            done(ok);
        };
        try { navigator.clipboard.writeText(md).then(function () { done(true); }, fallback); } catch (e) { fallback(); }
    }
    function open() {
        close(true);
        if (typeof o.before === 'function') { try { o.before(); } catch (e) { /* the window still opens */ } }
        remember({ open: true });
        var st = state();
        var pop = document.createElement('div'); pop.id = 'mbu-logpop'; pop.className = 'mbu-logpop';
        pop.innerHTML = mbuHtml('<div class="mbu-logpop-h"><b>' + esc(o.header || 'Activity log') + '</b> <span class="mbu-log-badge"></span><span class="mbu-logpop-sp"></span>'
            + '<button class="mbu-logpop-clear" type="button" title="Clear the log (the lines so far are gone)">Clear</button>'
            + '<button class="mbu-logpop-copy" type="button" title="Copy as Markdown (paste into a GitHub issue)">⧉ Copy</button>'
            + '<button class="mbu-logpop-min" type="button" title="Minimize">–</button>'
            + '<button class="mbu-logpop-x" type="button" title="Close">✕</button></div>'
            + '<div class="mbu-log-list"></div>');
        document.body.appendChild(pop);
        if (st.left != null) { pop.style.left = st.left; pop.style.top = st.top; pop.style.right = 'auto'; pop.style.transform = 'none'; }
        var restore = { left: pop.style.left, top: pop.style.top, right: pop.style.right, bottom: pop.style.bottom, transform: pop.style.transform };
        var list = pop.querySelector('.mbu-log-list'), badge = pop.querySelector('.mbu-log-badge');
        var row = function (e) {
            var d = document.createElement('div');
            d.className = 'mbu-log-li mbu-log-' + e.sev;
            d.innerHTML = mbuHtml('<span class="mbu-log-t">' + ts(e.t) + '</span><span class="mbu-log-m">' + linkify(e.msg) + '</span>');
            return d;
        };
        var showBadge = function () { badge.textContent = '(' + buf.length + ')' + (warn || error ? ' · ' + warn + '⚠ ' + error + '✖' : ''); };
        // the rows, once; later lines are appended one by one
        var frag = document.createDocumentFragment();
        buf.forEach(function (e) { frag.appendChild(row(e)); });
        if (buf.length) list.appendChild(frag);
        else list.innerHTML = mbuHtml('<div class="mbu-log-empty">No activity yet.</div>');
        showBadge();
        list.scrollTop = list.scrollHeight;
        // badge and scroll once per frame, however many lines arrive in it
        var queued = false, follow = true;
        list.addEventListener('scroll', function () { follow = list.scrollHeight - list.scrollTop - list.clientHeight < 40; });
        var paint = function () { queued = false; showBadge(); if (follow) list.scrollTop = list.scrollHeight; };
        var onKey = function (e) { if (e.key === 'Escape') close(); };
        win = {
            el: pop,
            append: function (e) {
                var empty = list.querySelector('.mbu-log-empty'); if (empty) empty.remove();
                list.appendChild(row(e));
                while (list.childElementCount > buf.length) list.firstElementChild.remove();
                if (!queued) { queued = true; requestAnimationFrame(paint); }
            },
            off: function () { document.removeEventListener('keydown', onKey); },
            cleared: function () { list.innerHTML = mbuHtml('<div class="mbu-log-empty">No activity yet.</div>'); showBadge(); },
        };
        pop.querySelector('.mbu-logpop-clear').onclick = function () { clear(); };
        pop.querySelector('.mbu-logpop-copy').onclick = function () { copy(pop.querySelector('.mbu-logpop-copy')); };
        var minBtn = pop.querySelector('.mbu-logpop-min');
        var setMin = function (m) {
            minBtn.textContent = m ? '▢' : '–'; minBtn.title = m ? 'Restore' : 'Minimize';
            if (m) { pop.style.left = '14px'; pop.style.bottom = '14px'; pop.style.top = 'auto'; pop.style.right = 'auto'; pop.style.transform = 'none'; }   // dock to the bottom
            else Object.assign(pop.style, restore);
        };
        minBtn.onclick = function () { var m = pop.classList.toggle('min'); setMin(m); remember({ min: m }); };
        if (st.min) { pop.classList.add('min'); setMin(true); }
        pop.querySelector('.mbu-logpop-x').onclick = function () { close(); };
        // floating and non-modal: dragged by its header
        pop.querySelector('.mbu-logpop-h').addEventListener('mousedown', function (e) {
            if (e.target.closest('button')) return;
            e.preventDefault();
            var r = pop.getBoundingClientRect();
            pop.style.left = r.left + 'px'; pop.style.top = r.top + 'px'; pop.style.right = 'auto'; pop.style.transform = 'none';
            var ox = e.clientX - r.left, oy = e.clientY - r.top;
            var mv = function (ev) {
                pop.style.left = Math.max(0, Math.min(window.innerWidth - pop.offsetWidth, ev.clientX - ox)) + 'px';
                pop.style.top = Math.max(0, Math.min(window.innerHeight - 36, ev.clientY - oy)) + 'px';
            };
            var up = function () {
                document.removeEventListener('mousemove', mv); document.removeEventListener('mouseup', up);
                if (!pop.classList.contains('min')) {
                    restore = { left: pop.style.left, top: pop.style.top, right: 'auto', bottom: '', transform: 'none' };
                    remember({ left: pop.style.left, top: pop.style.top });
                }
            };
            document.addEventListener('mousemove', mv); document.addEventListener('mouseup', up);
        });
        document.addEventListener('keydown', onKey);
        return pop;
    }
    // empty the log: the lines, the counts and the "earlier lines not kept" note
    function clear() {
        buf = []; dropped = 0; warn = 0; error = 0;
        if (win) win.cleared();
    }
    // quiet: closing to reopen, so the remembered "open" stays as it is
    function close(quiet) {
        var stray = document.getElementById('mbu-logpop');
        if (win) { win.off(); win.el.remove(); win = null; if (!quiet) remember({ open: false }); }
        if (stray) stray.remove();   // another script's window: one log window at a time
    }
    var api = {
        info: function () { add('info', arguments); },
        warn: function () { add('warn', arguments); },
        err: function () { add('error', arguments); },
        error: function () { add('error', arguments); },
        ok: function () { add('ok', arguments); },
        debug: function () { add('debug', arguments); },
        add: function (sev) { add(sev, Array.prototype.slice.call(arguments, 1)); },
        open: open,
        close: function () { close(); },
        reopen: function () { if (state().open) open(); },
        isOpen: function () { return !!win; },
        markdown: markdown,
        copy: copy,
        clear: clear,
        lines: function () { return buf.map(line); },
        messages: function () { return buf.map(function (e) { return e.msg; }); },
        counts: function () { return { warn: warn, error: error }; },
    };
    mbuLog.active = api;   // the script's own log, for helpers that note things in it (mbuClaim)
    return api;
}

// Dismiss-on-outside-click, with the trailing click SWALLOWED.
//
//   var off = mbuDismissOn(popoverEl, close);   // off() to detach early
//
// #305: a popover torn down on mousedown removes what was under the cursor, so
// the click that follows lands on whatever the page reflowed into that spot and
// activates it. Tearing down on click instead just moves the problem. So: close
// on outside mousedown, then eat exactly one click in the capture phase. This is
// the single most repeated interaction bug in these scripts and it belongs in
// one place — it is why #563 says interaction is part of the contract.
//
// Esc closes too, innermost first: the handler is registered in capture and stops
// propagation, so a popover inside a modal does not close the modal as well.
function mbuDismissOn(el, close, opts) {
    opts = opts || {};
    var closed = false;
    var onDown = function (e) {
        if (closed || !el || el.contains(e.target)) return;
        if (opts.ignore && e.target.closest && e.target.closest(opts.ignore)) return;
        finish();
        // swallow the click this mousedown will produce, once
        var eat = function (ev) { ev.stopPropagation(); ev.preventDefault(); document.removeEventListener('click', eat, true); };
        document.addEventListener('click', eat, true);
        setTimeout(function () { document.removeEventListener('click', eat, true); }, 400);
    };
    var onKey = function (e) {
        if (closed || e.key !== 'Escape') return;
        e.stopPropagation();
        finish();
    };
    function finish() {
        if (closed) return;
        closed = true;
        document.removeEventListener('mousedown', onDown, true);
        document.removeEventListener('keydown', onKey, true);
        try { close(); } catch (err) { /* a throwing closer must not leave listeners behind */ }
    }
    document.addEventListener('mousedown', onDown, true);
    document.addEventListener('keydown', onKey, true);
    return finish;
}

// Collapse a toolbar to icon-only when its buttons would wrap.
//
//   mbuFitToolbar(barEl)            // call on build, and on resize
//
// Measured by SUMMING child widths rather than reading scrollWidth or comparing
// offsetTop: a bar with flex:1 spacers never overflows its own scroll box, so
// both of those report "fits" right up until it visibly wraps. Art Station
// learned that the hard way (#234) and it is the only reason this is a helper
// rather than one CSS rule.
//
// opts.gap    inter-item gap in px (default 11)
// opts.pad    horizontal padding to leave (default 24)
// opts.spacer selector for flexible spacers, which must not count (default .mbu-sp)
function mbuFitToolbar(bar, opts) {
    if (!bar) return false;
    opts = opts || {};
    var gap = opts.gap == null ? 11 : opts.gap;
    var pad = opts.pad == null ? 24 : opts.pad;
    var spacer = opts.spacer || '.mbu-sp';
    bar.classList.remove('mbu-compact');            // measure at full labels
    var kids = [].slice.call(bar.children);
    var need = gap * Math.max(0, kids.length - 1);
    for (var i = 0; i < kids.length; i++) {
        if (kids[i].matches && kids[i].matches(spacer)) continue;
        need += kids[i].offsetWidth;
    }
    var compact = need > bar.clientWidth - pad;
    bar.classList.toggle('mbu-compact', compact);
    return compact;
}

// Publish the components on a shared namespace. Three reasons, in order:
//
//  1. it is the cross-userscript contract #563 is about — another script (or a
//     future one) gets the standard widgets without copying them, the same way
//     Mammoth already exposes its field-memory through a documented convention;
//  2. it makes the components testable from outside, which is the only way to
//     assert the *behaviour* half of the contract rather than just the markup;
//  3. it costs nothing when several scripts do it — the definitions are
//     byte-identical, so first writer wins and the rest are no-ops.
//
// Guarded per key, never clobbering: a script that loaded first keeps its copy,
// and a page that defines an unrelated window.MBU is left alone.
// Theme recognition. #564: "we don't have to conform to Stylus vars, we could
// probably use them as a recognition signal to enable our own dark theme."
//
// That is the right way round. Reading --background/--text and hoping every
// derived colour lands somewhere readable is guesswork that fails one token at a
// time; knowing WHICH theme we are in lets the token set say so outright, and
// lets us hand the browser the one thing CSS variables cannot express —
// color-scheme, which is what actually paints a checkbox dark instead of leaving
// a white (Firefox: black) box on a dark panel.
//
// The signal is the rendered page, not a particular userstyle's variable names:
// whatever painted the body, we measure its luminance. So this works for Stylus,
// for a browser extension, for MusicBrainz shipping its own dark mode one day,
// and for a user who just set --background by hand.
//
//   · an explicit --mbu-theme (light|dark) always wins — the escape hatch;
//   · otherwise the page background decides;
//   · re-checked when stylesheets arrive, because Stylus often lands after us.
function mbuThemeOf(bg) {
    var m = /rgba?\((\d+),\s*(\d+),\s*(\d+)(?:,\s*([\d.]+))?/.exec(bg || '');
    if (!m) return null;
    if (m[4] !== undefined && +m[4] < 0.5) return null;      // transparent tells us nothing
    var f = function (v) { v /= 255; return v <= 0.03928 ? v / 12.92 : Math.pow((v + 0.055) / 1.055, 2.4); };
    var L = 0.2126 * f(+m[1]) + 0.7152 * f(+m[2]) + 0.0722 * f(+m[3]);
    return L < 0.35 ? 'dark' : 'light';
}
// #569 (chaban-mb) — write only when the value actually changes.
//
// The DOM does not do this for you. classList.add of a token already present,
// classList.toggle to the state it is already in, setAttribute with the value it
// already has: each one re-sets the attribute and dispatches a mutation record.
// Harmless once; these run from 2Hz heartbeats and from observers that react to
// each other, and the measured idle cost on the release editor was 66 records a
// second, of which 93% came from writes that changed nothing (see
// dev/ui/measure-569-idle-mutations.mjs).
//
// Semantically these are exact no-ops: they skip a write ONLY when the value is
// already the one being written, so nothing that reads the DOM afterwards can
// tell the difference. That is the whole reason they are safe to sprinkle around
// a 2Hz loop.
function mbuCls(el, token, on) {
    if (!el || !el.classList) return;
    if (el.classList.contains(token) !== !!on) el.classList.toggle(token, !!on);
}
function mbuAttr(el, name, value) {
    if (!el) return;
    if (value === null || value === undefined || value === false) {
        if (el.hasAttribute(name)) el.removeAttribute(name);
    } else if (el.getAttribute(name) !== String(value)) {
        el.setAttribute(name, String(value));
    }
}
// For IDL properties (disabled, title, textContent, style.display …). Reading
// them is cheap; writing them is not, and textContent in particular replaces
// every child node.
//
// ⚠ textContent is the one to think twice about: its getter concatenates the
// text of ALL descendants, so on an element with child ELEMENTS the comparison
// can match while the DOM shape is wrong, and the guard then skips a write that
// would have flattened it. Only use it where the target holds text and nothing
// else.
function mbuProp(obj, prop, value) {
    if (!obj) return;
    if (obj[prop] !== value) obj[prop] = value;
}

// #569: the one element mbuTheme resolves --background through. Looked up by id
// rather than kept in a variable, so the seven scripts of a bundle share ONE
// probe instead of adding seven, and so it heals itself if anything removes it.
// It lives in <body>: a permanent stray node under <html>, outside head and
// body, is the sort of thing another script's document scan trips over.
function mbuProbe() {
    var p = document.getElementById('mbu-theme-probe');
    if (p) return p;
    if (!document.body) return null;
    p = document.createElement('span');
    p.id = 'mbu-theme-probe';
    p.setAttribute('aria-hidden', 'true');
    p.style.cssText = 'position:absolute;left:-9999px;top:0;width:1px;height:1px;pointer-events:none;background:var(--background)';
    document.body.appendChild(p);
    return p;
}
function mbuTheme() {
    var root = document.documentElement;
    try {
        var cs = getComputedStyle(root);
        var forced = (cs.getPropertyValue('--mbu-theme') || '').trim();
        var t = (forced === 'dark' || forced === 'light') ? forced
            : (mbuThemeOf(getComputedStyle(document.body).backgroundColor)
                || mbuThemeOf(cs.backgroundColor)
                || mbuThemeOf(cs.getPropertyValue('--mbu-bg'))
                || 'light');
        if (root.getAttribute('data-mbu-theme') !== t) root.setAttribute('data-mbu-theme', t);

        // Should we adopt the userstyle's OWN shades, or use our own palette?
        // Only if its --background actually agrees with the theme we detected.
        // A userstyle can paint the page dark with ordinary rules and still leave
        // --background at a light value for its own purposes; taking that on
        // trust hands us a light surface under a correct dark theme, which is
        // indistinguishable from the bug it looks like. Measured, not assumed.
        var seed = null;
        var raw = (cs.getPropertyValue('--background') || '').trim();
        if (raw) {
            // Resolved through a real element, because --background may itself be
            // a var(), a named colour, or anything else CSS accepts.
            //
            // #569 (chaban-mb): this used to CREATE and REMOVE that element on
            // every call, as a direct child of <html>. mbuTheme re-runs whenever
            // the root or body class changes, Mammoth watches the whole document
            // for childList changes and reacts by toggling classes on <html>, and
            // those class changes wake mbuTheme again — a self-feeding loop,
            // measured at 12 root-node mutations a second on an idle page, which
            // is what makes DevTools blink.
            //
            // One element, created once and left in place, breaks it: the value
            // is still resolved LIVE on every call (a cached reading would freeze
            // the theme at whatever it was before Stylus injected, which is the
            // bug this whole function exists to avoid) but nothing is added to or
            // removed from the DOM to read it.
            var probe = mbuProbe();
            var got = null;
            if (probe) {
                got = mbuThemeOf(getComputedStyle(probe).backgroundColor);
            } else {
                // No <body> yet — document-start. Fall back to the transient
                // element for these first one or two calls; the idle loop this
                // avoids cannot exist before the page has a body anyway.
                var tmp = document.createElement('span');
                tmp.style.cssText = 'position:absolute;left:-9999px;width:1px;height:1px;background:var(--background)';
                document.documentElement.appendChild(tmp);
                got = mbuThemeOf(getComputedStyle(tmp).backgroundColor);
                tmp.remove();
            }
            if (got === t) seed = 'theme';
        }
        // guarded: setAttribute dispatches a mutation record even when the value
        // is unchanged, and this runs several times a second
        if (seed) { if (root.getAttribute('data-mbu-seed') !== seed) root.setAttribute('data-mbu-seed', seed); }
        else if (root.hasAttribute('data-mbu-seed')) root.removeAttribute('data-mbu-seed');
        return t;
    } catch (e) { return 'light'; }
}
// A document-start script runs before the document is parsed: documentElement can
// still be null, and <head> and <body> don't exist. Observing a null root threw, the
// catch below swallowed it, and nothing (the watches, the re-checks) was ever set up,
// so such a script never read the theme at all (#625). It starts on the parsed page.
function mbuThemeStart() { try {
    mbuTheme();
    // Stylus and friends inject after us often enough that a one-shot read is
    // wrong about half the time. Watch for stylesheets ARRIVING — head childList
    // plus the root's own attributes — and never the whole subtree: this runs on
    // the release editor, where a subtree observer calling getComputedStyle is a
    // layout thrash on every keystroke.
    var _mbuThemeT = 0;
    var _mbuThemeSoon = function () {
        clearTimeout(_mbuThemeT);
        _mbuThemeT = setTimeout(mbuTheme, 150);
    };
    var _mbuThemeObs = new MutationObserver(_mbuThemeSoon);
    _mbuThemeObs.observe(document.documentElement, { attributeFilter: ['style', 'class'] });
    // ⚠ #569: characterData, not just childList. Until the idle thrash was fixed
    // this function ran several times a second whether or not anything had
    // changed — Apollo re-added a body class at 2Hz, which woke this observer,
    // which is how a theme change was ever noticed. That accidental polling was
    // LOAD-BEARING: with the thrash gone and only head-childList watched, a
    // userstyle that REWRITES ITSELF (Stylus editing it live, or one switching
    // palette) adds and removes no nodes, so nothing woke us and the theme went
    // stale. Caught by verify-569-theme-still-tracks.mjs, which passes on the
    // pre-fix build and failed on the first version of this one.
    if (document.head) _mbuThemeObs.observe(document.head, { childList: true, subtree: true, characterData: true });
    if (document.body) _mbuThemeObs.observe(document.body, { attributeFilter: ['style', 'class'] });
    // …and the case that produces no DOM mutation at all: the OS flipping to dark
    // under a userstyle with a prefers-color-scheme query. Nothing above can see
    // that, and nothing did before either — it was simply never noticed while the
    // page was re-checking itself several times a second.
    try {
        var _mbuMq = matchMedia('(prefers-color-scheme: dark)');
        if (_mbuMq.addEventListener) _mbuMq.addEventListener('change', _mbuThemeSoon);
        else if (_mbuMq.addListener) _mbuMq.addListener(_mbuThemeSoon);
    } catch (e) {}
    setTimeout(mbuTheme, 400);
    setTimeout(mbuTheme, 2000);
} catch (e) { /* no observer, no theme switching — the light defaults still apply */ } }
if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', mbuThemeStart, { once: true });
else mbuThemeStart();

try {
    var _mbuNs = (typeof unsafeWindow !== 'undefined' ? unsafeWindow : window);
    if (!_mbuNs.MBU) _mbuNs.MBU = {};
    if (!_mbuNs.MBU.theme) _mbuNs.MBU.theme = mbuTheme;
    if (!_mbuNs.MBU.helpHref) _mbuNs.MBU.helpHref = mbuHelpHref;
    if (!_mbuNs.MBU.helpHtml) _mbuNs.MBU.helpHtml = mbuHelpHtml;
    if (!_mbuNs.MBU.helpEl) _mbuNs.MBU.helpEl = mbuHelpEl;
    if (!_mbuNs.MBU.toast) _mbuNs.MBU.toast = mbuToast;
    if (!_mbuNs.MBU.cfgHeader) _mbuNs.MBU.cfgHeader = mbuCfgHeader;
    if (!_mbuNs.MBU.dismissOn) _mbuNs.MBU.dismissOn = mbuDismissOn;
    if (!_mbuNs.MBU.fitToolbar) _mbuNs.MBU.fitToolbar = mbuFitToolbar;
} catch (e) { /* a locked-down page must not stop the script loading */ }
// </ST-UI>

container.innerHTML = `
<style>
${MBU_TOKENS}${MBU_UI_CSS}
  /* MB's site CSS marks any outbound link with a red external-link ::after icon
   * via selectors that beat our specificity unless we anchor on #sidebar. The
   * ID-prefixed selector (specificity 1,2,2) beats anything class-only. */
  #sidebar .online-search-box a::before,
  #sidebar .online-search-box a::after { content: none !important; display: none !important; background: none !important; background-image: none !important; }
  #sidebar .online-search-box a img.external,
  #sidebar .online-search-box a img[src*="external"] { display: none !important; }
  .online-search-box .pc-icon-btn:hover { background: var(--mbu-bg-sunken); color: var(--mbu-text); }
  /* icons mode (toggle "Show platform icons"): the brand glyph REPLACES the ✓/×/~ text and carries the
   * state via a per-row class (pc-st-*): RING = already in MB (the only thing a ring means) · full colour =
   * clean match · GRAY icon+name = found but track-count mismatch · faint = not found. Match vs mismatch is
   * also on the right via the count colour. */
  /* fixed-size box (keeps names aligned); NO frame by default — only in-MB draws a blue circle */
  .pc-plat-ico { display: none; align-items: center; justify-content: center; flex: none; width: var(--pc-icon-size, 22px); height: var(--pc-icon-size, 22px); border-radius: 50%; box-sizing: border-box; }
  .pc-plat-ico svg { display: block; width: 100%; height: 100%; }
  #mb-pc-panel.pc-icons-mode .pc-plat-ico { display: inline-flex; }
  #mb-pc-panel.pc-icons-mode .pc-ico-slot { display: none; }
  /* in-MB marker (independent of match/mismatch) — per the "MB marker" option (#642) */
  /* #642: the marker is a choice (Settings › MB marker); the glow is gone — it was barely visible */
  #mb-pc-panel.pc-icons-mode.pc-mark-circle .pc-inmb .pc-plat-ico { border: 1px solid var(--mbu-info); padding: 1px; }
  /* the ring and square are drawn INSIDE the icon box (border + padding shrink the icon), never outside it: an
     outline with an offset overflowed into the next row and the panel edge at larger icon sizes (majkinetor) */
  #mb-pc-panel.pc-icons-mode.pc-mark-bold   .pc-inmb .pc-plat-ico { border: 2px solid var(--mbu-info); padding: 3px; }
  #mb-pc-panel.pc-icons-mode.pc-mark-square .pc-inmb .pc-plat-ico { border: 1.5px solid var(--mbu-info); padding: 3px; border-radius: 6px; }
  #mb-pc-panel.pc-icons-mode:is(.pc-mark-badge, .pc-mark-dot) .pc-inmb .pc-plat-ico { position: relative; overflow: visible; }
  #mb-pc-panel.pc-icons-mode:is(.pc-mark-badge, .pc-mark-dot) .pc-inmb .pc-plat-ico::after { content: ""; position: absolute; pointer-events: none; background: var(--mbu-info); }
  #mb-pc-panel.pc-icons-mode.pc-mark-badge .pc-inmb .pc-plat-ico::after { content: "✓"; right: -5px; bottom: -4px; width: 12px; height: 12px; border-radius: 50%; color: #fff; font: bold 9px/12px sans-serif; text-align: center; box-shadow: 0 0 0 1.5px var(--mbu-bg); }
  #mb-pc-panel.pc-icons-mode.pc-mark-dot .pc-inmb .pc-plat-ico::after { right: -3px; top: -3px; width: 8px; height: 8px; border-radius: 50%; box-shadow: 0 0 0 1.5px var(--mbu-bg); }
  /* presence — fades/grays the icon + name regardless of in-MB */
  #mb-pc-panel.pc-icons-mode .pc-st-mismatch .pc-plat-ico svg { filter: grayscale(1); opacity: .6; }  /* found but wrong */
  #mb-pc-panel.pc-icons-mode .pc-st-mismatch a[id^="mb-online"] { color: var(--mbu-text-weak) !important; }
  #mb-pc-panel.pc-icons-mode .pc-st-notfound .pc-plat-ico svg { filter: grayscale(1); opacity: .3; }  /* not found */
  /* Compact unmatched providers (#355): when on, every provider starts compact — a
     strip of dimmed brand icons — and rises into its full row when it matches; the
     unmatched ones stay in the strip (except Discogs/Bandcamp, which always keep their
     full rows). Clicking a strip icon runs that provider's search, like clicking its
     row. Full rows are hidden via a class so the per-provider enable/disable (inline
     display) is left untouched. */
  #mb-pc-panel .pc-row.pc-compacted { display: none !important; }
  /* the strip sits under the full rows with a clear gap; its icons are a touch
     smaller than the row icons (they're a secondary, collapsed representation). */
  .pc-compact-strip { display: none; grid-column: 1 / -1; flex-wrap: wrap; align-items: center; gap: 7px; padding: 1rem 0 1px; }
  #mb-pc-panel .pc-compact-strip.pc-has-icons { display: flex; }
  .pc-compact-ico { display: inline-flex; align-items: center; justify-content: center; width: calc(var(--pc-icon-size, 22px) * 0.8); height: calc(var(--pc-icon-size, 22px) * 0.8); cursor: pointer; border-radius: 50%; box-sizing: border-box; filter: grayscale(1); opacity: .38; transition: opacity .12s, filter .12s; }
  .pc-compact-ico svg, .pc-compact-ico img { display: block; width: 100%; height: 100%; }
  .pc-compact-ico:hover { filter: none; opacity: 1; }
  /* a folded MISMATCH (found but wrong barcode/format) keeps an amber ring so the
     "found but a different release" signal survives the collapse. */
  .pc-compact-ico.pc-compact-mismatch { box-shadow: 0 0 0 2px #e0892a; opacity: .55; }
  /* subtle rise as a provider leaves the strip on a match — a small fade + lift so
     the panel doesn't jump/flash as results stream in. */
  @keyframes pcRise { from { opacity: 0; transform: translateY(-3px); } to { opacity: 1; transform: none; } }
  #mb-pc-panel .pc-row.pc-rise { animation: pcRise .28s ease; }
  /* (#422) the ↻ refresh button doubles as the progress indicator: it spins (and is
     unclickable) while scans run; the scan duration lands in its tooltip afterwards */
  @keyframes pcSpin { to { transform: rotate(360deg); } }
  #mb-refresh-btn.pc-scanning { display: inline-block; animation: pcSpin 1s linear infinite; pointer-events: none; color: var(--mbu-info); }
  /* barcode mismatch (#182): a thin amber bar on the row's left edge — the barcode
     itself is never shown in the dash, only in the row tooltip + the log. */
  #mb-pc-panel .pc-row.pc-barcode-diff { box-shadow: inset 3px 0 0 #e0892a; }
  /* format incompatibility (#182): a thin violet bar; only shown while the
     "Use format for link confidence" option is on. Stacks beside the amber
     barcode bar when a row is both. */
  /* setup panel (#188): section headers + nav-button hovers */
  #mb-provider-modal-card .pc-setup-sec { font-weight: 700; color: var(--mbu-text); font-size: 11px; letter-spacing: .05em; text-transform: uppercase; margin: 14px 0 4px; padding-bottom: 3px; border-bottom: 1px solid var(--mbu-divider); }
  #mb-provider-modal-card .pc-setup-nav:hover { background: var(--mbu-bg-raised); }
  #mb-provider-modal-card .pc-setup-back:hover { text-decoration: underline; }
  #mb-pc-panel .pc-row.pc-format-diff { box-shadow: inset 3px 0 0 #7e57c2; }
  #mb-pc-panel .pc-row.pc-format-diff.pc-barcode-diff { box-shadow: inset 3px 0 0 #e0892a, inset 6px 0 0 #7e57c2; }
  /* withheld by barcode/format confidence (#182): grayed + non-clickable, so it reads
     as "not added" like other mismatches rather than a clickable ✓ that does nothing. */
  #mb-pc-panel .pc-row.pc-blocked .pc-ico-slot,
  #mb-pc-panel .pc-row.pc-blocked a[id^="mb-online"],
  #mb-pc-panel .pc-row.pc-blocked [id^="val-"] { color: var(--mbu-text-weak) !important; }
  #mb-pc-panel.pc-icons-mode .pc-row.pc-blocked .pc-plat-ico svg { filter: grayscale(1); opacity: .5; }
  #mb-pc-panel.pc-icons-mode .pc-st-notfound a[id^="mb-online"] { color: var(--mbu-text-weak) !important; opacity: .6; }
  /* Circled ✓ — applied when the platform URL came from an MB url-relationship
   * (existing rel), as distinct from a found-via-Wikidata/search result. Layered
   * on top of the colour-tint (green = fresh, steel-blue = cache hit). */
  .online-search-box .pc-ico-circled {
    border: 1.5px solid currentColor;
    border-radius: 50%;
    width: 13px;
    height: 13px;
    line-height: 11px;
    text-align: center;
    font-size: 9px;
    box-sizing: border-box;
    display: inline-block;
  }

  /* ── Row layout (issue #173): compact 1-row vs 2-row stacked ───────────────
   * 1-row packs each provider onto one line: full name, then year · format ·
   * label flowing right after it, with the track count pinned to the right
   * edge. Names stay fully visible (they identify the row); the label is the
   * only thing that truncates (full text in its tooltip). 2-row keeps the
   * legacy stacked look (name line + meta line below). */
  .pc-cell-ico  { display: inline-flex; align-items: center; justify-content: center; flex: 0 0 22px; width: 22px; cursor: default; }
  .pc-cell-ico img { display: block; }
  .pc-cell-name { color: inherit; text-decoration: none; font-weight: 600; font-size: var(--pc-name-size, 12px);
                  min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
  .pc-cell-year, .pc-cell-format, .pc-cell-label {
                  font-size: 10px; color: var(--mbu-text-weak); font-family: sans-serif; white-space: nowrap; overflow: hidden; }
  .pc-cell-label { text-overflow: ellipsis; min-width: 0; }
  /* format-family quadrant marker (#350) — vertically centered against the meta text */
  /* #564 (majkinetor): "PC vinyl is black in format circle and hardly visible".
     Vinyl is black because vinyl IS black — which works on a white page and
     disappears on a dark one. The lit quadrant colours are tokens now, with a
     dark set that lifts each one; the unlit quadrant and the hairline were
     already tokenised in an earlier pass. */
  :root { --pc-fmt-vinyl:#2b2b2b; --pc-fmt-cassette:#9a6b3f; --pc-fmt-cd:#7d8894; --pc-fmt-digital:#4a90d9; }
  :root[data-mbu-theme="dark"] { --pc-fmt-vinyl:#c3bdd0; --pc-fmt-cassette:#c79a6b; --pc-fmt-cd:#aab3bd; --pc-fmt-digital:#7bb3e8; }
  .pc-cell-format .pc-fmt { vertical-align: -2px; }
  #mb-pc-panel.pc-fmt-text .pc-cell-format .pc-fmt { display: none; }
  #mb-pc-panel:not(.pc-fmt-text) .pc-cell-format .pc-fmt-txt { display: none; }
  .pc-cell-val  { font-size: 12px; font-weight: bold; font-family: monospace; color: var(--mbu-text-dim); text-align: right; }
  .pc-cell-master { font-size: 11px; min-width: 14px; }

  /* 1-row — the ENTIRE provider list is ONE grid (rows are display:contents, so
     every cell becomes a grid item of .pc-rows). Columns are content-sized, so
     they're as wide as their widest cell across all rows and line up as a true
     table — an empty format still reserves its column, so labels start at the
     same x whether or not a row has a format. Order: icon name year format label
     master tracks. */
  #mb-pc-panel.pc-layout-1row .pc-rows {
    display: grid; align-items: center; column-gap: var(--pc-col-gap, 5px); row-gap: var(--pc-row-gap, 5px);
    grid-template-columns: 22px max-content max-content max-content minmax(0,1fr) max-content max-content;
  }
  /* each row is a subgrid box spanning all columns: it shares the parent's
     column tracks (so cells still align as a table) AND is a single element,
     so the whole row — gaps and empty cells included — is one click target. */
  #mb-pc-panel.pc-layout-1row .pc-row {
    display: grid; grid-column: 1 / -1; grid-template-columns: subgrid; align-items: center;
  }
  #mb-pc-panel.pc-layout-1row .pc-meta { display: contents; }
  #mb-pc-panel.pc-layout-1row .pc-cell-ico    { grid-column: 1; }
  #mb-pc-panel.pc-layout-1row .pc-cell-name   { grid-column: 2; }
  #mb-pc-panel.pc-layout-1row .pc-cell-year   { grid-column: 3; }
  #mb-pc-panel.pc-layout-1row .pc-cell-format { grid-column: 4; }
  #mb-pc-panel.pc-layout-1row .pc-cell-label  { grid-column: 5; min-width: 0; }   /* fills + truncates */
  #mb-pc-panel.pc-layout-1row .pc-cell-master { grid-column: 6; text-align: center; }
  #mb-pc-panel.pc-layout-1row .pc-cell-val    { grid-column: 7; }
  #mb-pc-panel.pc-layout-1row .pc-rows-sep    { grid-column: 1 / -1; border-bottom: 1px solid var(--mbu-divider); }

  /* 2-row — legacy stacked look: name line, then a meta line below */
  #mb-pc-panel.pc-layout-2row .pc-rows { display: flex; flex-direction: column; gap: var(--pc-row-gap, 5px); }
  #mb-pc-panel.pc-layout-2row .pc-rows-sep { border-bottom: 1px solid var(--mbu-divider); }
  #mb-pc-panel.pc-layout-2row .pc-row {
    display: grid; align-items: center; column-gap: 4px;
    grid-template-columns: 22px minmax(0,1fr) auto 24px;
  }
  #mb-pc-panel.pc-layout-2row .pc-cell-ico    { grid-area: 1 / 1; }
  #mb-pc-panel.pc-layout-2row .pc-cell-name   { grid-area: 1 / 2; }
  #mb-pc-panel.pc-layout-2row .pc-cell-master { grid-area: 1 / 3; text-align: center; }
  #mb-pc-panel.pc-layout-2row .pc-cell-val    { grid-area: 1 / 4; }
  #mb-pc-panel.pc-layout-2row .pc-meta {
    grid-column: 2 / -1; grid-row: 2; line-height: 1.2; padding-top: 0.3rem;
    font-size: 10px; color: var(--mbu-text-weak); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; min-width: 0;
  }
  #mb-pc-panel.pc-layout-2row .pc-meta .pc-cell-year,
  #mb-pc-panel.pc-layout-2row .pc-meta .pc-cell-format,
  #mb-pc-panel.pc-layout-2row .pc-meta .pc-cell-label { display: inline; }
  #mb-pc-panel.pc-layout-2row .pc-meta .pc-cell-year:not(:empty),
  #mb-pc-panel.pc-layout-2row .pc-meta .pc-cell-format:not(:empty) { margin-right: 4px; }

  /* names toggle (pc:show-names) */
  #mb-pc-panel.pc-no-names .pc-cell-name { display: none; }
  /* MusicBrainz reference row: always visible mark + brand-violet name, no fade */
  #mb-pc-panel .pc-row-mb .pc-plat-ico { display: inline-flex; }
</style>
<div style="margin-bottom: 6px;">
  <div style="display: flex; align-items: center; justify-content: space-between;">
    <div style="display: flex; align-items: center; gap: 4px;">
      <h3 style="margin: 0; font-size: 12px; font-weight: bold; text-transform: uppercase; letter-spacing: 0.5px; color: var(--mbu-text-dim);">Platform Check</h3>
      <span id="mb-refresh-btn" class="pc-icon-btn" title="Refresh — clear cache and re-scan" style="${iconBtn}">↻</span>
    </div>
  </div>
</div>
<div class="pc-rows" style="margin-bottom: 6px;">
  <div id="row-mb" class="pc-row pc-row-mb">
    <span class="pc-cell-ico"><span class="pc-plat-ico" title="MusicBrainz">${stIcon('musicbrainz', 16)}</span></span>
    <a id="mb-mb-name" class="pc-cell-name" href="${MB_ORIGIN}/release/" target="_blank" rel="noopener" title="MusicBrainz" style="color: var(--mbu-accent-text);">MB</a>
    <span class="pc-meta">
      <span id="mb-mb-year"   class="pc-cell-year"></span>
      <span id="mb-mb-format" class="pc-cell-format"></span>
      <span id="mb-mb-label"  class="pc-cell-label"></span>
    </span>
    <span class="pc-cell-master"></span>
    <span id="mb-mb-tracks" class="pc-cell-val" style="color: var(--mbu-warn);"></span>
  </div>
  <div class="pc-rows-sep"></div>
  ${PROVIDER_ORDER.map(p => `
  <div id="row-${p}" class="pc-row pc-st-notfound">
    <span class="pc-cell-ico">
      <span id="ico-${p}" class="pc-ico-slot" style="font-size: 11px; text-align: center; color: var(--mbu-text-weak);">⚪</span>
      <span id="plat-${p}" class="pc-plat-ico" title="${PROVIDER_NAME[p]}">${stIcon(p, 16)}</span>
    </span>
    <a id="mb-online-${p}" class="pc-cell-name" href="#" target="_blank" rel="noopener" style="color: ${PROVIDER_COLOR[p] || 'var(--mbu-text)'};">${PROVIDER_NAME[p]}</a>
    <span class="pc-meta">
      <span id="year-${p}"   class="pc-cell-year"></span>
      <span id="format-${p}" class="pc-cell-format"></span>
      <span id="label-${p}"  class="pc-cell-label"></span>
    </span>
    <span id="master-${p}" class="pc-master-slot pc-cell-master" style="cursor: default;"></span>
    <span id="val-${p}" class="pc-cell-val">—</span>
  </div>`).join('')}
  <div id="pc-compact-strip" class="pc-compact-strip"></div>
</div>
<div style="display: flex; justify-content: space-between; align-items: center; padding-top: 6px; border-top: 1px solid var(--mbu-border);">
  <div style="display: flex; align-items: center; gap: 6px;">
    <span id="mb-inject-btn"      class="pc-icon-btn" title="Open the release editor and queue OK URLs to add · right-click: add them silently in the background · middle-click or Alt+click: add them, including the ones strict barcode/format settings withhold (with Ctrl: in the background)" style="${iconBtn}">+</span>
    <span id="mb-openall-btn"     class="pc-icon-btn" title="Open found platform pages not yet in MB (non-circled) in new tabs" style="${iconBtn}">↗</span>
  </div>
  <div style="display: flex; align-items: center; gap: 6px;">
    <span id="mb-log-open-btn"    class="pc-icon-btn" title="Diagnostic log" style="${iconBtn} font-size: 11px;">log</span>
    <span id="mb-token-setup-btn" class="pc-icon-btn" title="Settings" style="${iconBtn}">⚙︎</span>
  </div>
</div>
`;

// Diagnostic log modal
const logModal = document.createElement('div');
logModal.id = 'mb-log-modal-overlay';
logModal.style.cssText = 'display: none; position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: rgba(0,0,0,0.85); z-index: 99999; font-family: monospace; padding: 30px; box-sizing: border-box;';
// Provider filter chips — one per source that produces log lines. Default all
// active (toggled = filter ON = entries hidden). State is per-session only;
// not persisted because the natural workflow is "open log to investigate
// one provider's behavior on this page".
// A log source's key for classes and data-attributes: no spaces ("YouTube Music" → youtube-music).
// With the space, classList.toggle threw on it, and its lines showed under every filter.
const pcLogKey = s => String(s).toLowerCase().replace(/[^a-z0-9]+/g, '-');
const LOG_SOURCES = ['System', 'MusicBrainz', 'Wikidata', 'Wallstream', 'Spotify', 'Discogs', 'Bandcamp', 'Deezer', 'Apple', 'Tidal', 'Qobuz', 'Beatport', 'Volumo', 'HDtracks', 'SoundCloud', 'Audiomack', 'YouTube Music', 'Amazon Music'];
const LOG_SOURCE_COLORS = {
    System: '#999', MusicBrainz: '#BA68C8', Wikidata: '#FFD54F', Wallstream: '#4FC3F7',
    Spotify: '#1DB954', Discogs: '#E0E0E0', Bandcamp: '#629AA9', Deezer: '#A238FF', Apple: '#FA243C',
    Tidal: '#CCC', Qobuz: '#5b9bff', Beatport: '#3AD17A', Volumo: '#b39dff', HDtracks: '#f08a84', SoundCloud: '#ff7a45', Audiomack: '#ffb84d', 'YouTube Music': '#ff5c5c', 'Amazon Music': '#25D1DA',
};
logModal.innerHTML = `
<style>
${MBU_TOKENS}${MBU_UI_CSS}
  .pc-log-chip { display: inline-block; padding: 3px 9px; margin-right: 4px; border-radius: 12px; font-size: 11px; font-weight: bold; cursor: pointer; user-select: none; border: 1px solid var(--mbu-border-strong); }
  .pc-log-chip.off { opacity: 0.35; background: transparent !important; color: var(--mbu-text-weak) !important; }
  ${LOG_SOURCES.map(s => `#mb-finder-log-panel.pc-hide-${pcLogKey(s)} [data-platform="${pcLogKey(s)}"] { display: none; }`).join('\n  ')}
  /* MOBILE / NARROW VIEWPORTS — both Platform Check modals live on <body>, so
     these rules are global. The log modal trims its 30px overlay padding and
     wraps its header (title + Copy on top, source chips below) to use the full
     width; the setup modal drops its fixed 420px width to fit a phone. */
  @media (max-width: 640px) {
    #mb-log-modal-overlay { padding: 8px !important; }
    #mb-log-modal-card { max-width: 100% !important; height: 92vh !important; }
    #mb-log-modal-card > div:first-child { flex-wrap: wrap !important; gap: 8px !important; }
    #mb-log-filters { order: 3; flex-basis: 100% !important; flex-grow: 0 !important; }
    #mb-modal-copy-btn { margin-left: auto; }
    .pc-log-chip { margin-bottom: 4px; }

    #mb-provider-modal-card { width: auto !important; left: 8px !important; right: 8px !important;
      transform: translateY(-50%) !important; max-height: 92vh !important; overflow-y: auto !important;
      padding: 18px !important; box-sizing: border-box !important; }
  }
</style>
<div id="mb-log-modal-card" style="max-width: 900px; height: 85vh; margin: 0 auto; background: #1E1E1E; color: #FFF; border-radius: 8px; border: 1px solid var(--mbu-border-strong); display: flex; flex-direction: column; box-shadow: 0 10px 25px rgba(0,0,0,0.5);">
  <div style="padding: 10px 12px; background: #2D2D2D; border-bottom: 1px solid var(--mbu-border-strong); display: flex; justify-content: space-between; align-items: center; gap: 12px;">
    <span style="font-weight: bold; color: var(--mbu-ok); font-size: 14px; white-space: nowrap;">Platform Check log</span>
    <div id="mb-log-filters" style="flex-grow: 1; text-align: left;">
      ${LOG_SOURCES.map(s => `<span class="pc-log-chip" data-source="${pcLogKey(s)}" style="background:${LOG_SOURCE_COLORS[s]}33; color:${LOG_SOURCE_COLORS[s]};">${s}</span>`).join('')}
    </div>
    <button id="mb-modal-copy-btn" style="padding: 6px 12px; background: #434C5E; border: none; color: white; border-radius: 4px; cursor: pointer; font-weight: bold; font-size: 12px;">Copy</button>
  </div>
  <div id="mb-finder-log-panel" style="flex-grow: 1; overflow-y: auto; padding: 15px; font-size: 12px; line-height: 1.5em; white-space: pre-wrap; background: #151515;"></div>
</div>`;

// Provider toggles
const providerModal = document.createElement('div');
providerModal.id = 'mb-provider-modal-overlay';
providerModal.style.cssText = 'display: none; position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: transparent; z-index: 100000; font-family: sans-serif;';
providerModal.innerHTML = `
<div id="mb-provider-modal-card" style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); width: 420px; background: var(--mbu-bg); padding: 20px 22px; border-radius: 8px; box-shadow: 0 20px 40px rgba(0,0,0,0.3); border: 1px solid var(--mbu-border); font-size: 13px; color: var(--mbu-text);">
    ${mbuCfgHeader({ script: 'platform_check', name: 'Platform Check',
      version: (typeof GM_info !== 'undefined' && GM_info.script && GM_info.script.version) || '?' })}

  <!-- ───────── MAIN view ───────── -->
  <div id="mb-setup-main">
    <div style="display: flex; gap: 8px; margin: 14px 0 4px;">
      <button class="pc-setup-nav" id="mb-view-order" type="button" style="flex: 1; text-align: left; padding: 8px 10px; background: var(--mbu-bg-raised); border: 1px solid var(--mbu-border); border-radius: 6px; font-size: 13px; cursor: pointer; display: flex; align-items: center; gap: 8px;">⋮⋮ <b>Platforms</b><span style="margin-left: auto; color: var(--mbu-text-weak);">›</span></button>
      <button class="pc-setup-nav" id="mb-view-auth" type="button" style="flex: 1; text-align: left; padding: 8px 10px; background: var(--mbu-bg-raised); border: 1px solid var(--mbu-border); border-radius: 6px; font-size: 13px; cursor: pointer; display: flex; align-items: center; gap: 8px;">🔑 <b>Authentication</b><span id="mb-auth-badge" style="margin-left: auto; color: var(--mbu-text-weak);">›</span></button>
    </div>

    <div class="pc-setup-sec">Link confidence</div>
    <div style="padding: 2px 4px;">
      <div style="display: flex; align-items: center; gap: 8px; margin: 5px 0;">
        <label style="display: inline-flex; align-items: center; gap: 8px; cursor: pointer; user-select: none;" title="When on, found links whose format is incompatible with MB's (e.g. a Digital-only platform on a CD release) are withheld from + / ↗. Digital-only platforms (Spotify, Apple, Tidal…) count as Digital; Bandcamp/Discogs use their actual format. A subtle violet left bar marks mismatches.">
          <input type="checkbox" id="mb-respect-format" style="margin: 0; width: 16px; height: 16px;"> Use <b>formats</b></label>
        <select id="mb-format-mode" style="font-size: 12px; padding: 1px 3px;" title="strictly: also withhold links whose format can't be determined. · if they exist: only withhold links whose format is known and incompatible.">
          <option value="exists">if they exist</option><option value="strict">strictly</option></select>
      </div>
      <div style="display: flex; align-items: center; gap: 8px; margin: 5px 0;">
        <label style="display: inline-flex; align-items: center; gap: 8px; cursor: pointer; user-select: none;" title="When on, found links whose barcode doesn't match MB's are withheld from + / ↗ (MB treats a different barcode as a different release). A subtle amber left bar marks known mismatches regardless of this setting.">
          <input type="checkbox" id="mb-respect-barcode" style="margin: 0; width: 16px; height: 16px;"> Use <b>barcodes</b></label>
        <select id="mb-barcode-mode" style="font-size: 12px; padding: 1px 3px;" title="strictly: only add barcode-confirmed links (also withholds links whose barcode can't be checked, e.g. Apple/Spotify). · if they exist: only withhold links whose barcode is known and differs.">
          <option value="exists">if they exist</option><option value="strict">strictly</option></select>
      </div>
      <div style="display: flex; align-items: center; gap: 8px; margin: 5px 0;">
        <label style="display: inline-flex; align-items: center; gap: 8px; cursor: pointer; user-select: none;" title="On: + opens the release editor in a new tab, leaving this one on the panel. Off: it navigates this tab instead. Either way, right-click on + (or a platform icon) always adds silently in a background tab that submits and closes itself.">
          <input type="checkbox" id="mb-open-new-tab" style="margin: 0; width: 16px; height: 16px;"> Add links in a <b>new tab</b></label>
      </div>
      <div style="display: flex; align-items: center; gap: 8px; margin: 5px 0;">
        <label style="display: inline-flex; align-items: center; gap: 8px; cursor: pointer; user-select: none;" title="#556. Firefox throttles timers in a background tab - to one step per second, and worse once the tab has spent its execution budget - and MusicBrainz's submit is a chain of them. A tab that is playing audio is exempt, so this plays an inaudible tone (30Hz, gain 0.0008) for the few seconds the background-add tab is alive. Measured on the same 2-link add: 20.2s without it, 3.7s with. REQUIRES allowing audio for musicbrainz.org (padlock menu > Autoplay > Allow Audio) - without it Firefox blocks the tone and the setting does nothing, which the Log says - and it lights the speaker icon while it runs. A WebRTC loopback was tried instead and does NOT work: it connects, and changes nothing.">
          <input type="checkbox" id="mb-bg-audio" style="margin: 0; width: 16px; height: 16px;"> Keep background-add tabs <b>awake</b></label>
      </div>
    </div>

    <div class="pc-setup-sec">Appearance</div>
    <div style="padding: 2px 4px;">
      <div style="font-weight: 600; color: var(--mbu-text-dim); margin: 4px 0 2px;">Platform</div>
      <div style="padding-left: 14px;">
        <label style="display: flex; align-items: center; gap: 8px; cursor: pointer; margin: 4px 0;">
          <input type="checkbox" id="mb-show-icons" style="margin: 0; width: 16px; height: 16px;"><span style="min-width: 44px;">Icon</span>
          <span style="color: var(--mbu-text-weak); font-size: 12px;">Size</span><input type="range" id="mb-icon-size" min="14" max="30" step="1" style="flex: 1; min-width: 0; margin: 0;"><span id="mb-icon-size-val" style="min-width: 18px; text-align: right; color: var(--mbu-text-dim);"></span>
        </label>
        <label style="display: flex; align-items: center; gap: 8px; cursor: pointer; margin: 4px 0;">
          <input type="checkbox" id="mb-show-names" style="margin: 0; width: 16px; height: 16px;"><span style="min-width: 44px;">Name</span>
          <span style="color: var(--mbu-text-weak); font-size: 12px;">Size</span><input type="range" id="mb-name-size" min="8" max="14" step="1" style="flex: 1; min-width: 0; margin: 0;"><span id="mb-name-size-val" style="min-width: 18px; text-align: right; color: var(--mbu-text-dim);"></span>
        </label>
      </div>

      <label style="display: flex; align-items: center; gap: 8px; cursor: pointer; margin: 9px 0 4px;" title="A provider that found nothing (or is still searching) shrinks to a dimmed icon in a strip under the rows, and rises into a full row once it finds something. Discogs and Bandcamp always stay full rows. Click a strip icon to search that platform, just like clicking its row.">
        <input type="checkbox" id="mb-compact-unmatched" style="margin: 0; width: 16px; height: 16px;"> Compact <b>unmatched</b> providers</label>
      <label style="display: flex; align-items: center; gap: 8px; cursor: pointer; margin: 4px 0;" title="A provider that found a release which isn't a clean match (a different barcode or format, or withheld by the strict barcode/format settings) also shrinks to an icon in the strip, with an amber ring. Off: it keeps its full row, so its tracks, year and label show.">
        <input type="checkbox" id="mb-compact-nonstrict" style="margin: 0; width: 16px; height: 16px;"> Compact <b>low-confidence</b> providers</label>

      <div style="display: flex; align-items: center; gap: 12px; margin: 9px 0 4px;">
        <span style="font-weight: 600; color: var(--mbu-text-dim);">MB marker</span>
        <select id="mb-marker" title="How an icon shows that its link is already on the release (icons mode)" style="font-size: 12px; padding: 2px 4px;">
          <option value="circle">Ring</option>
          <option value="bold">Bold ring</option>
          <option value="badge">✓ badge</option>
          <option value="dot">Dot</option>
          <option value="square">Rounded square</option>
        </select>
      </div>

      <div style="display: flex; align-items: center; gap: 12px; margin: 4px 0;" title="Show each release's format as a compact 4-quadrant circle (Vinyl · Cassette · CD · Digital) or as text.">
        <span style="font-weight: 600; color: var(--mbu-text-dim);">Format marker</span>
        <label style="display: inline-flex; align-items: center; gap: 5px; cursor: pointer;"><input type="radio" name="format-marker" value="circle" style="margin: 0;"> Circle</label>
        <label style="display: inline-flex; align-items: center; gap: 5px; cursor: pointer;"><input type="radio" name="format-marker" value="text" style="margin: 0;"> Text</label>
      </div>

      <div style="font-weight: 600; color: var(--mbu-text-dim); margin: 8px 0 2px;">Layout</div>
      <div style="padding-left: 14px;">
        <div style="display: flex; align-items: center; gap: 12px; margin: 4px 0;">
          <span style="min-width: 44px;">Rows</span>
          <label style="display: inline-flex; align-items: center; gap: 5px; cursor: pointer;"><input type="radio" name="mb-layout" value="1row" style="margin: 0;"> 1 row</label>
          <label style="display: inline-flex; align-items: center; gap: 5px; cursor: pointer;"><input type="radio" name="mb-layout" value="2row" style="margin: 0;"> 2 rows</label>
        </div>
        <label style="display: flex; align-items: center; gap: 6px; cursor: pointer; margin: 4px 0;">
          <span style="min-width: 44px;">Gap</span><span style="color: var(--mbu-text-weak); font-size: 12px;">row</span>
          <input type="range" id="mb-row-gap" min="0" max="10" step="1" style="flex: 1; min-width: 0; margin: 0;"><span id="mb-row-gap-val" style="min-width: 14px; text-align: right; color: var(--mbu-text-dim);"></span>
          <span style="color: var(--mbu-text-weak); font-size: 12px;" title="Column gap is only used in the 1-row layout">col</span>
          <input type="range" id="mb-col-gap" min="0" max="10" step="1" style="flex: 1; min-width: 0; margin: 0;"><span id="mb-col-gap-val" style="min-width: 14px; text-align: right; color: var(--mbu-text-dim);"></span>
        </label>
      </div>
    </div>

    <div style="display: flex; justify-content: flex-end; gap: 10px; margin-top: 16px;">
      <button id="mb-provider-close-btn" style="padding: 8px 16px; background: #1DB954; border: none; border-radius: 4px; font-size: 13px; color: #FFF; cursor: pointer;">Close</button>
    </div>
  </div>

  <!-- ───────── ORDER & VISIBILITY sub-view ───────── -->
  <div id="mb-setup-order" style="display: none;">
    <div class="pc-setup-sec" style="margin-top: 14px; display: flex; align-items: center;">Platforms<button class="pc-setup-back" type="button" style="margin-left: auto; padding: 0; background: none; border: none; color: var(--mbu-ok); font-size: 12px; font-weight: 600; text-transform: none; letter-spacing: 0; cursor: pointer;">‹ Back</button></div>
    <p style="font-size: 12px; color: var(--mbu-text-weak); margin: 4px 0 10px;">Drag to reorder; uncheck to skip a service. All results come from public endpoints.</p>
    <div id="mb-provider-list">
    ${PROVIDER_ORDER.map(p => `
      <div class="pc-prov-row" data-provider="${p}" draggable="true" style="display: flex; align-items: center; margin-bottom: 2px; font-size: 13px; padding: 4px 8px; border-radius: 4px; background: var(--mbu-bg-raised); border: 1px solid transparent; cursor: grab; user-select: none;">
        <span class="pc-prov-grip" style="color: var(--mbu-text-weak); font-size: 14px; margin-right: 8px; letter-spacing: -2px;" title="Drag to reorder">⋮⋮</span>
        <input type="checkbox" id="mb-toggle-${p}" checked style="margin: 0 10px 0 0; width: 15px; height: 15px;">
        <span style="font-weight: 500; flex-grow: 1; color: var(--mbu-text);">${PROVIDER_NAME[p]}</span>
      </div>`).join('')}
    </div>
  </div>

  <!-- ───────── AUTH sub-view ───────── -->
  <div id="mb-setup-auth" style="display: none;">
    <div class="pc-setup-sec" style="margin-top: 14px; display: flex; align-items: center;">Authentication<button class="pc-setup-back" type="button" style="margin-left: auto; padding: 0; background: none; border: none; color: var(--mbu-ok); font-size: 12px; font-weight: 600; text-transform: none; letter-spacing: 0; cursor: pointer;">‹ Back</button></div>
    <div id="mb-bp-acct" style="padding: 4px;">
      <div style="display: flex; align-items: center; gap: 8px; font-size: 13px; color: var(--mbu-text);">
        <span style="font-weight: 600;">Beatport account</span>
        <span id="mb-bp-status" style="font-size: 11px; color: var(--mbu-text-weak); margin-left: auto;"></span>
      </div>
      <div style="font-size: 11px; color: var(--mbu-text-weak); margin: 3px 0 7px;">Optional — enables <b>verified</b> Beatport matching (and the + insert) and lets ISRC Scout import Beatport ISRCs. Only the login token is stored, never your password.</div>
      <div id="mb-bp-form" style="display: flex; gap: 6px; flex-wrap: wrap; align-items: center;">
        <input id="mb-bp-user" type="text" placeholder="email / username" autocomplete="off" style="flex: 1 1 120px; min-width: 0; padding: 6px 8px; border: 1px solid var(--mbu-border); border-radius: 4px; font-size: 12px;">
        <input id="mb-bp-pass" type="password" placeholder="password" autocomplete="off" style="flex: 1 1 100px; min-width: 0; padding: 6px 8px; border: 1px solid var(--mbu-border); border-radius: 4px; font-size: 12px;">
        <button id="mb-bp-login" style="padding: 6px 12px; background: #0a8754; border: none; border-radius: 4px; color: #FFF; font-size: 12px; cursor: pointer;">Log in</button>
      </div>
      <button id="mb-bp-logout" style="display: none; padding: 5px 12px; background: var(--mbu-bg-sunken); border: none; border-radius: 4px; font-size: 12px; cursor: pointer; margin-top: 6px;">Sign out</button>
    </div>
    <div id="mb-qb-acct" style="padding: 4px; margin-top: 10px; border-top: 1px solid var(--mbu-border); padding-top: 10px;">
      <div style="display: flex; align-items: center; gap: 8px; font-size: 13px; color: var(--mbu-text);">
        <span style="font-weight: 600;">Qobuz account</span>
        <span id="mb-qb-status" style="font-size: 11px; color: var(--mbu-text-weak); margin-left: auto;"></span>
      </div>
      <div style="font-size: 11px; color: var(--mbu-text-weak); margin: 3px 0 7px;">Optional — unlocks Qobuz's session-gated API: <b>reliable</b> Qobuz matching here (track count + barcode via <code>album/get</code>, no store-page scrape), plus Qobuz ISRC import in ISRC Scout and roled Qobuz credits in Credit Hoarder. Only the login token is stored, never your password.</div>
      <div id="mb-qb-form" style="display: flex; gap: 6px; flex-wrap: wrap; align-items: center;">
        <input id="mb-qb-user" type="text" placeholder="email" autocomplete="off" style="flex: 1 1 120px; min-width: 0; padding: 6px 8px; border: 1px solid var(--mbu-border); border-radius: 4px; font-size: 12px;">
        <input id="mb-qb-pass" type="password" placeholder="password" autocomplete="off" style="flex: 1 1 100px; min-width: 0; padding: 6px 8px; border: 1px solid var(--mbu-border); border-radius: 4px; font-size: 12px;">
        <button id="mb-qb-login" style="padding: 6px 12px; background: #0070ef; border: none; border-radius: 4px; color: #FFF; font-size: 12px; cursor: pointer;">Log in</button>
      </div>
      <button id="mb-qb-logout" style="display: none; padding: 5px 12px; background: var(--mbu-bg-sunken); border: none; border-radius: 4px; font-size: 12px; cursor: pointer; margin-top: 6px;">Sign out</button>
    </div>
  </div>
</div>`;

document.body.appendChild(logModal);
document.body.appendChild(providerModal);
const coverArt = sidebar.querySelector('.cover-art');
if (coverArt) sidebar.insertBefore(container, coverArt);
else sidebar.prepend(container);
// Belt-and-suspenders: pin the panel to the sidebar's natural width *now* — measured
// synchronously, before the async scans fill in long meta lines AND before the cover
// art <img> finishes loading — so a content-sized sidebar can't later be stretched
// wide by either. (Measuring later would risk capturing an already-widened sidebar.)
const naturalW = sidebar.clientWidth;
// #355: pin a STABLE width (not just a max) so the panel doesn't visibly grow/reflow
// as async scan results stream longer meta lines in — the "epileptic" resize. At the
// sidebar's full width the panel starts at its final size; the label column
// (minmax(0,1fr) + ellipsis) absorbs long text instead of widening the box.
if (naturalW > 40) { container.style.maxWidth = naturalW + 'px'; container.style.width = naturalW + 'px'; }

const logPanel = document.getElementById('mb-finder-log-panel');
const providerRows = Object.fromEntries(PROVIDER_ORDER.map(p => [p, document.getElementById(`row-${p}`)]));

PROVIDER_ORDER.forEach(p => {
    const enabled = GM_getValue(`pc:prov_${p}`, true);
    if (providerRows[p]) providerRows[p].style.display = enabled ? '' : 'none';   // '' → CSS grid layout applies
});
// platform brand icons (default on) — class on the panel hides them all via CSS
container.classList.toggle('pc-icons-mode', GM_getValue('pc:show-icons', true));
container.classList.toggle('pc-compact-unmatched', GM_getValue('pc:compact-unmatched', true));   // #355 (on by default)
container.classList.toggle('pc-compact-nonstrict', GM_getValue('pc:compact-nonstrict', false));   // #653 (off: a found mismatch keeps its row)
container.classList.toggle('pc-no-names', !GM_getValue('pc:show-names', false));   // names hidden by default (#173) — the brand icon identifies the row
// row layout — 1-row aligned grid (default) vs 2-row stacked (issue #173)
container.classList.add(GM_getValue('pc:layout', '1row') === '2row' ? 'pc-layout-2row' : 'pc-layout-1row');
// How the in-MB marker is drawn (#642). The glow is retired: a stored 'glow' becomes the ring;
// 'gap' was the bold ring's first name, and anything else (the dropped underline) is the ring.
const PC_MARKERS = ['circle', 'bold', 'badge', 'dot', 'square'];
function pcMarker() { const v = GM_getValue('pc:mb-marker', 'circle'); return v === 'gap' ? 'bold' : PC_MARKERS.includes(v) ? v : 'circle'; }
if (GM_getValue('pc:mb-marker', 'circle') === 'glow') GM_setValue('pc:mb-marker', 'circle');
function pcApplyMarker(m) { for (const x of PC_MARKERS) container.classList.toggle('pc-mark-' + x, x === m); }
pcApplyMarker(pcMarker());
container.classList.toggle('pc-fmt-text', GM_getValue('pc:format-marker', 'circle') === 'text');   // format as text instead of the quadrant circle
// compact-view spacing + name font size (#178) — applied as CSS variables the
// layout rules read (row/column gap in 1-row, row gap = flex gap in 2-row).
container.style.setProperty('--pc-row-gap',  `${GM_getValue('pc:row-gap', 5)}px`);
container.style.setProperty('--pc-col-gap',  `${GM_getValue('pc:col-gap', 5)}px`);
container.style.setProperty('--pc-name-size', `${GM_getValue('pc:name-size', 12)}px`);
container.style.setProperty('--pc-icon-size', `${GM_getValue('pc:icon-size', 22)}px`);   // #188 platform icon size
refreshCompactStrip();   // #355: start everything compact (rows rise out as they match)

// Provider-reorder controls in the providers modal — drag-and-drop. Each row
// is draggable; dragover on a sibling reorders via the cursor's Y-midpoint
// (above-mid = insert before, below-mid = insert after). Save reads the
// resulting DOM order, persists to pc:provider-order, and reloads so the
// sidebar re-renders rows in the new sequence.
{
    let dragged = null;
    const list = providerModal.querySelector('#mb-provider-list');
    // Persist the modal's current row order and reorder the sidebar rows LIVE —
    // no page reload (#175). Moving the (display:contents) row divs reorders
    // their cells in the grid; row-mb + the separator stay pinned at the top.
    const commitProviderOrder = () => {
        const order = [...list.querySelectorAll('.pc-prov-row')].map(r => r.dataset.provider);
        GM_setValue('pc:provider-order', JSON.stringify(order));
        const rowsContainer = container.querySelector('.pc-rows');
        if (rowsContainer) order.forEach(p => { if (providerRows[p]) rowsContainer.appendChild(providerRows[p]); });
    };
    for (const row of list.querySelectorAll('.pc-prov-row')) {
        row.addEventListener('dragstart', e => {
            dragged = row;
            row.style.opacity = '0.4';
            e.dataTransfer.effectAllowed = 'move';
            // Some browsers require setData() for drag to start.
            try { e.dataTransfer.setData('text/plain', row.dataset.provider); } catch (_) {}
        });
        row.addEventListener('dragend', () => {
            row.style.opacity = '';
            for (const r of list.querySelectorAll('.pc-prov-row')) r.style.borderColor = 'transparent';
            dragged = null;
        });
        row.addEventListener('dragover', e => {
            if (!dragged || dragged === row) return;
            e.preventDefault();
            e.dataTransfer.dropEffect = 'move';
            const rect = row.getBoundingClientRect();
            const after = e.clientY > rect.top + rect.height / 2;
            // Visual hint: highlight which edge will receive the drop.
            row.style.borderColor = 'var(--mbu-ok)';
            row.style.borderTopColor    = after ? 'transparent' : 'var(--mbu-ok)';
            row.style.borderBottomColor = after ? 'var(--mbu-ok)'     : 'transparent';
            row.style.borderLeftColor   = 'transparent';
            row.style.borderRightColor  = 'transparent';
        });
        row.addEventListener('dragleave', () => { row.style.borderColor = 'transparent'; });
        row.addEventListener('drop', e => {
            e.preventDefault();
            if (!dragged || dragged === row) return;
            const rect = row.getBoundingClientRect();
            const after = e.clientY > rect.top + rect.height / 2;
            list.insertBefore(dragged, after ? row.nextSibling : row);
            commitProviderOrder();
        });
    }
}

// Pin a modal to the VISUAL viewport on narrow/zoomed screens. On tablets where
// MusicBrainz's desktop layout overflows the browser's layout viewport, the page
// overflows and the browser zooms to fit; a position:fixed modal is then anchored
// to the narrow layout viewport and lands in a corner. window.visualViewport
// reflects what's actually on screen (zoom scale + offset), so we size the overlay
// to it and centre the card within it. No-op on desktop / without VisualViewport.
const logCardEl = () => document.getElementById('mb-log-modal-card');
const provCardEl = () => document.getElementById('mb-provider-modal-card');
let _pcActive = null, _pcVVSync = null;
// The overlay + card keep their base layout (width:100vw, top/left, the card's
// centering + width) in their INLINE cssText. Pinning overrides a subset of those
// with !important, so unpinning must RESTORE the base — not removeProperty(), which
// would also delete the base values that share the inline declaration (that bug
// collapsed the modals to a corner on desktop, where pin no-ops straight through
// unpin on the first open). So snapshot cssText once and restore it verbatim.
function pcSnapshotBase(el) { if (el && el._pcBaseCss == null) el._pcBaseCss = el.style.cssText; }
function pcPinModal(overlay, card, maxW, fill) {
    pcSnapshotBase(overlay); pcSnapshotBase(card);
    const vv = window.visualViewport;
    if (!vv || !window.matchMedia('(max-width: 640px)').matches) { pcUnpinModal(overlay, card); return; }
    const imp = (el, o) => { for (const k in o) el.style.setProperty(k, o[k], 'important'); };
    const w = Math.min(vv.width * 0.96, maxW), h = vv.height * 0.96;
    imp(overlay, { left: vv.offsetLeft + 'px', top: vv.offsetTop + 'px', width: vv.width + 'px', height: vv.height + 'px', padding: '0' });
    const c = { position: 'fixed', left: (vv.offsetLeft + vv.width / 2) + 'px', top: (vv.offsetTop + vv.height / 2) + 'px',
        transform: 'translate(-50%, -50%)', margin: '0', 'max-width': 'none', width: w + 'px', 'max-height': h + 'px' };
    if (fill) c.height = h + 'px';
    imp(card, c);
}
function pcUnpinModal(overlay, card) {
    if (overlay && overlay._pcBaseCss != null) overlay.style.cssText = overlay._pcBaseCss;
    if (card && card._pcBaseCss != null) card.style.cssText = card._pcBaseCss;
}
function pcOpenModal(overlay, card, maxW, fill) {
    overlay.style.display = 'block';
    _pcActive = { overlay, card, maxW, fill };
    pcPinModal(overlay, card, maxW, fill);
    if (window.visualViewport && !_pcVVSync) {
        _pcVVSync = () => { if (_pcActive) pcPinModal(_pcActive.overlay, _pcActive.card, _pcActive.maxW, _pcActive.fill); };
        window.visualViewport.addEventListener('resize', _pcVVSync);
        window.visualViewport.addEventListener('scroll', _pcVVSync);
    }
}
const closeAllModals = () => {
    if (_pcVVSync && window.visualViewport) {
        window.visualViewport.removeEventListener('resize', _pcVVSync);
        window.visualViewport.removeEventListener('scroll', _pcVVSync);
        _pcVVSync = null;
    }
    // restore the base cssText FIRST (it carries display:block from the snapshot),
    // then force display:none last so the modal actually ends up hidden
    pcUnpinModal(logModal, logCardEl()); pcUnpinModal(providerModal, provCardEl());
    logModal.style.display = 'none'; providerModal.style.display = 'none';
    _pcActive = null;
};
logModal.addEventListener('click', e => { if (!document.getElementById('mb-log-modal-card').contains(e.target)) closeAllModals(); });
providerModal.addEventListener('click', e => { if (!document.getElementById('mb-provider-modal-card').contains(e.target)) closeAllModals(); });
document.addEventListener('keydown', e => { if (e.key === 'Escape') closeAllModals(); });

document.getElementById('mb-log-open-btn').addEventListener('click', () => { pcOpenModal(logModal, logCardEl(), 900, true); });

// Provider-filter chips: exclusive selection. Click a chip → only that
// source's entries remain visible (every other chip dims to .off). Click
// the same chip again → back to "all sources visible". CSS-driven via the
// `pc-hide-<source>` classes on the log panel; no per-entry DOM walk.
let activeFilter = null;     // null = show everything
for (const chip of logModal.querySelectorAll('.pc-log-chip')) {
    chip.addEventListener('click', () => {
        const src = chip.dataset.source;
        activeFilter = (activeFilter === src) ? null : src;   // click again = clear
        // Refresh chip dimming.
        for (const c of logModal.querySelectorAll('.pc-log-chip')) {
            const isActive = activeFilter === null || c.dataset.source === activeFilter;
            c.classList.toggle('off', !isActive);
        }
        // Refresh panel hide-classes: hide every source except the active one.
        for (const s of LOG_SOURCES) {
            const key = pcLogKey(s);
            logPanel.classList.toggle(`pc-hide-${key}`, activeFilter !== null && key !== activeFilter);
        }
    });
}
// Beatport-account UI state (logged in → show "Sign out"; logged out → show login form)
function bpRefreshSetupUI(msg, isErr) {
    const st = document.getElementById('mb-bp-status'), form = document.getElementById('mb-bp-form'), out = document.getElementById('mb-bp-logout');
    if (!st) return;
    const inOk = bpLoggedIn();
    form.style.display = inOk ? 'none' : 'flex';
    out.style.display = inOk ? 'inline-block' : 'none';
    st.textContent = msg || (inOk ? 'signed in' : 'not signed in');
    st.style.color = isErr ? 'var(--mbu-error)' : (inOk ? 'var(--mbu-ok)' : 'var(--mbu-text-weak)');
}
document.getElementById('mb-bp-login').addEventListener('click', async () => {
    const u = document.getElementById('mb-bp-user').value.trim(), p = document.getElementById('mb-bp-pass').value;
    if (!u || !p) { bpRefreshSetupUI('enter email + password', true); return; }
    bpRefreshSetupUI('signing in…');
    const r = await beatportLogin(u, p);
    document.getElementById('mb-bp-pass').value = '';
    bpRefreshSetupUI(r.ok ? 'signed in ✓ — ↻ to re-scan Beatport' : `failed: ${r.error}`, !r.ok);
});
document.getElementById('mb-bp-logout').addEventListener('click', () => { bpWrite(null); document.getElementById('mb-bp-user').value = ''; bpRefreshSetupUI('signed out'); });
// Qobuz-account UI state (mirrors Beatport)
function qbRefreshSetupUI(msg, isErr) {
    const st = document.getElementById('mb-qb-status'), form = document.getElementById('mb-qb-form'), out = document.getElementById('mb-qb-logout');
    if (!st) return;
    const inOk = qbLoggedIn();
    form.style.display = inOk ? 'none' : 'flex';
    out.style.display = inOk ? 'inline-block' : 'none';
    st.textContent = msg || (inOk ? 'signed in' : 'not signed in');
    st.style.color = isErr ? 'var(--mbu-error)' : (inOk ? 'var(--mbu-ok)' : 'var(--mbu-text-weak)');
}
document.getElementById('mb-qb-login').addEventListener('click', async () => {
    const u = document.getElementById('mb-qb-user').value.trim(), p = document.getElementById('mb-qb-pass').value;
    if (!u || !p) { qbRefreshSetupUI('enter email + password', true); return; }
    qbRefreshSetupUI('signing in…');
    const r = await qobuzLogin(u, p);
    document.getElementById('mb-qb-pass').value = '';
    qbRefreshSetupUI(r.ok ? 'signed in ✓ — ↻ to re-scan Qobuz here; ISRC Scout & Credit Hoarder can use it too' : `failed: ${r.error}`, !r.ok);
});
document.getElementById('mb-qb-logout').addEventListener('click', () => { qbWrite(null); document.getElementById('mb-qb-user').value = ''; qbRefreshSetupUI('signed out'); });
document.getElementById('mb-token-setup-btn').addEventListener('click', () => {
    PROVIDER_ORDER.forEach(p => { document.getElementById(`mb-toggle-${p}`).checked = GM_getValue(`pc:prov_${p}`, true); });
    document.getElementById('mb-show-icons').checked = GM_getValue('pc:show-icons', true);
    document.getElementById('mb-show-names').checked = GM_getValue('pc:show-names', false);
    document.getElementById('mb-respect-barcode').checked = GM_getValue('pc:respect-barcode', true);
    document.getElementById('mb-barcode-mode').value = GM_getValue('pc:barcode-mode', 'exists');
    document.getElementById('mb-barcode-mode').disabled = !GM_getValue('pc:respect-barcode', true);
    document.getElementById('mb-respect-format').checked = GM_getValue('pc:respect-format', true);
    document.getElementById('mb-format-mode').value = GM_getValue('pc:format-mode', 'exists');
    document.getElementById('mb-format-mode').disabled = !GM_getValue('pc:respect-format', true);
    document.getElementById('mb-open-new-tab').checked = GM_getValue('pc:open-new-tab', true);
    document.getElementById('mb-bg-audio').checked = GM_getValue('pc:bg-audio', false);
    const layout = GM_getValue('pc:layout', '1row');
    providerModal.querySelectorAll('input[name="mb-layout"]').forEach(r => { r.checked = r.value === layout; });
    document.getElementById('mb-compact-unmatched').checked = GM_getValue('pc:compact-unmatched', true);
    document.getElementById('mb-compact-nonstrict').checked = GM_getValue('pc:compact-nonstrict', false);
    providerModal.querySelector('#mb-marker').value = pcMarker();
    const fmtMarkerMode = GM_getValue('pc:format-marker', 'circle');
    providerModal.querySelectorAll('input[name="format-marker"]').forEach(r => { r.checked = r.value === fmtMarkerMode; });
    bpRefreshSetupUI();
    qbRefreshSetupUI();
    showSetupView('main');   // #188 always open on the main view
    pcOpenModal(providerModal, provCardEl(), 440, false);
});
document.getElementById('mb-provider-close-btn').addEventListener('click', closeAllModals);
// #188 setup is split into a compact main view + "Order & visibility" and "Auth"
// sub-views that replace the card content, each with a ‹ Back to the main view.
function showSetupView(name) {
    ['main', 'order', 'auth'].forEach(v => { const el = document.getElementById('mb-setup-' + v); if (el) el.style.display = v === name ? '' : 'none'; });
}
document.getElementById('mb-view-order').addEventListener('click', () => showSetupView('order'));
document.getElementById('mb-view-auth').addEventListener('click', () => showSetupView('auth'));
providerModal.querySelectorAll('.pc-setup-back').forEach(b => b.addEventListener('click', () => showSetupView('main')));
// Real-time config (#175): each control applies + persists the instant it
// changes — no Save button, no reload, and the sidebar updates live behind the
// (now backdrop-free) settings card.
PROVIDER_ORDER.forEach(p => {
    document.getElementById(`mb-toggle-${p}`).addEventListener('change', e => {
        GM_setValue(`pc:prov_${p}`, e.target.checked);
        if (providerRows[p]) providerRows[p].style.display = e.target.checked ? '' : 'none';
    });
});
document.getElementById('mb-show-icons').addEventListener('change', e => {
    GM_setValue('pc:show-icons', e.target.checked);
    container.classList.toggle('pc-icons-mode', e.target.checked);
});
document.getElementById('mb-compact-unmatched').addEventListener('change', e => {
    GM_setValue('pc:compact-unmatched', e.target.checked);   // #355
    container.classList.toggle('pc-compact-unmatched', e.target.checked);
    refreshCompactStrip();
});
document.getElementById('mb-compact-nonstrict').addEventListener('change', e => {
    GM_setValue('pc:compact-nonstrict', e.target.checked);   // #653
    container.classList.toggle('pc-compact-nonstrict', e.target.checked);
    refreshCompactStrip();
});
document.getElementById('mb-show-names').addEventListener('change', e => {
    GM_setValue('pc:show-names', e.target.checked);
    container.classList.toggle('pc-no-names', !e.target.checked);
});
document.getElementById('mb-respect-barcode').addEventListener('change', e => {
    GM_setValue('pc:respect-barcode', e.target.checked);   // (#182) gate + / ↗ on barcode match
    document.getElementById('mb-barcode-mode').disabled = !e.target.checked;
});
document.getElementById('mb-barcode-mode').addEventListener('change', e => {
    GM_setValue('pc:barcode-mode', e.target.value);        // 'exists' (known mismatch only) | 'strict' (also unconfirmable)
});
document.getElementById('mb-respect-format').addEventListener('change', e => {
    GM_setValue('pc:respect-format', e.target.checked);    // (#182) gate + / ↗ on format compatibility
    document.getElementById('mb-format-mode').disabled = !e.target.checked;
});
document.getElementById('mb-format-mode').addEventListener('change', e => {
    GM_setValue('pc:format-mode', e.target.value);         // 'exists' (known incompatible only) | 'strict' (also undeterminable)
});
document.getElementById('mb-open-new-tab').addEventListener('change', e => {
    GM_setValue('pc:open-new-tab', e.target.checked);      // #464 — off navigates the same tab instead of opening one
});
document.getElementById('mb-bg-audio').addEventListener('change', e => {
    // key kept as pc:bg-audio although it now means "keep awake by any means":
    // renaming it would silently switch the setting back OFF for anyone who has
    // already turned it on.
    GM_setValue('pc:bg-audio', e.target.checked);          // #556 — WebRTC loopback (or a tone) so Firefox stops throttling the background-add tab
});
providerModal.querySelectorAll('input[name="mb-layout"]').forEach(r => r.addEventListener('change', () => {
    const layout = (providerModal.querySelector('input[name="mb-layout"]:checked') || {}).value || '1row';
    GM_setValue('pc:layout', layout);
    container.classList.toggle('pc-layout-1row', layout !== '2row');
    container.classList.toggle('pc-layout-2row', layout === '2row');
}));
providerModal.querySelector('#mb-marker').addEventListener('change', (e) => {
    const marker = PC_MARKERS.includes(e.target.value) ? e.target.value : 'circle';
    GM_setValue('pc:mb-marker', marker);
    pcApplyMarker(marker);
});
providerModal.querySelectorAll('input[name="format-marker"]').forEach(r => r.addEventListener('change', () => {
    const mode = (providerModal.querySelector('input[name="format-marker"]:checked') || {}).value || 'circle';
    GM_setValue('pc:format-marker', mode);
    container.classList.toggle('pc-fmt-text', mode === 'text');   // live — both are already in the DOM, CSS just swaps which shows
}));
// Compact-view sliders (#178): set the matching CSS variable live + persist.
[['mb-row-gap', 'pc:row-gap', '--pc-row-gap', 5], ['mb-col-gap', 'pc:col-gap', '--pc-col-gap', 5], ['mb-name-size', 'pc:name-size', '--pc-name-size', 12], ['mb-icon-size', 'pc:icon-size', '--pc-icon-size', 22]].forEach(([id, key, prop, def]) => {
    const el = document.getElementById(id);
    const valEl = document.getElementById(`${id}-val`);
    const apply = v => { container.style.setProperty(prop, `${v}px`); if (valEl) valEl.textContent = String(v); };
    el.value = GM_getValue(key, def);
    apply(el.value);
    el.addEventListener('input', () => { GM_setValue(key, Number(el.value)); apply(el.value); });
});
document.getElementById('mb-modal-copy-btn').addEventListener('click', async function () {
    // Firefox throws NS_ERROR_NOT_INITIALIZED from clipboard.writeText when
    // the document isn't focused. Fall back to a textarea + execCommand on
    // failure rather than letting the unhandled rejection surface.
    // Wrap in a collapsed <details> + fenced block so it pastes into a GitHub
    // issue/comment as a tidy, foldable log rather than a wall of text.
    const raw = (logPanel.innerText || '').trim();
    const text = '<details><summary>Platform Check Log</summary>\n\n```\n' + raw + '\n```\n\n</details>\n';
    const flash = msg => { this.textContent = msg; setTimeout(() => { this.textContent = 'Copy'; }, 1500); };
    try {
        await navigator.clipboard.writeText(text);
        flash('Copied!');
    } catch (e) {
        const ta = document.createElement('textarea');
        ta.value = text; ta.style.cssText = 'position:fixed;left:-9999px;';
        document.body.appendChild(ta); ta.select();
        let ok = false;
        try { ok = document.execCommand('copy'); } catch (_) {}
        ta.remove();
        flash(ok ? 'Copied!' : 'Copy failed');
    }
});

function appendLog(platform, msg, kind = 'info') {
    const color = kind === 'error' ? '#FF6B6B' : kind === 'warn' ? '#EBCB8B' : kind === 'ok' ? '#A3BE8C' : '#88C0D0';
    const ts = new Date().toLocaleTimeString();
    // data-platform lets the modal's per-provider filter chips toggle entries
    // via CSS (`#mb-finder-log-panel.pc-hide-<platform> [data-platform=…]`).
    logPanel.insertAdjacentHTML('beforeend', `<div data-platform="${pcLogKey(platform)}" style="margin-bottom: 3px; border-left: 3px solid ${color}; padding-left: 6px;"><span style="color: var(--mbu-text-dim);">[${ts}]</span> <span style="color: ${color}; font-weight: bold;">[${platform}]</span> <span style="color: var(--mbu-text-weak);">${msg}</span></div>`);
    logPanel.scrollTop = logPanel.scrollHeight;
}
appendLog('System', mbuStartupInfo('Platform Check') + ' — startup');

// #556: the background add's stage timeline, surfaced HERE — see pcMark. The
// tab it happens in closes itself and this page reloads underneath it, so the
// console it was written to is unreachable by the time anyone would look.
// Drained from localStorage on mount (which is the reload right after a
// commit), and streamed live over the channel while a run is in progress.
{
    const seen = new Set();
    const show = (e) => {
        if (!e || !e.id || seen.has(e.id)) return;
        seen.add(e.id);
        const kind = /DISABLED|not found/.test(e.line) ? 'warn' : /edit committed/.test(e.line) ? 'ok' : 'info';
        // 'System', not a source of its own: LOG_SOURCES drives the filter chips
        // and a source that isn't in it can never be filtered out again.
        appendLog('System', 'background add: ' + e.line, kind);
    };
    try { (JSON.parse(localStorage.getItem('pc:bg-log') || '[]') || []).forEach(show); } catch (e) {}
    if (PC_CHANNEL) {
        try {
            PC_CHANNEL.addEventListener('message', (ev) => {
                if (ev && ev.data && ev.data.type === 'pc-bg-log') show(ev.data.entry);
            });
        } catch (e) {}
    }
}

// ─── GM_xmlhttpRequest wrapper that returns a Promise ──────────────────────
// MusicBrainz's /ws/2 goes through the shared request gate (#633): its slot first, and its
// hold after a 429/503 (one retry, which waits the hold out); everything else goes straight.
const pcGateLog = (lv, m) => appendLog('MusicBrainz', m, lv === 'warn' ? 'warn' : undefined);
async function gmGet(url, o) {
    if (!mbnGated(url)) return gmGetRaw(url, o);
    for (let attempt = 1; ; attempt++) {
        await mbnSlot({ label: '/ws/2/' + url.split('/ws/2/').pop(), log: pcGateLog });
        const r = await gmGetRaw(url, o);
        const a = await mbnAnswer(r.status, n => mbnRawHeader(r.responseHeaders, n), { log: pcGateLog });
        if (!a.throttled || attempt >= 2) return r;
    }
}
function gmGetRaw(url, { responseType, headers, timeout = 15000, anonymous } = {}) {
    return new Promise((resolve) => {
        const t0 = Date.now();
        const opts = {
            method: 'GET',
            url,
            headers: {
                // MB's API rejects bare "Mozilla/5.0" with 403; it expects an app
                // string. DDG's anti-bot meanwhile rejects detailed Chrome UAs —
                // searchWeb() overrides to "Mozilla/5.0" for its calls only.
                'User-Agent': 'PlatformCheck/12 (https://github.com/majkinetor/mb-userscripts)',
                'Accept-Language': 'en-US,en;q=0.9',
                ...headers,
            },
            timeout,
            onload(res) {
                const ms = Date.now() - t0;
                resolve({ ok: res.status >= 200 && res.status < 400, status: res.status, finalUrl: res.finalUrl || url, responseText: res.responseText || '', responseHeaders: res.responseHeaders || '', ms });
            },
            onerror(err)  { resolve({ ok: false, status: 0, finalUrl: url, responseText: '', error: String(err?.error || err?.statusText || err), ms: Date.now() - t0 }); },
            ontimeout()   { resolve({ ok: false, status: 0, finalUrl: url, responseText: '', error: 'timeout', ms: Date.now() - t0 }); },
        };
        if (responseType) opts.responseType = responseType;
        if (anonymous) opts.anonymous = true;   // omit the browser's ambient cookies
        GM_xmlhttpRequest(opts);
    });
}

// POST counterpart of gmGet, used for the Tidal client-credentials token grant.
function gmPost(url, data, { headers, timeout = 15000, anonymous } = {}) {
    return new Promise((resolve) => {
        const t0 = Date.now();
        const opts = {
            method: 'POST', url, data,
            headers: { 'Accept-Language': 'en-US,en;q=0.9', ...headers },
            timeout,
            onload(res)  { resolve({ ok: res.status >= 200 && res.status < 400, status: res.status, finalUrl: res.finalUrl || url, responseText: res.responseText || '', responseHeaders: res.responseHeaders || '', ms: Date.now() - t0 }); },
            onerror(err) { resolve({ ok: false, status: 0, responseText: '', error: String(err?.error || err?.statusText || err), ms: Date.now() - t0 }); },
            ontimeout()  { resolve({ ok: false, status: 0, responseText: '', error: 'timeout', ms: Date.now() - t0 }); },
        };
        if (anonymous) opts.anonymous = true;
        GM_xmlhttpRequest(opts);
    });
}

// ─── Tidal API (client-credentials app token; baked-in shared installed app) ──
const TIDAL = {
    clientId:     'cRhhDJDpYXXBn82U',
    clientSecret: 'K7UX40jDOZ5p4y4JMYZgoiwKi7jymTHWcLMb4gkewKs=',
    tokenUrl: 'https://auth.tidal.com/v1/oauth2/token',
    api:      'https://openapi.tidal.com/v2',
    country:  'US',
};
let _tidalTok = null, _tidalTokExp = 0;
async function tidalToken() {
    if (_tidalTok && Date.now() < _tidalTokExp - 60000) return _tidalTok;
    const basic = btoa(`${TIDAL.clientId}:${TIDAL.clientSecret}`);
    const r = await gmPost(TIDAL.tokenUrl, 'grant_type=client_credentials',
        { headers: { 'Authorization': `Basic ${basic}`, 'Content-Type': 'application/x-www-form-urlencoded' } });
    if (!r.ok) { appendLog('Tidal', `token grant failed (${r.status})`, 'error'); return null; }
    try {
        const j = JSON.parse(r.responseText);
        if (!j.access_token) { appendLog('Tidal', `token grant: no access_token`, 'error'); return null; }
        _tidalTok = j.access_token;
        _tidalTokExp = Date.now() + ((j.expires_in || 14400) * 1000);
        return _tidalTok;
    } catch (e) { appendLog('Tidal', `token JSON parse: ${e.message}`, 'error'); return null; }
}

// ── Beatport API auth (PKCE; token shared with ISRC Scout via musicbrainz.org localStorage) ──
// Beatport's catalog API needs an OAuth2 Bearer. No app registration exists, but the web
// app's *public* client_id + the user's own login (PKCE authorization_code) yields a token
// that returns track counts — enabling verified matches and the + insert. We store ONLY the
// tokens (never the password), renew silently via the refresh token, and share them with
// ISRC Scout through a localStorage key on this origin (config/login lives here in PC).
const BEATPORT = {
    clientId: '0GIvkCltVIuPkkwSJHp6NDb3s0potTjLBQr388Dd',          // Beatport web-app client (public, from their docs JS)
    redirect: 'https://api.beatport.com/v4/auth/o/post-message/',
    api:      'https://api.beatport.com/v4',
    origin:   'https://api.beatport.com',
    store:    'mbtools:beatport',
};
// Beatport's API runs Django CSRF protection that engages whenever a valid
// beatport.com session cookie rides along. GM_xmlhttpRequest shares the browser
// cookie jar, so any lingering beatport.com session (from a prior login on this
// browser) makes Django session-authenticate the request and then demand a CSRF
// token it can't supply — failing the login. Rather than read/echo that cookie
// (GM_cookie is domain-restricted to the page origin on some managers and can't
// see beatport.com at all), the login flow runs the requests `anonymous` (no
// ambient cookies) and threads the fresh session it creates itself — so the
// outcome never depends on the browser's existing Beatport state.
// Static origin/referer still need to be the API's OWN origin (Django always
// trusts a request's own origin; www.beatport.com is NOT in its trusted set).
const bpHeaders = () => ({ Referer: BEATPORT.origin + '/', Origin: BEATPORT.origin });

const bpRead     = () => { try { return JSON.parse(localStorage.getItem(BEATPORT.store) || 'null'); } catch { return null; } };
const bpWrite    = t  => { try { t ? localStorage.setItem(BEATPORT.store, JSON.stringify(t)) : localStorage.removeItem(BEATPORT.store); } catch {} };
const bpLoggedIn = () => { const t = bpRead(); return !!(t && t.refresh_token); };
const bpB64url   = buf => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
async function bpPkce() { const v = bpB64url(crypto.getRandomValues(new Uint8Array(48))); const c = bpB64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(v))); return { v, c }; }

// Full login → token. Returns { ok } or { ok:false, error }. Used by PC's setup UI.
// Two cases, both ending at a non-anonymous authorize GET that consumes a
// session cookie from the shared jar:
//   • Fresh browser — the normal login POST mints that session in the jar.
//   • Browser already holds a beatport.com session — that ambient cookie makes
//     Django enforce CSRF on the login POST (which we can't satisfy: GM_cookie
//     is domain-restricted and Set-Cookie is hidden on some managers). But the
//     existing session is itself valid and is accepted by the authorize GET, so
//     we just validate the typed credentials out-of-band (anonymous → no
//     session → no CSRF) and reuse that session.
async function beatportLogin(username, password) {
    let lr = await gmPost(`${BEATPORT.api}/auth/login/`, JSON.stringify({ username, password }), { headers: { 'Content-Type': 'application/json', ...bpHeaders() } });
    if (!lr.ok && /csrf/i.test(lr.responseText || '')) {
        appendLog('Beatport', 'login blocked by an existing browser Beatport session — validating credentials and reusing that session…');
        lr = await gmPost(`${BEATPORT.api}/auth/login/`, JSON.stringify({ username, password }), { anonymous: true, headers: { 'Content-Type': 'application/json', ...bpHeaders() } });
    }
    if (!lr.ok) {
        let m = 'incorrect username or password';
        try { const j = JSON.parse(lr.responseText); m = (typeof j === 'string' ? j : j.detail) || m; } catch {}
        appendLog('Beatport', `login rejected — HTTP ${lr.status}: ${m}`, 'error');
        return { ok: false, error: m };
    }

    const { v, c } = await bpPkce();
    const au = `${BEATPORT.api}/auth/o/authorize/?response_type=code&client_id=${BEATPORT.clientId}&redirect_uri=${encodeURIComponent(BEATPORT.redirect)}&code_challenge=${c}&code_challenge_method=S256`;
    const ar = await gmGet(au, { headers: bpHeaders() });   // non-anonymous: uses the jar session (fresh-from-login or existing browser)
    const code = ((ar.finalUrl || '').match(/[?&#]code=([^&]+)/) || [])[1];
    if (!code) {
        appendLog('Beatport', `authorize returned no code — HTTP ${ar.status}; no usable Beatport session in the browser. Log in at beatport.com in this browser, then retry.`, 'error');
        return { ok: false, error: 'no authorization code returned' };
    }
    const tr = await gmPost(`${BEATPORT.api}/auth/o/token/`, new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: BEATPORT.redirect, client_id: BEATPORT.clientId, code_verifier: v }).toString(), { anonymous: true, headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...bpHeaders() } });
    let j; try { j = JSON.parse(tr.responseText); } catch { appendLog('Beatport', `token exchange — unparseable response (HTTP ${tr.status})`, 'error'); return { ok: false, error: 'token response parse failed' }; }
    if (!j.access_token) { const e = j.error_description || j.error || 'no access token'; appendLog('Beatport', `token exchange failed — ${e}`, 'error'); return { ok: false, error: e }; }
    bpWrite({ access_token: j.access_token, refresh_token: j.refresh_token, exp: Date.now() + ((j.expires_in || 36000) * 1000) });
    appendLog('Beatport', `logged in (token scope: ${j.scope || '?'})`, 'ok');
    return { ok: true };
}
// Valid access token, renewing via refresh_token when needed; null if not logged in / refresh failed.
async function beatportToken() {
    const t = bpRead();
    if (!t || !t.refresh_token) return null;
    if (t.access_token && Date.now() < t.exp - 60000) return t.access_token;
    const tr = await gmPost(`${BEATPORT.api}/auth/o/token/`, new URLSearchParams({ grant_type: 'refresh_token', refresh_token: t.refresh_token, client_id: BEATPORT.clientId }).toString(), { anonymous: true, headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...bpHeaders() } });
    let j; try { j = JSON.parse(tr.responseText); } catch { j = {}; }
    if (!j.access_token) { appendLog('Beatport', 'token refresh failed — log in again in ⚙ setup', 'warn'); return null; }
    bpWrite({ access_token: j.access_token, refresh_token: j.refresh_token || t.refresh_token, exp: Date.now() + ((j.expires_in || 36000) * 1000) });
    return j.access_token;
}
// ── Qobuz API auth (email + password login; token shared with ISRC Scout + Credit Hoarder) ──
// Qobuz's per-track data (ISRCs + roled `performers`) lives behind `album/get`, which is
// session-gated — anonymous requests 404/401 regardless of app_id (see #353). A logged-in
// user_auth_token unlocks it. We log in with the user's own credentials, store ONLY the token
// (never the password), and share it — like the Beatport token — via a localStorage key on this
// origin, so ISRC Scout (ISRCs) and Credit Hoarder (roled credits) can read it without re-auth.
const QOBUZ = {
    appId: '712109809',                                  // anonymous web-player app_id (accepted for login + album/get with a token)
    api:   'https://www.qobuz.com/api.json/0.2',
    store: 'mbtools:qobuz',
};
const qbRead     = () => { try { return JSON.parse(localStorage.getItem(QOBUZ.store) || 'null'); } catch { return null; } };
const qbWrite    = t  => { try { t ? localStorage.setItem(QOBUZ.store, JSON.stringify(t)) : localStorage.removeItem(QOBUZ.store); } catch {} };
const qbLoggedIn = () => { const t = qbRead(); return !!(t && t.token); };
// Compact MD5 (public-domain, Joseph Myers) — Qobuz's user/login wants the password as an MD5 hex
// digest, which SubtleCrypto can't produce. Only used to sign the login request; nothing is stored.
function md5(str) {
    function rl(n, c) { return (n << c) | (n >>> (32 - c)); }
    function au(x, y) { const l = (x & 0xFFFF) + (y & 0xFFFF); return (((x >> 16) + (y >> 16) + (l >> 16)) << 16) | (l & 0xFFFF); }
    function cmn(q, a, b, x, s, t) { return au(rl(au(au(a, q), au(x, t)), s), b); }
    const ff = (a, b, c, d, x, s, t) => cmn((b & c) | (~b & d), a, b, x, s, t);
    const gg = (a, b, c, d, x, s, t) => cmn((b & d) | (c & ~d), a, b, x, s, t);
    const hh = (a, b, c, d, x, s, t) => cmn(b ^ c ^ d, a, b, x, s, t);
    const ii = (a, b, c, d, x, s, t) => cmn(c ^ (b | ~d), a, b, x, s, t);
    const bytes = new TextEncoder().encode(str), n = bytes.length, x = [];   // UTF-8
    for (let i = 0; i < n; i++) x[i >> 2] |= bytes[i] << ((i % 4) * 8);
    x[n >> 2] |= 0x80 << ((n % 4) * 8);
    x[(((n + 8) >> 6) * 16) + 14] = n * 8;
    let a = 1732584193, b = -271733879, c = -1732584194, d = 271733878;
    for (let i = 0; i < x.length; i += 16) {
        const oa = a, ob = b, oc = c, od = d, g = j => x[i + j] | 0;
        a = ff(a,b,c,d,g(0),7,-680876936);  d = ff(d,a,b,c,g(1),12,-389564586); c = ff(c,d,a,b,g(2),17,606105819);  b = ff(b,c,d,a,g(3),22,-1044525330);
        a = ff(a,b,c,d,g(4),7,-176418897);  d = ff(d,a,b,c,g(5),12,1200080426); c = ff(c,d,a,b,g(6),17,-1473231341); b = ff(b,c,d,a,g(7),22,-45705983);
        a = ff(a,b,c,d,g(8),7,1770035416);  d = ff(d,a,b,c,g(9),12,-1958414417); c = ff(c,d,a,b,g(10),17,-42063);    b = ff(b,c,d,a,g(11),22,-1990404162);
        a = ff(a,b,c,d,g(12),7,1804603682); d = ff(d,a,b,c,g(13),12,-40341101); c = ff(c,d,a,b,g(14),17,-1502002290); b = ff(b,c,d,a,g(15),22,1236535329);
        a = gg(a,b,c,d,g(1),5,-165796510);  d = gg(d,a,b,c,g(6),9,-1069501632); c = gg(c,d,a,b,g(11),14,643717713); b = gg(b,c,d,a,g(0),20,-373897302);
        a = gg(a,b,c,d,g(5),5,-701558691);  d = gg(d,a,b,c,g(10),9,38016083);  c = gg(c,d,a,b,g(15),14,-660478335); b = gg(b,c,d,a,g(4),20,-405537848);
        a = gg(a,b,c,d,g(9),5,568446438);   d = gg(d,a,b,c,g(14),9,-1019803690); c = gg(c,d,a,b,g(3),14,-187363961); b = gg(b,c,d,a,g(8),20,1163531501);
        a = gg(a,b,c,d,g(13),5,-1444681467); d = gg(d,a,b,c,g(2),9,-51403784);  c = gg(c,d,a,b,g(7),14,1735328473); b = gg(b,c,d,a,g(12),20,-1926607734);
        a = hh(a,b,c,d,g(5),4,-378558);     d = hh(d,a,b,c,g(8),11,-2022574463); c = hh(c,d,a,b,g(11),16,1839030562); b = hh(b,c,d,a,g(14),23,-35309556);
        a = hh(a,b,c,d,g(1),4,-1530992060); d = hh(d,a,b,c,g(4),11,1272893353); c = hh(c,d,a,b,g(7),16,-155497632); b = hh(b,c,d,a,g(10),23,-1094730640);
        a = hh(a,b,c,d,g(13),4,681279174);  d = hh(d,a,b,c,g(0),11,-358537222); c = hh(c,d,a,b,g(3),16,-722521979); b = hh(b,c,d,a,g(6),23,76029189);
        a = hh(a,b,c,d,g(9),4,-640364487);  d = hh(d,a,b,c,g(12),11,-421815835); c = hh(c,d,a,b,g(15),16,530742520); b = hh(b,c,d,a,g(2),23,-995338651);
        a = ii(a,b,c,d,g(0),6,-198630844);  d = ii(d,a,b,c,g(7),10,1126891415); c = ii(c,d,a,b,g(14),15,-1416354905); b = ii(b,c,d,a,g(5),21,-57434055);
        a = ii(a,b,c,d,g(12),6,1700485571); d = ii(d,a,b,c,g(3),10,-1894986606); c = ii(c,d,a,b,g(10),15,-1051523); b = ii(b,c,d,a,g(1),21,-2054922799);
        a = ii(a,b,c,d,g(8),6,1873313359);  d = ii(d,a,b,c,g(15),10,-30611744); c = ii(c,d,a,b,g(6),15,-1560198380); b = ii(b,c,d,a,g(13),21,1309151649);
        a = ii(a,b,c,d,g(4),6,-145523070);  d = ii(d,a,b,c,g(11),10,-1120210379); c = ii(c,d,a,b,g(2),15,718787259); b = ii(b,c,d,a,g(9),21,-343485551);
        a = au(a, oa); b = au(b, ob); c = au(c, oc); d = au(d, od);
    }
    const hex = n => { let s = ''; for (let i = 0; i < 4; i++) s += ((n >> (i * 8 + 4)) & 0xF).toString(16) + ((n >> (i * 8)) & 0xF).toString(16); return s; };
    return hex(a) + hex(b) + hex(c) + hex(d);
}
// Full login → { ok } or { ok:false, error }. Stores only the user_auth_token (+ app_id) on success.
async function qobuzLogin(email, password) {
    const url = `${QOBUZ.api}/user/login?email=${encodeURIComponent(email)}&password=${md5(password)}&app_id=${QOBUZ.appId}`;
    const r = await gmGet(url, { headers: { 'X-App-Id': QOBUZ.appId, Accept: 'application/json' } });
    let j; try { j = JSON.parse(r.responseText || 'null'); } catch { j = null; }
    const tok = j && j.user_auth_token;
    if (!tok) {
        const m = (j && (j.message || j.code)) || (r.status === 401 ? 'invalid email or password' : `HTTP ${r.status}`);
        appendLog('Qobuz', `login rejected — ${m}`, 'error');
        return { ok: false, error: String(m) };
    }
    qbWrite({ token: tok, appId: QOBUZ.appId });
    appendLog('Qobuz', 'logged in — token stored for ISRC Scout + Credit Hoarder', 'ok');
    return { ok: true };
}
async function beatportApi(path) {
    const tok = await beatportToken(); if (!tok) return null;
    const r = await gmGet(`${BEATPORT.api}${path}`, { headers: { Authorization: `Bearer ${tok}` } });
    appendLog('Beatport', `API ${path}: status=${r.status} ${(r.responseText || '').length}b in ${r.ms}ms`, r.ok ? undefined : 'warn');
    if (!r.ok) return null;
    try { return JSON.parse(r.responseText); } catch (e) { appendLog('Beatport', `API ${path}: JSON parse error: ${e.message}`, 'error'); return null; }
}

// ─── UI updater ────────────────────────────────────────────────────────────
// `source` is the original origin of the URL ('MB rels' / 'Wikidata' / 'search' /
// 'native' / 'API search'). `fromCache` is independent — true when this row was
// resolved from the local cache, regardless of which path originally found it.
// Two visual signals get layered:
//   colour tint    — green when fromCache=false, steel-blue when fromCache=true
//   circled icon   — when source includes 'MB rels' (the URL was put there by
//                    an MB editor, not discovered by us)
// The MB release's barcode for the current scan (#182) — set by runScans so
// updateRow can compare a found item's barcode against it.
let MB_BARCODE = null;
// Normalise a barcode for comparison: digits only, leading zeros stripped (a
// 12-digit UPC-A and its 13-digit EAN form "0…" are the same barcode).
function normBarcode(b) { return String(b || '').replace(/\D/g, '').replace(/^0+/, ''); }
// #354: stores index the same GTIN under different zero-paddings — a 12-digit UPC-A,
// a 13-digit EAN with a leading 0, or a 14-digit form — so an exact-UPC lookup can
// miss purely on padding. gtinVariants returns the distinct forms to try (the raw MB
// barcode first, then the stripped core and the 12/13/14 zero-padded forms). Leading
// zeros are insignificant in a GTIN, so these are all the SAME barcode — no wrong-match
// risk. `upcTry` runs a lookup across them and stops at the first hit, so the extra
// requests only happen on the no-match path.
function gtinVariants(barcode) {
    const raw = String(barcode || '').replace(/\D/g, '');
    if (!raw) return [];
    const core = raw.replace(/^0+/, '') || raw;
    const out = [];
    const push = v => { if (v && !out.includes(v)) out.push(v); };
    push(raw);                                   // the exact MB barcode (as stored) first
    push(core);                                  // leading zeros stripped
    if (core.length >= 11 && core.length <= 14) [12, 13, 14].forEach(n => { if (core.length <= n) push(core.padStart(n, '0')); });
    return out;
}
async function upcTry(barcode, fn) {
    for (const v of gtinVariants(barcode)) { const r = await fn(v); if (r) return r; }
    return null;
}

let MB_FORMAT = null;
// Format-confidence (#182). Only Bandcamp and Discogs carry a real parsed
// format string (Digital / CD / Vinyl …); every other provider is a digital-
// only storefront that never exposes a physical edition, so an absent format
// means "Digital" for the check (otherwise strict mode would withhold every
// streaming link). Those two are excluded and judged on their actual format.
const DIGITAL_ONLY_PROVIDERS = new Set(['spotify', 'apple', 'deezer', 'tidal', 'qobuz', 'beatport', 'volumo', 'hdtracks', 'soundcloud', 'audiomack', 'ytmusic', 'amazonmusic']);
// Bucket a format string into {physical, digital} categories. A multi-format
// string ("Digital, CD") yields both; an unknown/empty string yields neither.
function formatCategories(s) {
    const t = String(s || '').toLowerCase();
    const cats = new Set();
    if (/\b(cd|vinyl|cassette|sacd|dvd|blu-?ray|flexi|minidisc|lp|shm|7"|10"|12")\b/.test(t)) cats.add('physical');
    if (/\b(digital|file|stream|lossless|web|wav|flac|mp3|aac|hi-?res)\b/.test(t)) cats.add('digital');
    return cats;
}
// Remote format categories with the digital-only default applied.
function remoteFormatCategories(platform, fmt) {
    const cats = formatCategories(fmt);
    if (cats.size === 0 && DIGITAL_ONLY_PROVIDERS.has(platform)) cats.add('digital');
    return cats;
}
// A *known* format incompatibility (used for the row marker — shown only when
// the option is on). Unknown remote format is not a known mismatch.
function formatMismatch(platform, fmt) {
    const mbCats = formatCategories(MB_FORMAT);
    if (mbCats.size === 0) return false;
    const remote = remoteFormatCategories(platform, fmt);
    if (remote.size === 0) return false;
    return ![...remote].some(x => mbCats.has(x));
}

// Whole row is clickable (#173): anywhere from after the icon to the track
// count — empty cells and the gaps included (the row is one subgrid box).
// LEFT-click opens the found platform page, or the provider's SEARCH page when
// nothing was found (so even completely empty rows work); RIGHT-click always
// opens the SEARCH page for a manual check. The icon keeps "add to MB" and the
// name <a> opens natively (both excluded).
//
// This used to live inside updateRow, which meant a row only became clickable
// once its scan had REPORTED. While a scan is running — or after ↻ reset the
// rows — Discogs and Bandcamp sit there as full rows (they never fold into the
// compact strip) with no handler at all, so clicking them did nothing, even
// though the compact icons beside them were already clickable. Wiring is now
// its own function, called as soon as the search-fallback URLs exist, so a
// pending row behaves exactly like a compact icon: click → provider search.
//
// The destination is read from the anchor at click time rather than captured,
// so the same wiring serves a pending row and a resolved one: updateRow points
// the anchor at the found URL, and anything that isn't the stashed search URL
// counts as "found".
function wireRowOpen(p) {
    const row = document.getElementById(`row-${p}`);
    const a   = document.getElementById(`mb-online-${p}`);
    if (!row || !a) return;
    const open = (e, preferSearch) => {
        if (e.target.closest('.pc-cell-ico') || e.target.closest('a')) return;
        const search = a.dataset.searchUrl || null;
        const href   = a.getAttribute('href');
        const found  = href && href !== search && /^https?:\/\//.test(href) ? href : null;
        const dest   = preferSearch ? (search || found) : (found || search);
        if (dest) { e.preventDefault(); window.open(dest, '_blank', 'noopener'); }
    };
    row.onclick       = (e) => open(e, false);
    row.oncontextmenu = (e) => open(e, true);
    // Only claim to be clickable when there IS somewhere to go — before the
    // search fallbacks are seeded there isn't.
    const href = a.getAttribute('href');
    row.style.cursor = (a.dataset.searchUrl || (href && /^https?:\/\//.test(href))) ? 'pointer' : '';
}

// #641: middle click (button 1) runs `fn`, or nothing when fn is null. The mousedown is
// swallowed, so the browser doesn't start autoscrolling instead. #653: so does Alt+click, for a
// laptop's touchpad that has no middle button; it is caught before the element's own click and
// the row's, which would add normally or open the page. #641 (majkinetor): "I miss the background
// option with middle click. Lets use CTRL middle click … ctrl + alt + click forces to background":
// with Ctrl (⌘ on a Mac) held, `fn(true)` adds in the background.
const pcBgKey = e => !!(e.ctrlKey || e.metaKey);
function pcWireForce(el, fn) {
    el._pcForce = fn || null;
    el.onmousedown = fn ? (e) => { if (e.button === 1) e.preventDefault(); } : null;
    el.onauxclick = fn ? (e) => { if (e.button !== 1) return; e.preventDefault(); fn(pcBgKey(e)); } : null;
    if (!el._pcForceAlt) {
        el._pcForceAlt = true;
        el.addEventListener('click', (e) => {
            if (!e.altKey || !el._pcForce) return;
            e.preventDefault(); e.stopImmediatePropagation();
            el._pcForce(pcBgKey(e));
        }, true);
    }
}
function updateRow(p, { url, mbTracks, remoteTracks, year, label, source, fromCache, format, masterState, hiddenTracks, barcode }) {
    const a    = document.getElementById(`mb-online-${p}`);
    const ico  = document.getElementById(`ico-${p}`);
    const val  = document.getElementById(`val-${p}`);
    if (url) a.href = url;

    const fromMbRels = source === 'MB rels';
    // Barcode mismatch (#182): MB has a barcode, the found item exposes one, and
    // they differ → a different release per MB guidelines. Surfaced as a subtle
    // left bar (CSS) + tooltip/log only; the barcode itself is never shown in the
    // dashboard. Providers whose API hides the barcode (Apple, Bandcamp) pass none.
    const bcDiff = !!(url && MB_BARCODE && barcode && normBarcode(barcode) !== normBarcode(MB_BARCODE));
    // Format incompatibility (#182) — only marked when the option is on, since
    // "digital link on a physical release" is common enough to be noise otherwise.
    const fmtDiff = !!(url && GM_getValue('pc:respect-format', true) && formatMismatch(p, format));

    // Source-on-hover: tooltip on the provider name. "via MB rels", "via
    // Wikidata", "via API search · cached", etc. Replaces the visible badge
    // that used to live next to the track count.
    if (url) {
        const parts = [];
        if (source) parts.push(`via ${source}`);
        if (fromCache) parts.push('cached');
        a.title = parts.length ? `${PROVIDER_NAME[p]} URL — ${parts.join(' · ')}` : '';
    } else {
        a.title = `No ${PROVIDER_NAME[p]} URL found`;
    }

    // val is the platform's track count as a bare number, coloured by match
    // against the MB-side number (shown in the header). No more "(N/M trks)".
    if (remoteTracks != null) {
        // Bandcamp hidden download-only tracks (#183): mark the count with a "ⁿ"
        // superscript + tooltip so the editor knows N of the tracks aren't
        // streamable (the count itself already includes them).
        val.textContent = String(remoteTracks) + (hiddenTracks > 0 ? 'ⁿ' : '');
        const hiddenNote = hiddenTracks > 0 ? `\n${hiddenTracks} download-only track(s) hidden from streaming on Bandcamp` : '';
        if (parseInt(remoteTracks, 10) === parseInt(mbTracks, 10)) {
            ico.textContent = '✓';
            const tone = fromCache ? '#5B82B0' : '#008000';
            ico.style.color = tone;
            val.style.color = tone;
            val.title = `${remoteTracks} tracks, matches MB — ${fromCache ? 'blue: from the local cache' : 'green: fetched live this scan'}` + hiddenNote;
        } else {
            ico.textContent = '~'; ico.style.color = 'var(--mbu-warn)';
            val.style.color = 'var(--mbu-warn)';
            val.title = `${remoteTracks} tracks, MB has ${mbTracks}${fromCache ? ' (from the local cache)' : ''}` + hiddenNote;
        }
    } else if (url) {
        ico.textContent = '?'; ico.style.color = 'var(--mbu-text-weak)';
        val.textContent = '?'; val.style.color = 'var(--mbu-text-weak)';
        val.title = 'Track count could not be read';
    } else {
        ico.textContent = '×'; ico.style.color = 'var(--mbu-error)';
        val.textContent = '—'; val.style.color = 'var(--mbu-error)';
        val.title = `No ${PROVIDER_NAME[p]} release found`;
    }

    // Circle MB-rels rows regardless of glyph — circle says "URL is in MB".
    ico.classList.toggle('pc-ico-circled', fromMbRels);

    // Withheld by barcode/format confidence (#182): present it like a mismatch
    // (grayed, not clickable) instead of a ✓ that silently does nothing on click.
    const blocked = !!(url && !fromMbRels && (barcodeBlocks(p) || formatBlocks(p)));
    // Click-to-add on the main icon for verified ✓ + not-already-in-MB (and not withheld).
    const canAdd = url && ico.textContent === '✓' && !fromMbRels && !blocked;
    // #641: middle click adds a confirmed (✓) link anyway — over a strict barcode/format
    // withholding, which sometimes keeps back a legitimate find — in the foreground
    const canForce = !!(url && ico.textContent === '✓' && !fromMbRels);
    const forceTip = blocked ? ' · middle-click or Alt+click: add it anyway (with Ctrl: in the background)' : ' · middle-click or Alt+click: add it even if strict settings would withhold it (with Ctrl: in the background)';
    ico.style.cursor = canAdd || (blocked && canForce) ? 'pointer' : '';
    ico.title = canAdd ? `Click to add ${PROVIDER_NAME[p]} URL to MB · right-click: add it silently in the background${forceTip}` : (blocked ? `Withheld from + / ↗ — barcode/format confidence is on (see the coloured bar)${canForce ? forceTip : ''}` : '');
    ico.onclick = canAdd ? () => addSingleUrl(p) : null;
    ico.oncontextmenu = canAdd ? (e) => { e.preventDefault(); addSingleUrl(p, true); } : null;
    pcWireForce(ico, canForce ? (bg) => addSingleUrl(p, bg, true) : null);

    // Icons-mode encoding — TWO INDEPENDENT dimensions:
    //   presence (pc-st-*) drives the icon fade + name colour: match = full · mismatch = gray · notfound = faint
    //   in-MB    (pc-inmb) draws the marker (circle/glow) — orthogonal, so an in-MB row still grays on a mismatch
    const row = document.getElementById(`row-${p}`);
    if (row) {
        const g = ico.textContent;   // '✓' match · '~' mismatch · '?' found-no-count · '×' not found
        // a withheld (barcode/format-blocked) link reads as a mismatch, not a clean match (#182)
        const presence = blocked ? 'mismatch' : g === '×' ? 'notfound' : g === '~' ? 'mismatch' : 'match';
        row.classList.remove('pc-st-notfound', 'pc-st-mismatch', 'pc-st-match');
        row.classList.add('pc-st-' + presence);
        row.classList.toggle('pc-blocked', blocked);
        row.classList.toggle('pc-inmb', fromMbRels);
        // subtle left bar when the found release's barcode differs from MB's, or
        // (when the format option is on) its format is incompatible with MB's (#182)
        row.classList.toggle('pc-barcode-diff', bcDiff);
        row.dataset.barcodeDiff = bcDiff ? '1' : '';
        row.classList.toggle('pc-format-diff', fmtDiff);
        const diffTips = [];
        if (bcDiff) diffTips.push(`Different barcode than MB (MB ${MB_BARCODE} · ${PROVIDER_NAME[p]} ${barcode}) — likely a different release`);
        if (fmtDiff) diffTips.push(`Format incompatible with MB release (MB ${MB_FORMAT} · ${PROVIDER_NAME[p]} ${normalizeFormat(format) || 'Digital'}) — likely a different release`);
        // strict-mode withholding with no known mismatch (barcode/format couldn't be confirmed)
        if (blocked && !diffTips.length) diffTips.push(`Withheld from + / ↗ — couldn't confirm barcode/format (strict mode)`);
        if (diffTips.length) row.title = diffTips.join(' · ');
        else if (row.title && /Different barcode|Format incompatible|Withheld from/.test(row.title)) row.title = '';
        wireRowOpen(p);   // #173 — see below; re-wired here so the cursor tracks the new state
    }
    const plat = document.getElementById(`plat-${p}`);
    if (plat) {
        plat.style.cursor = canAdd || (blocked && canForce) ? 'pointer' : 'default';
        plat.onclick = canAdd ? () => addSingleUrl(p) : null;   // click-to-add works on the brand icon too
        plat.oncontextmenu = canAdd ? (e) => { e.preventDefault(); addSingleUrl(p, true); } : null;
        pcWireForce(plat, canForce ? (bg) => addSingleUrl(p, bg, true) : null);
        plat.title = canAdd ? `Click to add ${PROVIDER_NAME[p]} URL to MB · right-click: add it silently in the background${forceTip}` : (url ? a.title + (blocked && canForce ? forceTip : '') : `No ${PROVIDER_NAME[p]} URL found`);
    }

    // Discogs gets a master state in the left slot. Other platforms have an
    // empty slot of the same width so the rows still align vertically.
    const masterEl = document.getElementById(`master-${p}`);
    if (masterEl) {
        if (p === 'discogs' && masterState) {
            applyMasterIcon(masterEl, masterState);
        } else {
            masterEl.innerHTML  = '';
            masterEl.onclick    = null;
            masterEl.style.cursor = 'default';
            masterEl.title      = '';
            masterEl.classList.remove('pc-ico-circled');
        }
    }

    // Meta cells: year · format · label, each its own grid cell so the columns
    // align across providers (1-row layout) — see setMetaCells.
    // re-stripped here too, so a label cached before a stripCopyright fix shows clean (#644)
    setMetaCells(`year-${p}`, `format-${p}`, `label-${p}`, year, format, label ? stripCopyright(label) : label);
    refreshCompactStrip();   // #355
}

// #355: rebuild the "compact unmatched providers" strip from the rows' current state.
// Model: everything starts COMPACT (a strip of dimmed icons) and each provider RISES
// into a full row once it MATCHES — so pending + not-found stay in the strip, only a
// found row is shown in full. Discogs and Bandcamp always keep their full rows;
// disabled providers (prov_<p> off) are skipped. A row that leaves the strip gets a
// subtle rise animation so the panel doesn't jump as results stream in. Cheap enough
// to run after every updateRow.
function refreshCompactStrip() {
    const strip = document.getElementById('pc-compact-strip');
    if (!strip) return;
    const unmatched = container.classList.contains('pc-compact-unmatched');
    const lowConf = container.classList.contains('pc-compact-nonstrict');   // #653
    strip.textContent = '';
    if (unmatched || lowConf) PROVIDER_ORDER.forEach(p => {
        if (p === 'discogs' || p === 'bandcamp') return;
        const row = document.getElementById(`row-${p}`);
        if (!row) return;
        // #653: two options. Unmatched: pending and not-found rows stay in the strip.
        // Low-confidence: a found-but-mismatched (wrong barcode/format, or withheld) row too;
        // with it off that row keeps its full row, so its tracks/year/label show. A clean
        // match always rises into a full row, and so does a link that's already IN MB
        // (pc-inmb) — you added it, so show it.
        const isMismatch = row.classList.contains('pc-st-mismatch');
        const isMatch = row.classList.contains('pc-st-match');
        const foldable = isMismatch ? lowConf : !isMatch && unmatched;
        const compact = foldable && !row.classList.contains('pc-inmb') && GM_getValue(`pc:prov_${p}`, true);
        const was = row.classList.contains('pc-compacted');
        row.classList.toggle('pc-compacted', compact);
        if (!compact) {
            if (was) { row.classList.remove('pc-rise'); void row.offsetWidth; row.classList.add('pc-rise'); }   // rose out on a match
            return;
        }
        const a = document.getElementById(`mb-online-${p}`);
        // a mismatch (found but wrong release) keeps a subtle amber ring so the
        // "found but wrong" signal isn't lost when it's folded into the strip.
        const mismatch = isMismatch;
        const ico = document.createElement('span');
        ico.className = 'pc-compact-ico' + (mismatch ? ' pc-compact-mismatch' : '');
        // #641: a withheld match (✓, folded into the strip as a mismatch) takes the same
        // middle click as its full row's icon: add it anyway, in the foreground
        const canForce = !!(a && /^https?:\/\//.test(a.getAttribute('href') || '') && document.getElementById(`ico-${p}`)?.textContent.trim() === '✓' && !row.classList.contains('pc-inmb'));
        ico.title = `${PROVIDER_NAME[p]} — ${mismatch ? 'found but a different release · click to open it' : 'click to search'}${canForce ? ' · middle-click or Alt+click: add it anyway (with Ctrl: in the background)' : ''}`;
        pcWireForce(ico, canForce ? (bg) => addSingleUrl(p, bg, true) : null);
        ico.innerHTML = stIcon(p, 16);
        ico.addEventListener('click', () => {
            // behave exactly like clicking the (uncompacted) row: open what was FOUND
            // when there is one (a mismatch has a found URL), else the provider search.
            const href = a && a.getAttribute('href');
            const found = href && /^https?:\/\//.test(href) ? href : null;
            const dest = found || (a && a.dataset.searchUrl) || null;
            if (dest) window.open(dest, '_blank', 'noopener');
            else row.click();   // last-resort fallback (e.g. a pending row)
        });
        strip.appendChild(ico);
    });
    else PROVIDER_ORDER.forEach(p => { const r = document.getElementById(`row-${p}`); if (r) r.classList.remove('pc-compacted'); });
    strip.classList.toggle('pc-has-icons', strip.children.length > 0);
}

// Fill the three meta cells (year / format / label) for a row. The "·"
// separators TRAIL year and format, but only when a later field follows — so
// the same cell content reads correctly in both layouts: aligned columns in
// 1-row ("2026 · | Digital · | Selections Lab"), and a joined line in 2-row
// ("2026 · Digital · Selections Lab"). Format is normalized (Digital Media →
// Digital); the full label is set as a tooltip so a truncated label (CSS
// ellipsis) is still readable on hover.
function setMetaCells(yearId, formatId, labelId, year, format, label) {
    const yEl = document.getElementById(yearId);
    const fEl = document.getElementById(formatId);
    const lEl = document.getElementById(labelId);
    const fmt = format ? normalizeFormat(format) : '';
    const hasY = !!year, hasF = !!fmt, hasL = !!label;
    // 2-digit year to save space in the compact row (#173); full year in tooltip.
    const y2 = hasY ? String(year).slice(-2) : '';
    if (yEl) { yEl.textContent = hasY ? (hasF || hasL ? `${y2} ·` : y2) : ''; yEl.title = hasY ? String(year) : ''; }
    if (fEl) {
        fEl.textContent = ''; fEl.title = hasF ? fmt : '';
        if (hasF) {
            const marker = fmtMarker(fmt); fEl.appendChild(marker);
            // recognized formats render BOTH the circle and a text span; the "Format marker" option toggles
            // which shows via a panel class, so switching needs no re-scan. Unknown formats stay text-only.
            if (marker.nodeType === 1) { const t = document.createElement('span'); t.className = 'pc-fmt-txt'; t.textContent = fmt; fEl.appendChild(t); }
            if (hasL) fEl.appendChild(document.createTextNode(' ·'));
        }
    }
    if (lEl) { lEl.textContent = hasL ? label : ''; lEl.title = hasL ? label : ''; }
}

// MB's "Digital Media" is the spec name, but in a tight sidebar "Digital"
// communicates the same thing. Applied at display time so the cache and
// scan paths can keep MB's canonical value.
function normalizeFormat(s) { return String(s || '').replace(/\bDigital\s*Media\b/i, 'Digital'); }

// Format-family quadrant marker (#350): collapse any format(s) to Digital / Vinyl / CD / Cassette and draw
// them as a single circle split into 4 coloured quadrants (present family = its colour). Compact (1 glyph)
// for multi-format releases where the format text (Discogs/Bandcamp) would otherwise eat horizontal space.
const PC_FMT_COLOR = { Vinyl: '#2b2b2b', Cassette: '#9a6b3f', CD: '#7d8894', Digital: '#4a90d9' };
function pcFormatFamily(f) {
    f = String(f || '').toLowerCase();
    if (/cassette|tape/.test(f)) return 'Cassette';
    if (/vinyl|shellac|flexi|\blp\b|7"|10"|12"/.test(f)) return 'Vinyl';
    if (/cd|sacd|dvd|blu-?ray|hd-?dvd|minidisc|umd|disc/.test(f)) return 'CD';
    if (/digital|file|stream|web|download|lossless|flac|mp3|wav|aac|hi-?res/.test(f)) return 'Digital';
    return '';
}
const pcFormatFamilies = fmt => [...new Set(String(fmt || '').split(/[,+/]|\s+&\s+/).map(pcFormatFamily).filter(Boolean))];
function fmtMarker(fmt) {
    const fams = pcFormatFamilies(fmt);
    if (!fams.length) return document.createTextNode(normalizeFormat(fmt) || '');   // unknown → keep the text
    const NS = 'http://www.w3.org/2000/svg', svg = document.createElementNS(NS, 'svg');
    svg.setAttribute('viewBox', '0 0 24 24'); svg.setAttribute('width', '13'); svg.setAttribute('height', '13');
    svg.setAttribute('class', 'pc-fmt');
    // quadrants: Vinyl top-right · Cassette top-left · CD bottom-left · Digital bottom-right
    const QUAD = { Vinyl: [-90, 0], Cassette: [180, 270], CD: [90, 180], Digital: [0, 90] };
    const cx = 12, cy = 12, r = 11, rad = d => d * Math.PI / 180;
    for (const fam in QUAD) {
        const [a0, a1] = QUAD[fam];
        const x0 = cx + r * Math.cos(rad(a0)), y0 = cy + r * Math.sin(rad(a0)), x1 = cx + r * Math.cos(rad(a1)), y1 = cy + r * Math.sin(rad(a1));
        const path = document.createElementNS(NS, 'path');
        path.setAttribute('d', `M${cx},${cy} L${x0.toFixed(2)},${y0.toFixed(2)} A${r},${r} 0 0 1 ${x1.toFixed(2)},${y1.toFixed(2)} Z`);
        // #564: an unlit quadrant and the hairline between quadrants were a fixed
        // pale grey and a fixed near-white, so the marker read as a white disc on a
        // dark panel. Set through .style rather than setAttribute: a presentation
        // attribute is not a reliable place for var(), an inline style is.
        // #564: through .style and a token, for the same reason the unlit one is —
        // a presentation attribute cannot carry var(), and a fixed #2b2b2b vinyl
        // is invisible on a dark panel.
        if (fams.includes(fam)) path.style.fill = `var(--pc-fmt-${fam.toLowerCase()}, ${PC_FMT_COLOR[fam]})`;
        else path.style.fill = 'var(--mbu-bg-sunken)';
        path.style.stroke = 'var(--mbu-bg)'; path.setAttribute('stroke-width', '0.8');
        svg.appendChild(path);
    }
    return svg;
}

// Strip leading copyright noise from a label string so the meta line doesn't
// show the year twice (year · label). Handles ℗/© or "(P)/(C)", a BARE leading
// year (Tidal often does "2026 Label" with no symbol), and repeated/stacked
// prefixes ("℗ 2017 © 2017 Label"), and marks run together (Amazon Music's "℗© 2025 Label", #644).
// Returns null when nothing's left.
function stripCopyright(text) {
    let t = String(text || '').trim(), prev;
    do { prev = t; t = t.replace(/^\s*(?:(?:[℗©]|\([pc]\))\s*)*(?:19|20)\d{2}\s*|^\s*(?:(?:[℗©]|\([pc]\))\s*)+/i, ''); } while (t !== prev);
    return t.trim() || null;
}

// Apply Discogs master-state to the master slot. State shape:
// { glyph: '✓'|'~'|'×', circled: bool, clickable: bool, title: str, addMasterUrl?: str }
function applyMasterIcon(el, state) {
    el.textContent = state.glyph;
    el.style.color = state.muted ? 'var(--mbu-text-weak)' : 'var(--mbu-info)';
    el.title       = state.title;
    el.classList.toggle('pc-ico-circled', !!state.circled);
    if (state.clickable && state.addMasterUrl) {
        el.style.cursor = 'pointer';
        el.onclick = () => addMasterUrl(state.addMasterUrl);
    } else {
        el.style.cursor = 'default';
        el.onclick = null;
    }
}

// Build the Discogs master-state object given the URL Discogs found + the
// URL MB has on the release-group already. Drives applyMasterIcon().
function discogsMasterState(cachedMasterUrl, existingDiscogsMaster) {
    if (!cachedMasterUrl) {
        // No master from a resolved Discogs release — but if the MB
        // release-group already carries a Discogs master, use it (it's the
        // authoritative RG-level link, same as honouring any existing MB rel).
        if (existingDiscogsMaster) {
            return { glyph: '✓', circled: true, clickable: false, masterUrl: existingDiscogsMaster,
                title: `Discogs master on the release-group: ${existingDiscogsMaster}` };
        }
        // Discogs returns no master_id when the release simply isn't part of a
        // master group (one-off pressings, niche labels). Show a muted "—" so
        // the user can distinguish "release has no master" from "we haven't
        // scanned yet" without the slot looking like a bug.
        return { glyph: '—', circled: false, clickable: false, title: 'Discogs release has no master entry', muted: true };
    }
    if (existingDiscogsMaster === cachedMasterUrl) {
        return { glyph: '✓', circled: true,  clickable: false, masterUrl: cachedMasterUrl, title: 'Discogs master URL is on the release-group' };
    }
    if (existingDiscogsMaster) {
        return { glyph: '~', circled: true,  clickable: false, masterUrl: existingDiscogsMaster, title: `MB has a different Discogs master on the release-group: ${existingDiscogsMaster}` };
    }
    return     { glyph: '✓', circled: false, clickable: true,  masterUrl: cachedMasterUrl, title: 'Click to add this Discogs master URL to the release-group', addMasterUrl: cachedMasterUrl };
}

// ─── Helpers ───────────────────────────────────────────────────────────────
// DDG redirects search hits through /l/?uddg=<encoded-url>. Decode it.
function decodeDdgRedirect(href) {
    const m = href.match(/[?&]uddg=([^&]+)/);
    if (!m) return null;
    try { return decodeURIComponent(m[1]); } catch { return null; }
}

// Search Brave first (handles concurrent calls cleanly, returns the canonical
// open.spotify.com / *.bandcamp.com URLs verbatim); fall back to DDG HTML if
// Brave is blocked. Returns up to `maxN` unique URLs that pass `urlFilter` —
// callers verify each candidate by fetching its server-side metadata, since
// the first search hit is often a different album by the same artist (e.g.
// MMW returns "20" for the Stone-series query).
//
// Engines are sometimes rate-limited per IP. We try them in order and stop
// at the first one that yields any usable result.
async function searchWeb(query, urlFilter, label, maxN = 5) {
    const engines = [
        {
            name: 'Brave',
            url: `https://search.brave.com/search?q=${encodeURIComponent(query)}`,
            // Brave's anti-bot keys on a detailed Chrome UA being PRESENT, not absent.
            headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36' },
            extract(html) {
                // Brave embeds raw result URLs directly inside <a href="…"> — easy to
                // pluck. We collect every external link and let `urlFilter` triage.
                return [...html.matchAll(/href="(https?:\/\/[^"]+)"/g)].map(m => m[1]);
            },
        },
        {
            name: 'DDG',
            url: `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`,
            // Counter-intuitive: DDG's anti-bot blocks specific Chrome UAs but lets
            // through a bare "Mozilla/5.0". Verified 2026-05-28.
            headers: { 'User-Agent': 'Mozilla/5.0', 'Referer': 'https://duckduckgo.com/' },
            extract(html) {
                const out = [];
                for (const m of html.matchAll(/href="(\/\/duckduckgo\.com\/l\/\?uddg=[^"]+)"/g)) {
                    const decoded = decodeDdgRedirect(m[1]);
                    if (decoded) out.push(decoded);
                }
                // Also fall through to direct URL matches (some result layouts).
                for (const m of html.matchAll(/https?:\/\/[^\s"<>]+/g)) out.push(m[0]);
                return out;
            },
        },
    ];

    for (const eng of engines) {
        appendLog(label, `${eng.name}: ${eng.url}`);
        const res = await queueSearch(() => gmGet(eng.url, { headers: eng.headers }));
        const sizeHint = res.responseText.length;
        appendLog(label, `${eng.name}: status=${res.status} ${sizeHint}b in ${res.ms}ms`);
        // Engines distinguish rate-limit from real success differently:
        //   Brave -> HTTP 429 ("Too Many Requests")
        //   DDG   -> HTTP 202 with a tiny <14 KB anti-bot page
        // Surface both clearly in the log so the user knows when to wait.
        if (res.status === 429 || res.status === 503) {
            appendLog(label, `${eng.name}: rate-limited (HTTP ${res.status}) — try again later`, 'warn');
            continue;
        }
        if (!res.ok || !res.responseText) { appendLog(label, `${eng.name}: HTTP failure (status=${res.status})`, 'warn'); continue; }
        if (sizeHint < 5000 || res.status === 202) {
            appendLog(label, `${eng.name}: response too small (${sizeHint}b) — likely anti-bot block`, 'warn');
            continue;
        }
        const all = eng.extract(res.responseText);
        const matches = [];
        const seen = new Set();
        for (const u of all) {
            if (!urlFilter(u)) continue;
            // Strip query strings and "/intl-xx/" locale segments before dedup —
            // the same album often surfaces 5+ times with different locale prefixes.
            const norm = u.replace(/\/intl-[a-z-]+\//, '/').replace(/\?.*$/, '').replace(/#.*$/, '');
            if (seen.has(norm)) continue;
            seen.add(norm);
            matches.push(norm);
            if (matches.length >= maxN) break;
        }
        appendLog(label, `${eng.name}: ${all.length} total hrefs, ${matches.length} unique candidates after filter`);
        if (matches.length) return matches;
        appendLog(label, `${eng.name}: no candidate matched filter`, 'warn');
    }
    appendLog(label, `All search engines failed to match`, 'error');
    return [];
}

// ─── Candidate scoring ──────────────────────────────────────────────────────
// When the first search hit is wrong (e.g. MMW "20" instead of MMW
// "The Stone: Issue Four"), we need a way to pick the right one from a few
// candidates. Strategy: fetch each candidate's server-side metadata and score
// against the MB release's track count + title.
// #623 (sweep, X10): any script. Keeping only [a-z0-9] turned a non-Latin title into ""
// — an empty search, and no title or artist signal in scoring. Diacritics still fold on
// Latin, Greek and Cyrillic letters; other scripts keep their marks (voiced kana).
function normName(s) {
    return (s || '').toLowerCase().normalize('NFKD').replace(/(?<=[\p{Script=Latin}\p{Script=Greek}\p{Script=Cyrillic}])\p{M}+/gu, '').normalize('NFC').replace(/[^\p{L}\p{N}\p{M}]+/gu, ' ').trim();
}

// Punctuation-stripped form for use in search-engine queries. Quoting exact
// phrases is too rigid: MB might have "Space Echo: The Mystery…!" while the
// Bandcamp page renders it "Space Echo - The Mystery…" (no colon, no bang).
// Stripping punctuation to spaces lets the engine token-match either form;
// the verifier later picks the right candidate by track count + normName.
function searchTerms(s) {
    return (s || '').normalize('NFKD').replace(/(?<=[\p{Script=Latin}\p{Script=Greek}\p{Script=Cyrillic}])\p{M}+/gu, '').normalize('NFC').replace(/[^\p{L}\p{N}\p{M}]+/gu, ' ').replace(/\s+/g, ' ').trim();
}
// Token-set overlap.  `mode` controls strictness:
//   'max' — ratio against the larger side (default). Strict. Right for
//           album/title comparison: rejects "Self (The Remixes)" vs
//           "Jaiye Omo (The Remixes)" (share only "the" + "remixes").
//   'min' — ratio against the smaller side. Lenient. Right for artist
//           comparison: MB credits often shorter than streaming-platform
//           credits (e.g. MB "Hamad Kalkaba" vs Apple "Hamad Kalkaba &
//           The Golden Sounds" — all of MB's tokens are in Apple's, so
//           a min-based 0.8 threshold accepts it).
function tokenMatch(a, b, mode = 'max', threshold = 0.6) {
    const na = normName(a), nb = normName(b);
    if (!na || !nb) return false;
    if (na === nb) return true;
    const tokensOf = s => new Set(s.split(' ').filter(t => t.length >= 2));
    const ta = tokensOf(na), tb = tokensOf(nb);
    if (!ta.size || !tb.size) return false;
    let common = 0;
    for (const t of ta) if (tb.has(t)) common++;
    const denom = mode === 'min' ? Math.min(ta.size, tb.size) : Math.max(ta.size, tb.size);
    return common / denom >= threshold;
}
const titleSimilar  = (a, b) => tokenMatch(a, b, 'max', 0.6);
// #324: min-mode leniency is for the intended direction only — the MB credit being
// SHORTER than the platform's (e.g. "Hamad Kalkaba" ⊂ "Hamad Kalkaba & The Golden
// Sounds"). When the *candidate* is the shorter side it has dropped MB tokens — often
// a disambiguator like the "61" in "UFO 61" vs a bare "UFO!" — so be strict (max),
// or a wrong same-prefixed release scores a full artist match. (Root cause of #314.)
const artistTokenCount = s => normName(s).split(' ').filter(t => t.length >= 2).length;
const artistSimilar = (cand, mb) => tokenMatch(cand, mb, artistTokenCount(mb) <= artistTokenCount(cand) ? 'min' : 'max', 0.8);

// Score: tracks +100 / ±2 +30, title +60, artist +80 (non-VA).
//
// Two subtleties:
//
//   - The artist-mismatch penalty (-80) only applies when the title also
//     fails to match. Compilation reissues commonly credit the curator
//     label as `byArtist` on Bandcamp (e.g. "Analog Africa") while MB
//     attributes the recording to the actual artist ("Hamad Kalkaba").
//     If the title matches strongly, accept the mismatch as a likely
//     label/series credit.
//
//   - Pickable threshold (≥120) means a candidate needs at least one
//     non-tracks signal (title OR artist) to be trusted. Tracks alone
//     (100) is not enough — that was the bug behind picking the Jaiye
//     Omo album for Om Unit's "Self (The Remixes)" purely because both
//     happened to be 4-track EPs.
// Two non-empty titles that share ZERO significant tokens = a clearly different
// album (e.g. "Mambo Loco" vs "Para Bailar A Millón"). #324: an artist with many
// same-track-count albums (tracks 100 + artist 80) would otherwise be picked on a
// totally different title; a disjoint title is a strong negative signal.
function titleDisjoint(a, b) {
    const na = normName(a), nb = normName(b);
    if (!na || !nb) return false;
    const T = s => new Set(s.split(' ').filter(t => t.length >= 2));
    const ta = T(na), tb = T(nb);
    if (!ta.size || !tb.size) return false;
    for (const t of ta) if (tb.has(t)) return false;
    return true;
}
function scoreCandidate(meta, mbTracks, mbAlbum, mbArtist, isVA) {
    if (!meta) return -1;
    let s = 0;
    if (meta.tracks != null) {
        if (meta.tracks === mbTracks)                   s += 100;
        else if (Math.abs(meta.tracks - mbTracks) <= 2) s += 30;
    }
    const titleMatch = meta.title && titleSimilar(meta.title, mbAlbum);
    if (titleMatch) s += 60;
    // #324: a clearly different title outweighs tracks+artist (an album the same
    // artist also made, with the same track count, is a common false positive).
    else if (meta.title && mbAlbum && titleDisjoint(meta.title, mbAlbum)) s -= 100;
    if (!isVA && mbArtist && meta.artist) {
        if (artistSimilar(meta.artist, mbArtist)) s += 80;
        else if (!titleMatch) s -= 80;
    }
    return s;
}

// Drive a per-candidate verifier loop. Returns the best { url, meta, score }
// across the candidate list, plus a per-candidate log table for diagnostics.
// `fetchMeta(url)` returns `{ tracks, title, year, label }` (any field may be null).
async function pickBestCandidate(candidates, fetchMeta, mbTracks, mbAlbum, label, mbArtist, isVA) {
    const scored = [];
    for (const url of candidates) {
        const meta = await fetchMeta(url);
        const score = scoreCandidate(meta, mbTracks, mbAlbum, mbArtist, isVA);
        scored.push({ url, meta, score });
        appendLog(label, `  cand score=${score}  tracks=${meta?.tracks ?? '?'}  artist="${meta?.artist || '?'}"  title="${meta?.title || '?'}"  url=${url}`);
        // Short-circuit on a high-confidence match (tracks + (title or artist)).
        if (score >= 150) break;
    }
    if (!scored.length) return null;
    scored.sort((a, b) => b.score - a.score);
    return scored[0];
}

// Per-platform-per-MBID cache. Stores the full resolved row so a return visit
// to a release page does ZERO network calls: no MB-rels-driven detail fetch,
// no Wikidata SPARQL, no search, no embed/album-page parse. The ↻ button
// clears entries when the user wants to force a re-scan.
//
// Schema (JSON-encoded value): { url, tracks, year, label, source } where
// `url` may be null when we've definitively concluded "no match exists on
// this platform" (so we don't keep re-searching for niche releases that
// genuinely aren't on Spotify/Bandcamp).
// #501 follow-up (majkinetor, live: his script-manager config was cluttered
// with pc:cache:v2:*/pc:mbdata:*/pc:pending:* entries riding along in a sync
// backup) — these are same-origin (musicbrainz.org-only @match, no
// cross-domain handoff need, unlike e.g. falcon's Harmony bridge or
// isrc_scout's Beatport OAuth handoff), so localStorage is the right layer:
// it's still shared across every musicbrainz.org tab, just not swept into a
// script-manager sync/backup the way a real setting should be.
// #556: "the same album" identity for two URL strings.
//
// MusicBrainz stores whatever URL the editor was given, and the provider
// searches here produce a different spelling of the same page all the time —
// `open.spotify.com/intl-de/album/X` vs `/album/X`, `music.apple.com/us/album/
// slug/123` vs `/album/123`, `qobuz.com/us-en/album/…`, `listen.tidal.com` vs
// `tidal.com/browse/album/…`. The `existing` map above already anticipates every
// one of those variants; the comparison that consumed it did not, and used
// `===`. A missed match leaves a link that IS on the release looking un-added,
// so the panel re-queues it and the editor no-ops on a duplicate.
//
// Compare on a provider id where there is one (they are stable and unambiguous),
// otherwise on a host+path normalised for the noise MB and the providers add.
// ⚠ The provider table lives INSIDE pcUrlKey, memoised on the function object,
// and must stay there. As a module-level `const` it sat below the IIFE's
// early-return for /release/<mbid>/edit, so injectInto — which runs on exactly
// that path — hit it in the temporal dead zone: `ReferenceError: Cannot access
// 'PC_URL_ID' before initialization`, thrown out of the whole inject run.
// It only fired for a URL MusicBrainz had rewritten, because matchRowByUrl
// short-circuits on `h === url` first, so identically-spelled links (Deezer,
// Tidal) landed and the run then died on the first rewritten one (Qobuz) —
// taking every remaining URL with it. Same hazard TYPE_FORCE is inlined for.
function pcUrlKey(u) {
    const ID = pcUrlKey._id || (pcUrlKey._id = [
        [/open\.spotify\.com\/(?:intl-[a-z-]+\/)?album\/([a-z0-9]+)/i,        'spotify'],
        [/music\.apple\.com\/(?:[a-z]{2}\/)?album\/(?:[^/?#]+\/)?(\d+)/i,     'apple'],
        [/(?:www\.)?deezer\.com\/(?:[a-z]{2}\/)?album\/(\d+)/i,               'deezer'],
        [/(?:listen\.)?tidal\.com\/(?:browse\/)?album\/(\d+)/i,               'tidal'],
        [/(?:www\.)?discogs\.com\/(?:[a-z-]+\/)?release\/(\d+)/i,             'discogs'],
        [/(?:www\.)?discogs\.com\/(?:[a-z-]+\/)?master\/(\d+)/i,              'discogsmaster'],
        [/(?:www\.)?beatport\.com\/release\/[^/]+\/(\d+)/i,                   'beatport'],
        // #639: the id is in the query string, which the normalisation below drops, so
        // without this every YouTube Music album would count as the same link
        [/music\.youtube\.com\/(?:playlist\?(?:[^#]*&)?list=|browse\/)(OLAK5uy_[\w-]+|MPREb_[\w-]+)/i, 'ytmusic'],
        [/music\.amazon\.[a-z.]+\/albums\/([A-Z0-9]{10})/i,              'amazonmusic'],   // #644: any country's domain, one album
    ]);
    const s = String(u || '').trim();
    if (!s) return '';
    for (const [re, name] of ID) { const m = s.match(re); if (m) return name + ':' + m[1].toLowerCase(); }
    // no stable id (bandcamp, qobuz, volumo, hdtracks, soundcloud, audiomack) — normalise the
    // spelling instead: scheme, common host prefixes, locale segment, query and
    // fragment, trailing slash.
    try {
        const url = new URL(s);
        const host = url.hostname.toLowerCase().replace(/^(?:www|m|listen|play|open)\./, '');
        let path = url.pathname.replace(/\/+$/, '');
        path = path.replace(/^\/(?:[a-z]{2}-[a-z]{2}|[a-z]{2}|intl-[a-z-]+|browse)(?=\/)/i, '');
        return host + path.toLowerCase();
    } catch (e) { return s.toLowerCase().replace(/[?#].*$/, '').replace(/\/+$/, ''); }
}
function pcSameUrl(a, b) { return !!a && !!b && pcUrlKey(a) === pcUrlKey(b); }
/* #623 (sweep, X11): both caches below grew by one entry per platform for every
   release ever visited, and never expired. A cached "no match" was permanent, so a
   release that reached a platform later was never searched there again; and once
   musicbrainz.org's ~5 MB of localStorage filled up, every write failed silently —
   the platform logins' token refreshes included. Entries now carry their time (_t):
   a "not found" is searched again after 14 days, a found link after 90, the
   release's MusicBrainz data after 30. A daily prune drops what expired and keeps
   the newest 500 releases.
   ⚠ Functions, not consts: the release editor's helper reads the cache (injectInto →
   cacheGet, #423) and runs above the script's early return, where a const declared down
   here is still in its temporal dead zone — the trap PC_URL_ID fell into (#556). */
function pcTtlOf(key, v) {
    const TTL = { miss: 14 * 864e5, hit: 90 * 864e5, mbdata: 30 * 864e5 };
    return key.startsWith('pc:mbdata:') ? TTL.mbdata : (v && v.url ? TTL.hit : TTL.miss);
}
function pcMaxReleases() { return 500; }
function pcLsGet(key) {   // the entry, or null when absent, unreadable or expired (then removed)
    const raw = localStorage.getItem(key);
    if (!raw) return null;
    let v; try { v = JSON.parse(raw); } catch { return null; }
    if (v && v._t && Date.now() - v._t > pcTtlOf(key, v)) { try { localStorage.removeItem(key); } catch (e) {} return null; }
    return v;
}
function pcLsSet(key, entry) {
    if (!entry) return;
    try { localStorage.setItem(key, JSON.stringify({ ...entry, _t: Date.now() })); } catch (e) {}
}
function pcPruneCache() {
    try {
        const now = Date.now(), today = new Date(now).toISOString().slice(0, 10);
        if (localStorage.getItem('pc:cache:pruned') === today) return;
        localStorage.setItem('pc:cache:pruned', today);
        const keys = [];
        for (let i = 0; i < localStorage.length; i++) { const k = localStorage.key(i); if (k && (k.startsWith('pc:cache:v2:') || k.startsWith('pc:mbdata:'))) keys.push(k); }
        const newest = new Map();   // release mbid → its newest entry's time
        let expired = 0, stamped = 0, evicted = 0;
        for (const k of keys) {
            let v; try { v = JSON.parse(localStorage.getItem(k)); } catch (e) { v = null; }
            if (!v) { localStorage.removeItem(k); expired++; continue; }
            // an entry from before #623 has no time: its age starts now, rather than
            // the whole cache expiring (and being searched again) at once
            if (!v._t) { v._t = now; localStorage.setItem(k, JSON.stringify(v)); stamped++; }
            if (now - v._t > pcTtlOf(k, v)) { localStorage.removeItem(k); expired++; continue; }
            const mbid = k.slice(k.lastIndexOf(':') + 1);
            newest.set(mbid, Math.max(newest.get(mbid) || 0, v._t));
        }
        if (newest.size > pcMaxReleases()) {
            const oldest = [...newest].sort((a, b) => a[1] - b[1]).slice(0, newest.size - pcMaxReleases());
            oldest.forEach(([mbid]) => cacheClear(mbid));
            evicted = oldest.length;
        }
        appendLog('System', `Cache prune: ${keys.length} entr${keys.length === 1 ? 'y' : 'ies'} for ${newest.size} release(s) — ${expired} expired, ${evicted} release(s) over the ${pcMaxReleases()} cap dropped${stamped ? `, ${stamped} older entr${stamped === 1 ? 'y' : 'ies'} dated today` : ''}`);
    } catch (e) { appendLog('System', `Cache prune failed: ${e.message}`, 'warn'); }
}
function cacheKey(mbid, platform) { return `pc:cache:v2:${platform}:${mbid}`; }   // v2: entries now carry `barcode` (#182)
function cacheGet(mbid, platform) { return pcLsGet(cacheKey(mbid, platform)); }
function cacheSet(mbid, platform, entry) { pcLsSet(cacheKey(mbid, platform), entry); }
function cacheClear(mbid) {
    for (const p of ALL_PROVIDERS) localStorage.removeItem(cacheKey(mbid, p));   // all providers — not a stale hardcoded subset (else ↻ leaves Tidal/Beatport/Volumo cached)
    localStorage.removeItem(mbDataKey(mbid));
}

// MB-level metadata cache (artist, album, mbTracks, etc.) — written once per
// MBID after a successful release fetch. When MB returns 503 (rate-limited)
// or otherwise fails, we fall back to this cache so a tab switch to a
// previously-scanned release still renders its cached rows instead of
// halting on "Halted: API status 503".
function mbDataKey(mbid) { return `pc:mbdata:${mbid}`; }
function mbDataGet(mbid) { return pcLsGet(mbDataKey(mbid)); }
function mbDataSet(mbid, entry) { pcLsSet(mbDataKey(mbid), entry); }
pcPruneCache();   // once a day (#623)

// Apply a cached row to the UI and log the hit. Preserves the cache entry's
// original source (e.g. 'MB rels', 'Wikidata', 'search') so updateRow can
// still decide whether to circle the ✓; cache-state is conveyed separately
// via the `fromCache: true` flag (which drives the steel-blue tint).
function applyCachedRow(platform, label, cached, mbTracks, masterState) {
    appendLog(label, `Cache hit: url=${cached.url || '(no match)'}  tracks=${cached.tracks ?? '?'}  year=${cached.year || '?'}  label=${cached.label || '?'}  src=${cached.source || '?'}`, 'ok');
    updateRow(platform, {
        url:          cached.url,
        mbTracks,
        remoteTracks: cached.tracks ?? null,
        year:         cached.year   ?? null,
        label:        cached.label  ?? null,
        format:       cached.format  ?? null,
        source:       cached.source || null,
        fromCache:    true,
        masterState:  masterState   ?? null,
        hiddenTracks: cached.hiddenTracks ?? 0,
        barcode:      cached.barcode ?? null,
    });
}

// (Old discogsMasterExtra pill replaced by the master-slot state object —
// see discogsMasterState() / applyMasterIcon() above.)

// ─── Wikidata fast path ─────────────────────────────────────────────────────
// Wikidata curates external IDs (Spotify P2205, Apple Music P5121, AllMusic
// P1729) against MB release-group IDs (P436) and release IDs (P5813). When a
// release has a Wikidata entity, the data is human-edited and effectively
// 100% precise — much better than ranking 5 search-engine candidates by
// track count. Recall is the trade-off: niche / very-recent releases usually
// have no Wikidata entry, in which case we fall back to web search.
async function lookupWikidata(releaseGroupMbid, releaseMbid) {
    if (!releaseGroupMbid && !releaseMbid) return null;
    // Union of release-group and release lookups in one query — avoids two
    // round-trips when one or the other might be the indexed entity.
    const sparql = `SELECT ?spotify ?apple ?allmusic ?tidal ?beatport WHERE {
${releaseGroupMbid ? `  { ?item wdt:P436 "${releaseGroupMbid}" }`           : ''}
${releaseGroupMbid && releaseMbid ? '  UNION' : ''}
${releaseMbid      ? `  { ?item wdt:P5813 "${releaseMbid}" }`               : ''}
  OPTIONAL { ?item wdt:P2205 ?spotify }
  OPTIONAL { ?item wdt:P5121 ?apple }
  OPTIONAL { ?item wdt:P1729 ?allmusic }
  OPTIONAL { ?item wdt:P4577 ?tidal }
  OPTIONAL { ?item wdt:P11312 ?beatport }
} LIMIT 5`;
    const url = `https://query.wikidata.org/sparql?query=${encodeURIComponent(sparql)}&format=json`;
    appendLog('Wikidata', `SPARQL lookup rg=${releaseGroupMbid || '-'} rel=${releaseMbid || '-'}`);
    // 8 s, not gmGet's 15 s: query.wikidata.org often stalls, and the providers
    // that use this answer (Spotify/Apple/Tidal/Beatport) wait for it — on a
    // timeout they just fall through to their own search.
    const res = await gmGet(url, { headers: { 'Accept': 'application/sparql-results+json' }, timeout: 8000 });
    appendLog('Wikidata', `status=${res.status} ${res.responseText.length}b in ${res.ms}ms`);
    if (!res.ok) { appendLog('Wikidata', res.error === 'timeout' ? `timed out after ${res.ms}ms — continuing without it` : `lookup failed`, 'warn'); return null; }
    let data;
    try { data = JSON.parse(res.responseText); } catch (e) { appendLog('Wikidata', `JSON parse: ${e.message}`, 'error'); return null; }
    const bindings = data.results?.bindings || [];
    if (!bindings.length) {
        appendLog('Wikidata', `no entity matches release-group/release MBID — falling back to search`, 'warn');
        return null;
    }
    // Pick first binding that has any populated field; if multiple bindings
    // disagree (rare), trust the first row.
    const b = bindings.find(r => r.spotify || r.apple || r.allmusic || r.tidal || r.beatport) || bindings[0];
    const out = {
        spotifyId:  b.spotify?.value  || null,
        appleId:    b.apple?.value    || null,
        allmusicId: b.allmusic?.value || null,
        tidalId:    b.tidal?.value    || null,
        beatportId: b.beatport?.value || null,
    };
    appendLog('Wikidata', `match: spotify=${out.spotifyId || '-'} apple=${out.appleId || '-'} allmusic=${out.allmusicId || '-'} tidal=${out.tidalId || '-'} beatport=${out.beatportId || '-'}`, 'ok');
    return out;
}

// Wallstream (tools.wallstream.com, #602) proxies Spotify's catalog search with
// its own app token, so `q=upc:<code>` resolves a barcode → exact-UPC Spotify
// album — the only unauthenticated UPC route for Spotify (the embed/API don't
// expose a UPC without an app token). Replaced SAMBL, which stopped returning
// Spotify results and blocked every scanner while it ran. No CORS header →
// GM_xmlhttpRequest (@connect tools.wallstream.com).
// Spotify's upc: filter matches only the exact string Spotify stored, leading
// zeros included (0859381157694 hits, 859381157694 doesn't), so try the MB
// barcode verbatim, then its 12/13/14-digit zero-padded forms, first hit wins.
// Count with items.length — the response's `total` can be 0 with items present.
function spotifyUpcVariants(barcode) {
    const raw = String(barcode || '').trim();
    if (!raw) return [];
    const out = [raw];
    if (/^\d+$/.test(raw)) {
        const core = raw.replace(/^0+/, '');
        for (const n of [12, 13, 14]) if (core.length <= n) out.push(core.padStart(n, '0'));
    }
    return [...new Set(out)];
}
async function lookupWallstreamSpotify(barcode) {
    const variants = spotifyUpcVariants(barcode);
    if (!variants.length) return null;
    appendLog('Wallstream', `Spotify barcode lookup ${barcode} (forms: ${variants.join(', ')})`);
    for (const code of variants) {
        const url = `https://tools.wallstream.com/api/spotify/isrc?q=${encodeURIComponent('upc:' + code)}`;
        const r = await gmGet(url, { timeout: 8000, anonymous: true });
        appendLog('Wallstream', `upc:${code} → status=${r.status} ${r.responseText.length}b in ${r.ms}ms${r.error ? ' (' + r.error + ')' : ''}`);
        if (!r.ok) { appendLog('Wallstream', `lookup failed — falling back to Wikidata/search`, 'warn'); return null; }
        let j; try { j = JSON.parse(r.responseText); } catch (e) { appendLog('Wallstream', `JSON parse: ${e.message}`, 'error'); return null; }
        const albums = j?.items?.albums?.items || [];
        appendLog('Wallstream', `upc:${code} → ${albums.length} album(s)${albums.length ? ': ' + albums.map(x => `"${x.name}" ${x.external_urls?.spotify || x.id}`).join(' | ') : ''}`);
        const hit = albums.find(x => x?.external_urls?.spotify || x?.id);
        if (hit) {
            const albumUrl = hit.external_urls?.spotify || `https://open.spotify.com/album/${hit.id}`;
            appendLog('Wallstream', `exact-barcode Spotify album (upc:${code}): ${albumUrl}`, 'ok');
            return albumUrl;
        }
    }
    appendLog('Wallstream', `no Spotify album for any barcode form`, 'warn');
    return null;
}

// Concurrent search-engine queries from the same IP can trip anti-bot pages.
// Serialize them on one chain so two scanners never hit the same engine at once.
let searchChain = Promise.resolve();
function queueSearch(fn) { const p = searchChain.then(fn, fn); searchChain = p.catch(() => {}); return p; }

// ─── Per-platform scanners ─────────────────────────────────────────────────
// Fetch Spotify album metadata via the server-rendered /embed/album/<id> page.
// The embed ships an inline JSON blob; we extract title + track count + year +
// label by regex (lighter and more tolerant than full-tree parsing).
async function fetchSpotifyMeta(albumUrl) {
    const idMatch = albumUrl.match(/album\/([a-zA-Z0-9]{22})/);
    if (!idMatch) return null;
    const embedUrl = `https://open.spotify.com/embed/album/${idMatch[1]}`;
    const er = await gmGet(embedUrl);
    if (!er.ok) return null;
    const html = er.responseText;
    const trackUris = [...html.matchAll(/"uri":"spotify:track:[a-zA-Z0-9]+"/g)];
    const titleMatch = html.match(/"name"\s*:\s*"([^"]+)"/);
    const yearMatch  = html.match(/"releaseDate":"(\d{4})-/) || html.match(/"year"\s*:\s*(\d{4})/);
    const labelMatch = html.match(/"label":"([^"]+)"/) || html.match(/"copyrights":\s*\[\s*\{\s*"text"\s*:\s*"([^"]+)"/);
    // Spotify embed stores the album-level artist credit as the first
    // `"subtitle":"…"` field (subsequent subtitles are per-track artist
    // credits). The bigger Spotify metadata schemas use `"artists":[…]`
    // but the embed compresses them all to `subtitle`.
    const subtitleMatch = html.match(/"subtitle"\s*:\s*"([^"]+)"/);
    const artist = subtitleMatch?.[1] || null;
    return {
        tracks: trackUris.length || null,
        title:  titleMatch?.[1] || null,
        year:   yearMatch?.[1]  || null,
        label:  labelMatch?.[1] || null,
        artist,
    };
}

async function scanSpotify({ artist, album, mbTracks, existingUrl, mbid, wikidataSpotifyId, isVariousArtists, barcode }) {
    const label = 'Spotify';

    // Cache hit WITH URL → use it and skip everything else. A cached "no
    // match" (url:null) is NOT a short-circuit — a fresh Wikidata answer
    // can still override it. Only if Wikidata also has nothing AND no
    // existing rel do we fall back to rendering the cached no-match
    // (without rerunning search engines; ↻ forces full retry).
    const cached = cacheGet(mbid, 'spotify');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        appendLog('Wallstream', `skipped — Spotify URL cached from a previous scan (↻ to re-run): ${cached.url}`);
        applyCachedRow('spotify', label, cached, mbTracks);
        return;
    }

    let albumUrl = existingUrl;
    let source   = null;
    let bestMeta = null;
    let exactBarcode = false;   // (#182) true when the URL was resolved by exact UPC
    // Barcode lookup (#602) runs here, inside the Spotify scanner, so it no
    // longer delays the other providers' scans. Every skip is logged, so an
    // empty Wallstream log never leaves you guessing whether it ran.
    let barcodeUrl = null;
    if (albumUrl)      appendLog('Wallstream', `skipped — Spotify already linked in MB: ${albumUrl}`);
    else if (!barcode) appendLog('Wallstream', `skipped — release has no barcode`);
    else               barcodeUrl = await lookupWallstreamSpotify(barcode);

    if (albumUrl) {
        appendLog(label, `Using existing MB URL: ${albumUrl}`, 'ok');
        source = 'MB rels';
    } else if (barcodeUrl) {
        // Wallstream resolved the exact-barcode Spotify album. It beats
        // Wikidata/search, which can point at a different-barcode edition.
        albumUrl = barcodeUrl; source = 'Wallstream (barcode)'; exactBarcode = true;
        appendLog(label, `Wallstream barcode match → ${albumUrl}`, 'ok');
    } else if (wikidataSpotifyId) {
        albumUrl = `https://open.spotify.com/album/${wikidataSpotifyId}`;
        appendLog(label, `Wikidata answer: ${albumUrl}`, 'ok');
        source = 'Wikidata';
    } else if (cached) {
        // Cache says "no match", no MB rel, Wikidata had no answer — surface
        // the cached state without re-running web search (the user already
        // saw this; they have ↻ to force a fresh search).
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('spotify', label, cached, mbTracks);
        return;
    } else {
        // Restrict the `site:` filter to the /album/ path so artist pages,
        // playlists, tracks, and shows never enter the candidate list. Use
        // punctuation-stripped tokens (not a quoted exact phrase) so the
        // engine matches "Space Echo - The Mystery..." against MB's
        // "Space Echo: The Mystery...!". For VA compilations drop the artist
        // term because the literal phrase "Various Artists" doesn't appear
        // on streaming pages — labels host compilations under their own name.
        const albumT  = searchTerms(album);
        const artistT = searchTerms(artist);
        const q = isVariousArtists
            ? `site:open.spotify.com/album/ ${albumT}`
            : `site:open.spotify.com/album/ ${artistT} ${albumT}`;
        const candidates = await searchWeb(q, u => /open\.spotify\.com\/(?:intl-[a-z-]+\/)?album\/[a-zA-Z0-9]{22}/.test(u), label);
        if (!candidates.length) {
            // Cache "no match" so a refresh-less page re-visit doesn't re-search.
            cacheSet(mbid, 'spotify', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('spotify', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        appendLog(label, `Verifying ${candidates.length} candidate(s) by tracks + title + artist…`);
        const best = await pickBestCandidate(candidates, fetchSpotifyMeta, mbTracks, album, label, artist, isVariousArtists);
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'spotify', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('spotify', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        albumUrl = best.url;
        bestMeta = best.meta;
        appendLog(label, `Picked best (score=${best.score}): ${albumUrl}`, best.score >= 150 ? 'ok' : 'warn');
        source = 'search';
    }

    const meta = bestMeta || await fetchSpotifyMeta(albumUrl);
    if (meta) {
        appendLog(label, `Embed parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'}`, meta.tracks ? 'ok' : 'warn');
    } else {
        appendLog(label, `Embed fetch failed`, 'error');
    }
    // The embed strips year/label entirely. Fetch the public album page once
    // we've settled on a URL to enrich year for display — the JSON-LD blob
    // includes `datePublished`. Label is still unobtainable without OAuth.
    let displayYear = meta?.year ?? null;
    if (!displayYear) {
        try {
            const pr = await gmGet(albumUrl);
            if (pr.ok) {
                const m = pr.responseText.match(/"datePublished"\s*:\s*"(\d{4})/);
                if (m) {
                    displayYear = m[1];
                    appendLog(label, `Album page year: ${displayYear}`);
                }
            }
        } catch (_) { /* enrichment is best-effort */ }
    }
    const tracks = meta?.tracks ?? null;
    const lbl    = meta?.label  ?? null;
    const sbc = exactBarcode ? MB_BARCODE : null;   // exact UPC → MB barcode (no mismatch); else unknown
    cacheSet(mbid, 'spotify', { url: albumUrl, tracks, year: displayYear, label: lbl, source, barcode: sbc });
    updateRow('spotify', { url: albumUrl, mbTracks, remoteTracks: tracks, year: displayYear, label: lbl, source, barcode: sbc });
}

// ─── Qobuz ───────────────────────────────────────────────────────────────────
// Qobuz's catalogue API (api.json/0.2) with app_id `712109809`: `album/search`
// works unauthenticated (barcode-first search + UPC capture, like the other API
// providers), but `album/get` — which also carries `tracks_count` + `upc` for a
// direct verify — is session-gated (404/401 anonymously, #353). So when the user
// has logged in via ⚙ Setup → Auth (token in mbtools:qobuz), we attach it and the
// API path becomes reliable; otherwise Qobuz falls back to scraping the
// server-rendered store page. (#201/#353, shapes per chaban-mb / Harmony.)
const QOBUZ_APP_ID = '712109809';
function qobuzApi(path) {
    const headers = { Accept: 'application/json', 'X-App-Id': QOBUZ_APP_ID };
    const t = qbRead();                                       // #353 the user's stored token unlocks album/get
    if (t && t.token) headers['X-User-Auth-Token'] = t.token;
    return gmGet(`https://www.qobuz.com/api.json/0.2/${path}${path.includes('?') ? '&' : '?'}app_id=${QOBUZ_APP_ID}`, { headers })
        .then(r => { if (!r.ok) return null; try { return JSON.parse(r.responseText); } catch { return null; } });
}
// the album slug-id is the API's album_id (e.g. .../album/<slug>/vft3hpnx5c3lc)
function qobuzAlbumId(url) { const m = String(url || '').match(/qobuz\.com\/(?:[a-z]{2}-[a-z]{2}\/)?album\/(?:[^/?#]+\/)?([a-z0-9]+)/i); return m ? m[1] : null; }
const qobuzMetaFromApi = d => (d && d.id) ? {
    tracks: d.tracks_count ?? null,
    title:  d.title || null,
    year:   String(d.release_date_original || d.release_date_stream || '').slice(0, 4) || null,
    label:  (d.label && d.label.name) || null,
    artist: (d.artist && d.artist.name) || null,
    barcode: d.upc || null,
} : null;
const qzDec = s => String(s || '').replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&#x([0-9a-f]+);/gi, (_, n) => String.fromCodePoint(parseInt(n, 16))).replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(+n));
// Normalise any Qobuz album URL to the server-rendered www store page. open./play.
// are SPA shells with no credits in the HTML, and an MB rel is often the slug-less
// open form — a wrong-slug www URL 301-redirects to the canonical page, so this
// always lands somewhere scrapeable. (URL shapes per Harmony; #201, chaban-mb)
function qobuzStoreUrl(albumUrl) {
    const m = String(albumUrl || '').match(/qobuz\.com\/(?:[a-z]{2}-[a-z]{2}\/)?album\/(?:[^/?#]+\/)?([a-z0-9]+)/i);
    if (!m) return albumUrl;
    if (/^https?:\/\/www\.qobuz\.com\/[a-z]{2}-[a-z]{2}\/album\/[^/]+\/[a-z0-9]+/i.test(albumUrl)) return albumUrl;   // already a www store page
    return `https://www.qobuz.com/us-en/album/x/${m[1]}`;
}
async function fetchQobuzMeta(albumUrl) {
    // Prefer the API (structured + carries the UPC); fall back to scraping the
    // store page where the API returns nothing (geo) or 429s. #201/#353
    const id = qobuzAlbumId(albumUrl);
    if (id) {
        const signedIn = qbLoggedIn();
        const m = qobuzMetaFromApi(await qobuzApi(`album/get?album_id=${encodeURIComponent(id)}`));
        if (m && m.tracks) { m._via = 'api'; return m; }   // tagged so scanQobuz can log the real source (see below)
        // #353 say WHY we're scraping so a logged-in user isn't left wondering: not signed in on
        // THIS origin → prompt; signed in but the API gave nothing → note it (geo / stale session).
        appendLog('Qobuz', signedIn
            ? `album/get returned no data despite being signed in — scraping instead (Qobuz may be geo-restricting this session)`
            : `not signed in to Qobuz on this site — scraping. Log in via ⚙ Setup → Auth for the reliable album/get path (track count + barcode)`,
            signedIn ? 'warn' : 'info');
    }
    const scraped = await fetchQobuzScrape(albumUrl);
    if (scraped) scraped._via = 'page';
    return scraped;
}
async function fetchQobuzScrape(albumUrl) {
    let r = await gmGet(qobuzStoreUrl(albumUrl));
    // Qobuz rate-limits very aggressively (429 after only a few requests, #201).
    // One polite retry honouring Retry-After; if it persists, report it distinctly
    // so the scanner can leave the row retryable instead of caching a false "no match".
    if (r.status === 429) {
        const ra = parseInt((String(r.responseHeaders || '').match(/retry-after:\s*(\d+)/i) || [])[1], 10);
        await new Promise(z => setTimeout(z, Math.min((ra > 0 ? ra : 3) * 1000, 10000)));
        r = await gmGet(qobuzStoreUrl(albumUrl));
    }
    if (r.status === 429) return { rateLimited: true };
    if (!r.ok || !r.responseText) return null;
    const html = r.responseText;
    // Track count: the page renders an empty duplicate of every track row for
    // its responsive layout, so the `track__info` blocks double-count. Each
    // real track instead carries a unique add-to-cart marker — count those.
    const trackIds = new Set([...html.matchAll(/popinAddToCartBtnPlayerTrack(\d+)/g)].map(m => m[1]));
    // Album name + year from the JSON-LD MusicAlbum block (clean, unlike og:title).
    let title = null, year = null;
    for (const m of html.matchAll(/<script type="application\/ld\+json">([\s\S]*?)<\/script>/g)) {
        try { const j = JSON.parse(m[1]); if (/MusicAlbum/.test(j['@type'] || '')) { if (j.name) title = qzDec(j.name); if (j.datePublished) year = String(j.datePublished).slice(0, 4); } } catch (e) { /* skip */ }
    }
    // Artist: og:title is "<Album>, <Artist> - Qobuz"; strip the suffix and the
    // album-name prefix to leave the credit (VA pages read "Various Artists").
    const og = qzDec((html.match(/<meta property="og:title" content="([^"]*)"/) || [])[1] || '').replace(/\s*-\s*Qobuz\s*$/i, '');
    let artist = null;
    if (title && og.startsWith(title)) artist = og.slice(title.length).replace(/^[,\s]+/, '').trim() || null;
    else if (og.includes(',')) artist = og.slice(og.lastIndexOf(',') + 1).trim() || null;
    const label = qzDec((html.match(/href="\/[a-z]{2}-[a-z]{2}\/label\/[^"]+"[^>]*>\s*([^<]{1,80})/) || [])[1] || '').trim() || null;
    // `url` = the page we actually landed on after redirects — i.e. Qobuz's REAL
    // canonical /album/<slug>/<id> (the slug includes the artist, so we can't
    // reconstruct it from the title; #201 chaban-mb). The caller uses it as the URL
    // to hand MB instead of the /album/x/<id> placeholder we fetched with.
    return { tracks: trackIds.size || null, title: title || og || null, year, label, artist, barcode: null, url: r.finalUrl || null };
}

async function scanQobuz({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'Qobuz';
    const cached = cacheGet(mbid, 'qobuz');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) { applyCachedRow('qobuz', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl && !barcode) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('qobuz', label, cached, mbTracks); return; }

    // Barcode-first: the API matches an exact UPC with no text-search ambiguity.
    // Qobuz indexes the UPC in its stored form, usually the 13-digit EAN with a
    // leading zero (e.g. MB's 199257198605 is "0199257198605" there), so a query
    // with MB's bare barcode misses — try the other GTIN paddings too (#354 shared
    // gtinVariants: raw · stripped · 12/13/14). Geo-dependent, so it falls through
    // to the normal search on no hit. #201 (chaban-mb)
    if (!existingUrl && barcode) {
        const queries = gtinVariants(barcode);
        let items = [];
        for (const q of queries) {
            const s = await qobuzApi(`album/search?query=${encodeURIComponent(q)}&limit=10`);
            items = s?.albums?.items || [];
            if (items.some(a => normBarcode(a.upc) === normBarcode(barcode))) break;
        }
        const hit = items.find(a => normBarcode(a.upc) === normBarcode(barcode)) || items[0];
        if (hit && hit.id) {
            // Qobuz's slug includes the artist, so it can't be rebuilt from the title
            // (#201 chaban-mb). Use the REAL slug the API returns (`slug` / `relative_url`);
            // if geo-stripped from the response, fall back to fetching /album/x/<id>
            // (Qobuz 301s it to the canonical URL) and keeping that landed URL.
            const fetchUrl = `https://www.qobuz.com/us-en/album/x/${hit.id}`;
            const meta = await fetchQobuzMeta(fetchUrl);
            const apiUrl = hit.slug ? `https://www.qobuz.com/us-en/album/${hit.slug}/${hit.id}`
                : (hit.relative_url ? `https://www.qobuz.com/us-en${hit.relative_url}` : null);
            const albumUrl = apiUrl || meta?.url || fetchUrl;
            appendLog(label, `Barcode ${barcode} → ${albumUrl}`, 'ok');
            const bc = meta?.barcode || hit.upc || barcode;
            cacheSet(mbid, 'qobuz', { url: albumUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode', barcode: bc });
            updateRow('qobuz', { url: albumUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode', barcode: bc });
            return;
        }
        appendLog(label, `Barcode ${barcode}: no API hit — falling back to search`);
    }

    let albumUrl = existingUrl;
    let source   = null;
    let bestMeta = null;
    if (albumUrl) {
        appendLog(label, `Using existing MB URL: ${albumUrl}`, 'ok');
        source = 'MB rels';
    } else if (cached) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('qobuz', label, cached, mbTracks);
        return;
    } else {
        const albumT  = searchTerms(album);
        const artistT = searchTerms(artist);
        // Qobuz album URLs are /<store>/album/<slug>/<id>; the store prefix varies,
        // so we site-restrict to qobuz.com and keep only /album/.../<id> hits.
        const q = isVariousArtists
            ? `site:qobuz.com ${albumT} album`
            : `site:qobuz.com ${artistT} ${albumT}`;
        const candidates = await searchWeb(q, u => /qobuz\.com\/[a-z]{2}-[a-z]{2}\/album\/[^/]+\/[a-z0-9]+/i.test(u), label);
        if (!candidates.length) {
            cacheSet(mbid, 'qobuz', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('qobuz', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        appendLog(label, `Verifying ${candidates.length} candidate(s) by tracks + title + artist…`);
        const best = await pickBestCandidate(candidates, fetchQobuzMeta, mbTracks, album, label, artist, isVariousArtists);
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'qobuz', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('qobuz', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        albumUrl = best.url;
        bestMeta = best.meta;
        appendLog(label, `Picked best (score=${best.score}): ${albumUrl}`, best.score >= 150 ? 'ok' : 'warn');
        source = 'search';
    }

    const meta = bestMeta || await fetchQobuzMeta(albumUrl);
    if (meta && meta.rateLimited) {
        // Don't cache — Qobuz throttled us, not a real "no match". ↻ retries. (#201)
        appendLog(label, `Rate-limited by Qobuz (429) — the link is set, track-count unverified; use ↻ to retry`, 'warn');
        updateRow('qobuz', { url: albumUrl, mbTracks, remoteTracks: null, source });
        return;
    }
    if (meta) {
        // #353 name the real source — "API album/get" (signed in; carries the barcode) vs "store page" scrape
        const via = meta._via === 'api' ? 'API album/get' : 'store page';
        appendLog(label, `Verified via ${via}: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'}${meta.barcode ? ` barcode=${meta.barcode}` : ''}`, meta.tracks ? 'ok' : 'warn');
    } else {
        appendLog(label, `Album fetch failed`, 'error');
    }
    const tracks = meta?.tracks ?? null;
    const year   = meta?.year   ?? null;
    const lbl    = meta?.label  ?? null;
    const bc     = meta?.barcode ?? null;   // UPC from the API (null on the scrape fallback) — feeds barcode-confidence #201
    cacheSet(mbid, 'qobuz', { url: albumUrl, tracks, year, label: lbl, source, barcode: bc });
    updateRow('qobuz', { url: albumUrl, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: bc });
}

// MB's media[].format strings → Discogs API's `format` query value. Other
// formats (DVD/Blu-ray/SACD/etc.) we just leave unfiltered — those are rare
// enough on Discogs that adding a filter hurts more than it helps.
function mbFormatToDiscogs(mbFormat) {
    if (!mbFormat) return null;
    const f = String(mbFormat).toLowerCase();
    if (f.includes('vinyl'))    return 'Vinyl';
    if (f.includes('cassette')) return 'Cassette';
    if (f.includes('digital') || f === 'file') return 'File';
    if (f === 'cd' || f.includes('cd'))        return 'CD';
    return null;
}

async function scanDiscogs({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, format, barcode, existingDiscogsMaster }) {
    const label = 'Discogs';
    appendLog(label, `Existing RG master: ${existingDiscogsMaster || 'none'}`);

    // Surface the existing release-group Discogs master immediately — it's the
    // authoritative RG-level link (use it, same as any existing MB rel), and it
    // shouldn't depend on whether we manage to resolve a Discogs *release*.
    if (existingDiscogsMaster) {
        const mEl = document.getElementById('master-discogs');
        if (mEl) applyMasterIcon(mEl, discogsMasterState(null, existingDiscogsMaster));
    }

    // Positive cache hit short-circuits before any API call. Cached "no
    // match" only short-circuits when there's no MB rel either — we still
    // want a freshly-added MB rel to replace a stale no-match.
    //
    // Format-mismatch invalidation: if the cached release's format differs
    // from the MB release format (e.g. cache holds a Vinyl pressing but MB
    // says CD — possible when a prior scan ran without format extraction),
    // re-search so format-aware ranking can pick the matching edition.
    const cached = cacheGet(mbid, 'discogs');
    const wantFmt = mbFormatToDiscogs(format);
    const haveFmt = mbFormatToDiscogs(cached?.format);
    const formatMismatch = !!(wantFmt && haveFmt && wantFmt !== haveFmt && cached?.url && !existingUrl);
    if (formatMismatch) {
        appendLog(label, `Cached match is ${haveFmt} but MB format is ${wantFmt} — re-scanning`, 'warn');
    } else if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        applyCachedRow('discogs', label, cached, mbTracks, discogsMasterState(cached.masterUrl, existingDiscogsMaster));
        return;
    }
    if (cached && !cached.url && !existingUrl) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('discogs', label, cached, mbTracks, discogsMasterState(cached.masterUrl, existingDiscogsMaster));
        return;
    }

    let releaseUrl = existingUrl;
    let releaseId  = null;
    let source     = null;

    if (releaseUrl) {
        appendLog(label, `Using existing MB URL: ${releaseUrl}`, 'ok');
        source = 'MB rels';
        const m = releaseUrl.match(/\/release\/(\d+)/);
        if (m) releaseId = m[1];
    } else {
        // Barcode-first (#182): Discogs' search API supports `barcode=<UPC>` — an exact
        // match, preferred over the text search (which can pick a different pressing of
        // the same title). Falls through to the text search when there's no UPC hit.
        if (barcode) {
            const bu = `https://api.discogs.com/database/search?barcode=${encodeURIComponent(barcode)}&type=release&per_page=5`;
            appendLog(label, `Barcode ${barcode}: ${bu}`);
            const br = await gmGet(bu);
            if (br.ok) {
                try {
                    const bres = JSON.parse(br.responseText).results || [];
                    let bbest = null;
                    for (const r of bres.slice(0, 8)) {
                        const [artistPart, ...albumParts] = (r.title || '').split(' - ');
                        const sc = scoreCandidate({ title: albumParts.join(' - '), artist: artistPart }, mbTracks, album, artist, isVariousArtists);
                        if (!bbest || sc > bbest.score) bbest = { score: sc, item: r };
                    }
                    if (bbest && bbest.score >= 50) {
                        releaseId  = String(bbest.item.id);
                        releaseUrl = `https://www.discogs.com/release/${releaseId}`;
                        source     = 'barcode';
                        appendLog(label, `Barcode ${barcode} → ${releaseUrl}`, 'ok');
                    } else appendLog(label, `Barcode ${barcode}: ${bres.length ? 'no confident match' : 'no result'} — falling back to text search`);
                } catch (e) { appendLog(label, `Barcode search parse error: ${e.message}`, 'error'); }
            } else appendLog(label, `Barcode ${barcode} search failed — falling back to text search`, 'warn');
        }
        if (!releaseUrl) {   // (#182) text search only when barcode-first didn't resolve
        // Discogs HTTP UI is Cloudflare-protected (403); the public API works
        // without an auth token for search + detail (~25 req/min unauth'd).
        // For VA compilations drop the artist term — Discogs doesn't credit
        // compilations to a literal "Various Artists" string, so including
        // it in the query produces 0 results.
        const apiQ = isVariousArtists ? album : `${artist} ${album}`;
        const discogsFmt = mbFormatToDiscogs(format);
        // Format-aware first try: a CD release shouldn't pick a vinyl Discogs
        // entry when a CD edition exists. If the format-filtered search
        // returns 0 results, retry without the format filter and accept
        // whatever's available.
        const trySearch = async withFormat => {
            const u = `https://api.discogs.com/database/search?q=${encodeURIComponent(apiQ)}&type=release&per_page=5${withFormat ? `&format=${encodeURIComponent(discogsFmt)}` : ''}`;
            appendLog(label, `API search${withFormat ? ` (format=${discogsFmt})` : ''}: ${u}`);
            const r = await gmGet(u);
            appendLog(label, `API search: status=${r.status} ${r.responseText.length}b in ${r.ms}ms`);
            return r;
        };
        let sr = await trySearch(!!discogsFmt);
        if (sr.ok) {
            try {
                let data = JSON.parse(sr.responseText);
                if ((data.results || []).length === 0 && discogsFmt) {
                    appendLog(label, `0 results with format=${discogsFmt} — retrying without format filter`, 'warn');
                    sr   = await trySearch(false);
                    data = sr.ok ? JSON.parse(sr.responseText) : { results: [] };
                }
                // Score every result by parsing its `title` ("Artist - Album")
                // and matching against MB artist + album. Discogs search
                // results don't expose track count, so we score on title +
                // artist only — the detail fetch later will catch a track
                // mismatch separately. Picking the *best* candidate (rather
                // than blindly taking results[0]) fixes the "13-track Mista
                // Savona release picked for a 4-track Om Unit album" bug.
                const candidates = (data.results || []).slice(0, 8);
                let best = null;
                for (const r of candidates) {
                    const [artistPart, ...albumParts] = (r.title || '').split(' - ');
                    const albumPart = albumParts.join(' - ');
                    const sc = scoreCandidate({ title: albumPart, artist: artistPart }, mbTracks, album, artist, isVariousArtists);
                    appendLog(label, `  cand score=${sc}  id=${r.id}  artist="${artistPart}"  album="${albumPart}"  format=${(r.format || []).join(',')}`);
                    if (!best || sc > best.score) best = { score: sc, item: r };
                    if (sc >= 150) break;
                }
                if (best && best.score >= 50) {
                    releaseId  = String(best.item.id);
                    releaseUrl = `https://www.discogs.com/release/${releaseId}`;
                    source     = discogsFmt && (best.item.format || []).some(f => mbFormatToDiscogs(f) === discogsFmt)
                        ? `API search (format=${discogsFmt})`
                        : 'API search';
                    appendLog(label, `Found via API (score=${best.score}): ${releaseUrl}`, 'ok');
                } else if (candidates.length) {
                    appendLog(label, `Top candidate score=${best?.score ?? 'n/a'} below 50 threshold — no confident match`, 'warn');
                } else {
                    appendLog(label, `API search returned 0 results`, 'warn');
                }
            } catch (e) { appendLog(label, `API JSON parse error: ${e.message}`, 'error'); }
        } else {
            appendLog(label, `API search failed`, 'error');
        }
        }   // (#182) end of barcode-first guard around the text search
        if (!releaseUrl) {
            // searchWeb returns an ARRAY of filtered candidate URLs (not a single string). The old code
            // did `if (fallback) { fallback.match(...) }` — but `[]` is truthy, so an empty result threw a
            // TypeError that aborted the whole scan before the not-found render below. Take the first hit.
            const candidates = await searchWeb(`site:discogs.com release ${artist} ${album}`, u => /www\.discogs\.com\/release\/\d+/.test(u) || /www\.discogs\.com\/.*\/release\/\d+/.test(u), label);
            const hit = candidates[0];
            if (hit) {
                releaseUrl = hit;
                const m = hit.match(/\/release\/(\d+)/);
                if (m) releaseId = m[1];
                source = 'web search';
            }
        }
    }

    if (!releaseUrl) {
        cacheSet(mbid, 'discogs', { url: null, tracks: null, year: null, label: null, source: 'search' });
        // Even with no resolved release, surface the existing RG-level Discogs master.
        updateRow('discogs', { url: null, mbTracks, remoteTracks: null,
            masterState: discogsMasterState(null, existingDiscogsMaster) });
        return;
    }

    let tracks = null, year = null, lbl = null, fmt = null, masterUrl = null, foundBarcode = null;
    if (releaseId) {
        const detailUrl = `https://api.discogs.com/releases/${releaseId}`;
        appendLog(label, `API detail: ${detailUrl}`);
        const dr = await gmGet(detailUrl);
        appendLog(label, `API detail: status=${dr.status} ${dr.responseText.length}b in ${dr.ms}ms`);
        if (dr.ok) {
            try {
                const data = JSON.parse(dr.responseText);
                // Discogs tracklist entries have type_ values "track" (normal),
                // "index" (a parent of sub_tracks, used for medleys like the
                // 9a/9b/9c entries on Essiebons Special — a single MB
                // position 9 with 3 songs underneath), and "heading" (section
                // dividers). MB counts the medley parent as one position, so
                // include both "track" and "index" — exclude only "heading".
                const trk = (data.tracklist || []).filter(t => t.type_ === 'track' || t.type_ === 'index' || !t.type_);
                tracks = trk.length || null;
                year   = data.year || null;
                lbl    = (data.labels || []).map(l => l.name).join(', ') || null;
                // Discogs `formats` is an array of {name, qty, descriptions}.
                // We only want the headline — qty + name (e.g. "2×Vinyl") — and
                // skip the pressing-detail descriptions ('12"', '33 ⅓ RPM',
                // 'Mini-Album', etc.) that bloat the meta line without adding
                // useful info for verifying it's the right release.
                fmt = (data.formats || []).map(f => {
                    return (f.qty && f.qty !== '1' ? `${f.qty}×` : '') + (f.name || '');
                }).join(', ') || null;
                // Master URL — points at the release-group equivalent on Discogs.
                // Stored so the + flow can offer to add it to MB's release-group
                // url-rels (a separate edit page from the release).
                if (data.master_id) masterUrl = `https://www.discogs.com/master/${data.master_id}`;
                // Barcode (#182): Discogs publishes it in `identifiers` ([{type:"Barcode", value}]).
                // Capturing it lets the barcode-confidence check compare/confirm Discogs like the
                // other barcode-exposing providers (previously it was treated as unconfirmable).
                foundBarcode = ((data.identifiers || []).find(i => /^barcode$/i.test(i.type || '')) || {}).value || null;
                if (foundBarcode) foundBarcode = String(foundBarcode).replace(/\s+/g, '');
                appendLog(label, `API detail parsed: tracks=${tracks} year=${year || '?'} label=${lbl || '?'} format=${fmt || '?'} barcode=${foundBarcode || '-'} master=${masterUrl || '-'}`, 'ok');
            } catch (e) { appendLog(label, `API detail parse error: ${e.message}`, 'error'); }
        } else { appendLog(label, `API detail failed`, 'error'); }
    }

    cacheSet(mbid, 'discogs', { url: releaseUrl, tracks, year, label: lbl, format: fmt, masterUrl, source, barcode: foundBarcode });
    updateRow('discogs', {
        url: releaseUrl, mbTracks, remoteTracks: tracks, year, label: lbl, format: fmt, source, barcode: foundBarcode,
        masterState: discogsMasterState(masterUrl, existingDiscogsMaster),
    });
}

// Fetch Bandcamp album metadata via the standard album page. Bandcamp ships
// a Schema.org JSON-LD block with numTracks/name/datePublished/recordLabel as
// native JSON (not HTML-escaped) — the cleanest source. The legacy `data-tralbum`
// attribute has the same data but with &quot; entities and requires decoding.
async function fetchBandcampMeta(albumUrl) {
    const ar = await gmGet(albumUrl);
    if (!ar.ok || !ar.responseText) return null;
    const html = ar.responseText;
    const numTracksMatch = html.match(/"numTracks"\s*:\s*(\d+)/);
    const titleMatch = html.match(/"@type"\s*:\s*"MusicAlbum"[\s\S]{0,200}?"name"\s*:\s*"([^"]+)"/)
                    || html.match(/<meta\s+name="title"\s+content="([^"|]+)/);
    const yMatch = html.match(/"datePublished"\s*:\s*"[^"]*?(\d{4})\b/);
    const lMatch = html.match(/"recordLabel"\s*:\s*\{[^}]*?"name"\s*:\s*"([^"]+)"/);
    // Album artist comes from JSON-LD `"byArtist":{"name":"…"}` (the band/
    // label that hosts the page may differ from the album artist on
    // multi-artist labels, so prefer byArtist).
    const artistMatch = html.match(/"byArtist"\s*:\s*\{[^}]*?"name"\s*:\s*"([^"]+)"/)
                     || html.match(/<meta\s+name="Description"\s+content="from\s+([^"|,]+)/i);
    const formats = [...new Set(
        [...html.matchAll(/"musicReleaseFormat"\s*:\s*"(\w+)"/g)]
            .map(m => m[1].replace(/Format$/, ''))
    )];
    // Hidden download-only tracks (#183): the JSON-LD `numTracks` (and the player's
    // trackinfo) only count STREAMABLE tracks, but the og:description meta tag —
    // "N track album" — carries the REAL total including bonus tracks that are only
    // in the download. So total − streaming = hidden. (Only trust the tag when it
    // matches "N track album"; an artist-set custom description won't, and we just
    // fall back to numTracks.) Same signal Harmony / bandcamp_importer use.
    const streaming = numTracksMatch ? parseInt(numTracksMatch[1], 10) : null;
    const ogTag = html.match(/<meta[^>]+property=["']og:description["'][^>]*>/i)?.[0] || '';
    const ogTotal = (ogTag.match(/content=["']\s*(\d+)\s+track\b/i) || [])[1];
    const total = ogTotal ? parseInt(ogTotal, 10) : null;
    const hiddenTracks = (total != null && streaming != null && total > streaming) ? total - streaming : 0;
    // Barcode (#194): the UPC lives in TralbumData.current.upc — embedded in the
    // page's `data-tralbum` attribute (entity-encoded JSON), not the JSON-LD.
    // Often null (Bandcamp barcodes are hand-entered). Per Harmony (kellnerd/harmony#42)
    // the digital `current.upc` can coincide with a physical package's barcode —
    // when it does, it's the package's, not the digital release's, so we drop it.
    let barcode = null, barcodeIsPackage = false;
    const trm = html.match(/data-tralbum="([^"]*)"/);
    if (trm) {
        try {
            const tr = JSON.parse(trm[1].replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, '&').replace(/&gt;/g, '>').replace(/&lt;/g, '<'));
            const upc = tr && tr.current && tr.current.upc;
            if (upc) {
                const pkgUpcs = (tr.packages || []).map(pp => normBarcode(pp && pp.upc)).filter(Boolean);
                if (pkgUpcs.includes(normBarcode(upc))) barcodeIsPackage = true;   // physical package's barcode — not the digital release's
                else barcode = String(upc).trim();
            }
        } catch (e) { /* malformed data-tralbum — no barcode */ }
    }
    return {
        // report the true total (incl. hidden) as the track count — that's what the
        // Bandcamp release actually contains, and what MB compares against.
        tracks: total != null ? total : streaming,
        streamingTracks: streaming,
        hiddenTracks,
        title:  titleMatch?.[1] || null,
        year:   yMatch?.[1]     || null,
        label:  lMatch?.[1]     || null,
        format: formats.length ? formats.join(', ') : null,
        artist: artistMatch?.[1]?.trim() || null,
        barcode,
        barcodeIsPackage,
    };
}

// Bandcamp's own search at /search?item_type=a returns a server-rendered HTML
// list of album results — works without any token in a real browser (the
// browser carries Bandcamp's CF clearance cookie). Try this BEFORE the generic
// web-search engines: when both are available it's faster, lower-noise (only
// album results), and not subject to Brave/DDG rate-limits. Falls through to
// `searchWeb` if Cloudflare's bot challenge fires from a cookie-less context.
async function searchBandcampNative(query, label) {
    const url = `https://bandcamp.com/search?q=${encodeURIComponent(query)}&item_type=a`;
    appendLog(label, `Native: ${url}`);
    const res = await gmGet(url, { headers: { 'Accept': 'text/html,application/xhtml+xml' } });
    appendLog(label, `Native: status=${res.status} ${res.responseText.length}b in ${res.ms}ms`);
    if (!res.ok) return [];
    // Cloudflare's interstitial is ~3 KB and titled "Client Challenge". When we
    // see it, log it and let the caller fall through to web search — in a real
    // browser with prior Bandcamp cookies this branch is skipped.
    if (/<title>\s*Just a moment/i.test(res.responseText) || /<title>\s*Client Challenge/i.test(res.responseText) || res.responseText.length < 5000) {
        appendLog(label, `Native: blocked by Cloudflare challenge (cookie-less request) — falling through`, 'warn');
        return [];
    }
    // Bandcamp's search-result anchors point at full *.bandcamp.com/album/<slug>
    // URLs. Strip query strings and dedupe.
    const urls = [...res.responseText.matchAll(/href="(https?:\/\/[a-z0-9-]+\.bandcamp\.com\/album\/[^"?#]+)/gi)].map(m => m[1]);
    const unique = [...new Set(urls)];
    appendLog(label, `Native: ${unique.length} unique album link(s)`, unique.length ? 'ok' : 'warn');
    return unique.slice(0, 5);
}

async function scanBandcamp({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists }) {
    const label = 'Bandcamp';

    const cached = cacheGet(mbid, 'bandcamp');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        applyCachedRow('bandcamp', label, cached, mbTracks);
        return;
    }
    if (cached && !cached.url && !existingUrl) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('bandcamp', label, cached, mbTracks);
        return;
    }

    let albumUrl = existingUrl;
    let source   = null;
    let bestMeta = null;

    if (albumUrl) {
        appendLog(label, `Using existing MB URL: ${albumUrl}`, 'ok');
        source = 'MB rels';
    } else {
        // Priority 1: Bandcamp's own search (works when the browser has CF
        // clearance — common after any prior Bandcamp visit). Skip when
        // blocked. VA compilations: search by album only — Bandcamp credits
        // them to the label, not "Various Artists".
        const albumT  = searchTerms(album);
        const artistT = searchTerms(artist);
        const nativeQ = isVariousArtists ? albumT : `${artistT} ${albumT}`;
        let candidates = await searchBandcampNative(nativeQ, label);
        let candidateSource = 'native';
        if (!candidates.length) {
            // Priority 2: generic web search. Punctuation-stripped tokens, no
            // exact-phrase quotes — MB's "Foo: Bar!" and Bandcamp's
            // "Foo - Bar" still hit each other this way; the verifier handles
            // the rest. Bandcamp candidate pages are ~300 KB so cap at 3.
            const q = isVariousArtists
                ? `site:bandcamp.com/album/ ${albumT}`
                : `site:bandcamp.com/album/ ${artistT} ${albumT}`;
            candidates = await searchWeb(q, u => /^https?:\/\/[a-z0-9-]+\.bandcamp\.com\/album\//i.test(u), label, 3);
            candidateSource = 'search';
        }
        if (!candidates.length) {
            cacheSet(mbid, 'bandcamp', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('bandcamp', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        appendLog(label, `Verifying ${candidates.length} candidate(s) by tracks + title + artist…`);
        const best = await pickBestCandidate(candidates, fetchBandcampMeta, mbTracks, album, label, artist, isVariousArtists);
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'bandcamp', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('bandcamp', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        albumUrl = best.url;
        bestMeta = best.meta;
        appendLog(label, `Picked best (score=${best.score}): ${albumUrl}`, best.score >= 150 ? 'ok' : 'warn');
        source = candidateSource;
    }

    const meta = bestMeta || await fetchBandcampMeta(albumUrl);
    const hidden = meta?.hiddenTracks || 0;
    if (meta) {
        const trk = hidden > 0 ? `${meta.tracks} (${meta.streamingTracks} streaming + ${hidden} download-only hidden)` : `${meta.tracks}`;
        appendLog(label, `Album parsed: tracks=${trk} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'} format=${meta.format || '?'} barcode=${meta.barcode || (meta.barcodeIsPackage ? 'package-only (ignored)' : '-')}`, meta.tracks ? 'ok' : 'warn');
        if (hidden > 0) appendLog(label, `${hidden} download-only track(s) hidden from streaming — Bandcamp release has ${meta.tracks}, not ${meta.streamingTracks}`, 'warn');
        if (meta.barcodeIsPackage) appendLog(label, `current.upc matches a physical package's barcode — not the digital release's, so ignored (harmony#42)`, 'warn');
    } else {
        appendLog(label, `Album page failed`, 'error');
    }
    const tracks = meta?.tracks ?? null;
    const year   = meta?.year   ?? null;
    const lbl    = meta?.label  ?? null;
    const fmt    = meta?.format ?? null;
    const bc     = meta?.barcode ?? null;   // #194: digital release UPC (null when absent or package-only)
    cacheSet(mbid, 'bandcamp', { url: albumUrl, tracks, year, label: lbl, format: fmt, source, hiddenTracks: hidden, barcode: bc });
    updateRow('bandcamp', { url: albumUrl, mbTracks, remoteTracks: tracks, year, label: lbl, format: fmt, source, hiddenTracks: hidden, barcode: bc });
}

// ─── SoundCloud (#439) ──────────────────────────────────────────────────────
// Unlike every other provider, SoundCloud can't be *searched by barcode* — the
// release UPC lives per-track inside a SET's api-v2 metadata
// (publisher_metadata.upc_or_ean, the same value across the set on distributed
// releases; self-uploads omit it). So this provider is LINK-DERIVED like
// Bandcamp: when the release links a SoundCloud SET, read its barcode + track
// count from the anonymous api-v2 (public client_id lifted from the web-player
// JS — no login) and feed the barcode-confidence check. A conservative native
// set search (title + track-count verified) covers the no-link case.
let _pcScClientId = null;
async function soundcloudClientId() {
    if (_pcScClientId) return _pcScClientId;
    const home = await gmGet('https://soundcloud.com/discover', { headers: { Accept: 'text/html' } });
    const assets = [...(home.responseText || '').matchAll(/https:\/\/a-v2\.sndcdn\.com\/assets\/[^"']+\.js/g)].map(m => m[0]);
    for (const a of assets.reverse()) {
        const js = await gmGet(a);
        const m = (js.responseText || '').match(/client_id\s*[:=]\s*"([a-zA-Z0-9]{20,40})"/);
        if (m) { _pcScClientId = m[1]; return _pcScClientId; }
    }
    throw new Error('no client_id in the web-player JS');
}
const SC_API_V2 = 'https://api-v2.soundcloud.com';
async function fetchSoundcloudSet(setUrl) {
    const cid = await soundcloudClientId();
    const rj = async (u) => { const r = await gmGet(u, { headers: { Accept: 'application/json' } }); return r.ok ? JSON.parse(r.responseText || 'null') : null; };
    const pl = await rj(`${SC_API_V2}/resolve?url=${encodeURIComponent(setUrl)}&client_id=${cid}`);
    // a bare track URL is a single-track release (#439, chaban-mb) — its own publisher_metadata carries the barcode
    if (pl && pl.kind === 'track') {
        const pm = pl.publisher_metadata || {};
        const pl1 = (pm.p_line || '').replace(/^\s*©?℗?\s*\d{4}\s*/, '').trim();
        return { title: pl.title || '', tracks: 1, barcode: String(pm.upc_or_ean || '').trim() || null, year: (pl.release_date || pl.display_date || pl.created_at || '').slice(0, 4) || null, label: pl1 || null };
    }
    if (!pl || pl.kind !== 'playlist') return null;
    const stubs = (pl.tracks || []).filter(t => t && t.id);
    const byId = new Map(); (pl.tracks || []).forEach(t => { if (t && t.title) byId.set(t.id, t); });
    const missing = stubs.filter(t => !byId.has(t.id)).map(t => t.id);
    for (let i = 0; i < missing.length; i += 50) {
        const b = await rj(`${SC_API_V2}/tracks?ids=${encodeURIComponent(missing.slice(i, i + 50).join(','))}&client_id=${cid}`);
        (b || []).forEach(t => { if (t && t.id != null) byId.set(t.id, t); });
    }
    const tracks = stubs.map(s => byId.get(s.id)).filter(Boolean);
    const upcs = [...new Set(tracks.map(t => String((t.publisher_metadata || {}).upc_or_ean || '').trim()).filter(Boolean))];
    const pLine = (tracks.map(t => (t.publisher_metadata || {}).p_line || '').find(Boolean) || '').replace(/^\s*©?℗?\s*\d{4}\s*/, '').trim();
    return {
        title:   pl.title || '',
        tracks:  pl.track_count || tracks.length || null,
        // only trust a barcode the WHOLE set agrees on — a mixed-UPC compilation gives none
        barcode: upcs.length === 1 ? upcs[0] : null,
        year:    (pl.release_date || pl.display_date || pl.created_at || '').slice(0, 4) || null,
        label:   pLine || pl.label_name || null,
        // #527 follow-up (majkinetor, live): "SC shows as digital, although it
        // is assumed" — SoundCloud never actually tells us the RELEASE's
        // format (a set page says nothing about whether the release also
        // exists on CD/vinyl), so hardcoding 'Digital Media' here rendered
        // the format-confidence circle as if it were a CONFIRMED value, same
        // visual weight as Bandcamp/Discogs' real parsed format. SoundCloud
        // is a digital-only storefront exactly like Spotify/Apple/Tidal/etc —
        // it now relies on the same DIGITAL_ONLY_PROVIDERS fallback they use
        // (still correctly treated as "digital" for the mismatch check, just
        // not displayed as if it were confirmed).
    };
}
// #527 follow-up (majkinetor, live): "Soundcloud logs seem insufficient...
// Not matched via what route? So make logs telling without us having to
// deep dive userscript docs." — brought up to the same verbosity every
// other provider already uses (see scanDeezer just below for the
// reference shape): log the client_id fetch, the search request + status,
// the candidate count, and EVERY candidate considered with why it did or
// didn't match — not just the final pick or a bare "no match".
async function scanSoundcloud({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists }) {
    const label = 'SoundCloud';
    const cached = cacheGet(mbid, 'soundcloud');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) { applyCachedRow('soundcloud', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('soundcloud', label, cached, mbTracks); return; }

    // #527 (majkinetor, live): a track-level SoundCloud relationship (one of
    // the release's own recordings linking to its own track page) got swept
    // up and used as if it were the RELEASE's SoundCloud URL on an 11-track
    // release. "existingUrl" is whatever the DOM/API scrape considered a
    // release-level rel, but that scrape can't always tell a genuine
    // release-level link from a per-track one that merely rendered
    // somewhere in scope — so verify it before trusting it: fetch it and
    // check its own track count. A bare-track result (tracks=1) is only
    // plausibly the release's own URL when the release ITSELF is
    // single-track (#439's documented case); on a multi-track release it's
    // almost certainly a mismatched/track-level link, not the release's —
    // fall through to a native search instead of caching a wrong URL as
    // "confirmed in MB".
    let setUrl = null, source = null, meta = null;
    if (existingUrl) {
        appendLog(label, `Checking existing MB URL: ${existingUrl}`);
        const existingMeta = await fetchSoundcloudSet(existingUrl).catch(e => { appendLog(label, `Existing URL fetch failed: ${e && e.message}`, 'error'); return null; });
        if (existingMeta && !(mbTracks > 1 && existingMeta.tracks === 1)) {
            setUrl = existingUrl; source = 'MB rels'; meta = existingMeta;
            appendLog(label, `Using existing MB URL: ${setUrl} (tracks=${existingMeta.tracks})`, 'ok');
        } else if (existingMeta) {
            appendLog(label, `Existing MB URL is a single track (tracks=1) on a ${mbTracks}-track release — likely a track-level relationship, not the release's; searching instead`, 'warn');
        } else {
            appendLog(label, `Existing MB URL didn't resolve to a real track/set — searching instead`, 'warn');
        }
    }
    if (!setUrl) {
        // No usable MB link → conservative native SET search (SoundCloud is
        // track-centric, so verify by title + track count before trusting a
        // set's barcode).
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const cid = await soundcloudClientId().catch(e => { appendLog(label, `Couldn't get a SoundCloud client_id (web-player JS parse failed: ${e && e.message}) — search unavailable`, 'error'); return null; });
        if (cid) {
            const searchUrl = `${SC_API_V2}/search/playlists?q=${encodeURIComponent(q)}&limit=5&client_id=${cid}`;
            appendLog(label, `Search: q="${q}"`);
            const r = await gmGet(searchUrl, { headers: { Accept: 'application/json' } });
            appendLog(label, `Search: status=${r.status} ${(r.responseText || '').length}b in ${r.ms}ms`);
            let hits = []; try { hits = (JSON.parse(r.responseText || 'null')?.collection) || []; } catch (e) { appendLog(label, `Search: JSON parse error: ${e.message}`, 'error'); }
            appendLog(label, `Search: ${hits.length} candidate(s)`);
            const norm = s => (s || '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
            const want = norm(album);
            hits.forEach(h => {
                const titleMatch = h.kind === 'playlist' && norm(h.title).includes(want);
                const trackMatch = mbTracks && h.track_count === mbTracks;
                appendLog(label, `  cand kind=${h.kind}  tracks=${h.track_count ?? '?'}  title="${h.title || ''}"  titleMatch=${titleMatch}  trackCountMatch=${trackMatch}  url=${h.permalink_url || '?'}`);
            });
            const pick = hits.find(h => h.kind === 'playlist' && norm(h.title).includes(want) && mbTracks && h.track_count === mbTracks)
                      || hits.find(h => h.kind === 'playlist' && norm(h.title).includes(want));
            if (pick && pick.permalink_url) { setUrl = pick.permalink_url; source = 'search'; appendLog(label, `Search picked: ${setUrl} (tracks=${pick.track_count})`, 'ok'); }
            else appendLog(label, hits.length ? `Search: none of the ${hits.length} candidate(s) matched the album title` : `Search: no playlist results for this query`, 'warn');
        }
        if (!setUrl) { appendLog(label, `No matching set found`, 'warn'); cacheSet(mbid, 'soundcloud', { url: null, tracks: null, year: null, label: null, source: 'search' }); updateRow('soundcloud', { url: null, mbTracks, remoteTracks: null }); return; }
    }

    if (!meta) meta = await fetchSoundcloudSet(setUrl).catch(e => { appendLog(label, `Set fetch failed: ${e && e.message}`, 'error'); return null; });
    if (meta) appendLog(label, `Set parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'} barcode=${meta.barcode || '-'}`, meta.tracks ? 'ok' : 'warn');
    else appendLog(label, `Set parse returned nothing — resolve() likely failed for ${setUrl}`, 'error');
    const entry = { url: setUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, format: meta?.format ?? null, source, barcode: meta?.barcode ?? null };
    cacheSet(mbid, 'soundcloud', entry);
    updateRow('soundcloud', { url: setUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, format: meta?.format ?? null, source, barcode: meta?.barcode ?? null });
}

// ─── Audiomack (#664) ───────────────────────────────────────────────────────
// Audiomack's API (api.audiomack.com/v1) wants every call OAuth 1.0a-signed, but
// the web player's own consumer key + secret are public, so no login is needed.
// The album and song endpoints carry the release barcode (`upc`), track count,
// release date and the ℗ line. Search finds albums by text only (no barcode
// index) and its hits carry no barcode, so each plausible hit is fetched and a
// hit whose barcode equals MB's wins; without one, title + track count decide.
// Re-uploads by fans are common there, so a hit that has no barcode at all is
// never picked over one that has.
const AM_API = 'https://api.audiomack.com/v1/';
const AM_KEY = 'audiomack-web', AM_SECRET = 'bd8a07e9f23fbe9d808646b730f89b8e';
const amEnc = s => encodeURIComponent(s).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());
async function audiomackGet(endpoint, params = {}) {
    const url = AM_API + endpoint;
    const p = { ...params, oauth_consumer_key: AM_KEY, oauth_nonce: Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2),
        oauth_signature_method: 'HMAC-SHA1', oauth_timestamp: String(Math.floor(Date.now() / 1000)), oauth_version: '1.0' };
    const qs = Object.keys(p).sort().map(k => `${amEnc(k)}=${amEnc(p[k])}`).join('&');
    const base = ['GET', amEnc(url), amEnc(qs)].join('&');
    const enc = new TextEncoder();
    const key = await crypto.subtle.importKey('raw', enc.encode(amEnc(AM_SECRET) + '&'), { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
    const sig = btoa(String.fromCharCode(...new Uint8Array(await crypto.subtle.sign('HMAC', key, enc.encode(base)))));
    const r = await gmGet(`${url}?${qs}&oauth_signature=${amEnc(sig)}`, { headers: { Accept: 'application/json' } });
    let j = null; try { j = JSON.parse(r.responseText || 'null'); } catch (e) { /* not JSON */ }
    return { status: r.status, ms: r.ms, results: (r.ok && j) ? j.results : null };
}
// audiomack.com/<artist>/album/<slug> or /<artist>/song/<slug> → the API path
function audiomackRef(u) {
    const m = String(u || '').match(/^https?:\/\/(?:www\.)?audiomack\.com\/([^/?#]+)\/(album|song)\/([^/?#]+)/i);
    return m ? { artist: m[1], kind: m[2].toLowerCase(), slug: m[3] } : null;
}
function audiomackMeta(it, url) {
    const ts = Number(it.original_release_date || it.released || 0);
    // "℗ Spaceship/ Bad Habit/ Atlantic Records,  2025 Spaceship ..." → the part before ", <year>"
    const pl = String(it.pline || '').replace(/^[\s©℗]*(?:\(P\)\s*)?(?:\d{4}\s+)?/i, '').split(/,\s+\d{4}\b/)[0].trim();
    return {
        url,
        title:   it.title || '',
        artist:  it.artist || '',
        tracks:  it.type === 'album' ? (Array.isArray(it.tracks) ? it.tracks.length : null) : 1,
        barcode: String(it.upc || '').replace(/\D/g, '') || null,
        year:    ts ? String(new Date(ts * 1000).getUTCFullYear()) : null,
        label:   pl || it.uploader?.label || null,
    };
}
async function fetchAudiomack(url) {
    const ref = audiomackRef(url);
    if (!ref) return null;
    const r = await audiomackGet(`music/${ref.kind}/${ref.artist}/${ref.slug}`);
    return r.results ? audiomackMeta(r.results, `https://audiomack.com/${ref.artist}/${ref.kind}/${ref.slug}`) : null;
}
async function scanAudiomack({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'Audiomack';
    const cached = cacheGet(mbid, 'audiomack');
    if (cached?.url && (!existingUrl || pcSameUrl(existingUrl, cached.url))) { applyCachedRow('audiomack', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('audiomack', label, cached, mbTracks); return; }

    let meta = null, source = null;
    if (existingUrl) {
        appendLog(label, `Checking existing MB URL: ${existingUrl}`);
        const m = await fetchAudiomack(existingUrl).catch(e => { appendLog(label, `Existing URL fetch failed: ${e && e.message}`, 'error'); return null; });
        // a song link on a multi-track release is a track-level relationship, not the release's (as with SoundCloud, #527)
        if (m && !(mbTracks > 1 && m.tracks === 1)) { meta = m; source = 'MB rels'; appendLog(label, `Using existing MB URL: ${m.url} (tracks=${m.tracks})`, 'ok'); }
        else if (m) appendLog(label, `Existing MB URL is a single song on a ${mbTracks}-track release — likely a track-level relationship; searching instead`, 'warn');
        else appendLog(label, `Existing MB URL didn't resolve to an Audiomack album or song — searching instead`, 'warn');
    }
    if (!meta) {
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const show = mbTracks === 1 ? 'songs' : 'albums';
        appendLog(label, `Search: q="${q}" show=${show}`);
        const r = await audiomackGet('search', { q, show, limit: '10' }).catch(e => { appendLog(label, `Search failed: ${e && e.message}`, 'error'); return null; });
        const hits = (r && Array.isArray(r.results)) ? r.results : [];
        if (r) appendLog(label, `Search: status=${r.status} in ${r.ms}ms — ${hits.length} candidate(s)`);
        const norm = s => (s || '').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
        const want = norm(album);
        const plausible = hits.filter(h => {
            const n = norm(h.title);
            const ok = n === want || n.startsWith(want + ' ') || (want && n.includes(want));
            const ref = h.uploader?.url_slug && h.url_slug ? `https://audiomack.com/${h.uploader.url_slug}/${h.type === 'album' ? 'album' : 'song'}/${h.url_slug}` : '?';
            appendLog(label, `  cand type=${h.type} tracks=${Array.isArray(h.tracks) ? h.tracks.length : (h.type === 'song' ? 1 : '?')} title="${h.title || ''}" artist="${h.artist || ''}" titleMatch=${ok} url=${ref}`);
            return ok && ref !== '?';
        }).slice(0, 5);
        const metas = [];
        for (const h of plausible) {
            const m = await fetchAudiomack(`https://audiomack.com/${h.uploader.url_slug}/${h.type === 'album' ? 'album' : 'song'}/${h.url_slug}`).catch(() => null);
            if (!m) continue;
            appendLog(label, `  fetched ${m.url}: tracks=${m.tracks} barcode=${m.barcode || '-'}${barcode && m.barcode === barcode ? ' (= MB barcode)' : ''}`);
            metas.push(m);
        }
        const pick = (barcode && metas.find(m => m.barcode === barcode))
                  || metas.find(m => m.barcode && m.tracks === mbTracks)
                  || metas.find(m => m.barcode && scoreCandidate(m, mbTracks, album, artist, isVariousArtists) >= 100);
        if (pick) { meta = pick; source = 'search'; appendLog(label, `Search picked: ${pick.url}${barcode && pick.barcode === barcode ? ' (barcode match)' : ' (title + track count)'}`, 'ok'); }
        else {
            appendLog(label, metas.length ? `Search: none of the ${metas.length} fetched candidate(s) matched by barcode or track count` : `No matching album found`, 'warn');
            cacheSet(mbid, 'audiomack', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('audiomack', { url: null, mbTracks, remoteTracks: null });
            return;
        }
    }
    appendLog(label, `Parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'} barcode=${meta.barcode || '-'}`, meta.tracks ? 'ok' : 'warn');
    const entry = { url: meta.url, tracks: meta.tracks, year: meta.year, label: meta.label, format: null, source, barcode: meta.barcode };
    cacheSet(mbid, 'audiomack', entry);
    updateRow('audiomack', { url: meta.url, mbTracks, remoteTracks: meta.tracks, year: meta.year, label: meta.label, format: null, source, barcode: meta.barcode });
}

// ─── YouTube Music (#639) ───────────────────────────────────────────────────
// Read through the API YouTube Music's own web player uses (youtubei/v1), which answers
// anonymous requests. There is no barcode lookup as such, but searching the barcode as
// plain text finds most albums (11 of 12 in #639's test), and artist + album with the
// "albums" filter finds nearly all the rest (19 of 20). Neither is proof: a barcode
// search can land on a sibling edition (Moderat's III Deluxe → III (Instrumentals)), and
// the album page shows no barcode to check. So every candidate, the barcode's too, has to
// pass scoreCandidate (tracks, title, artist) like a search hit. It is an internal API,
// not a public one: when it changes, the log says so, and the row is simply not found.
const YTM_API = 'https://music.youtube.com/youtubei/v1/';
const YTM_ALBUMS_FILTER = 'EgWKAQIYAWoKEAkQBRAKEAMQBA==';   // the search's "Albums" chip
const YTM_CLIENT = { clientName: 'WEB_REMIX', clientVersion: '1.20250101.01.00', hl: 'en', gl: 'US' };
async function ytmCall(endpoint, body, label = 'YouTube Music') {
    const r = await gmPost(`${YTM_API}${endpoint}?prettyPrint=false`, JSON.stringify({ context: { client: YTM_CLIENT }, ...body }), { headers: { 'Content-Type': 'application/json' }, anonymous: true });
    let j = null; try { j = JSON.parse(r.responseText); } catch {}
    const what = body.browseId || JSON.stringify(body.query);
    if (!r.ok || !j) appendLog(label, `${endpoint} ${what}: HTTP ${r.status}${r.error ? ' (' + r.error + ')' : ''}${r.ok && !j ? ', not JSON' : ''} in ${r.ms}ms — YouTube Music's API may have changed`, 'error');
    else appendLog(label, `${endpoint} ${what}: ${r.responseText.length}b in ${r.ms}ms`);
    return r.ok ? j : null;
}
const ytmText = t => (t && t.runs ? t.runs.map(x => x.text).join('') : (t && t.simpleText) || '');
function ytmWalk(o, fn) { if (!o || typeof o !== 'object') return; fn(o); for (const k in o) ytmWalk(o[k], fn); }
// The albums a search returned, in order: { id: 'MPREb_…', title, artist, year, kind }.
// A row reads "Migration" | "Album • Bonobo • 2017".
function ytmAlbumResults(j) {
    const out = [];
    ytmWalk(j, o => {
        const r = o.musicResponsiveListItemRenderer;
        const id = r && r.navigationEndpoint && r.navigationEndpoint.browseEndpoint && r.navigationEndpoint.browseEndpoint.browseId;
        if (!id || !/^MPREb_/.test(id) || out.some(x => x.id === id)) return;
        const cols = (r.flexColumns || []).map(c => ytmText(c.musicResponsiveListItemFlexColumnRenderer && c.musicResponsiveListItemFlexColumnRenderer.text));
        const sub = (cols[1] || '').split(' • ');
        const year = /^\d{4}$/.test(sub[sub.length - 1] || '') ? sub.pop() : null;
        out.push({ id, title: cols[0] || '', kind: sub[0] || '', artist: sub.slice(1).join(' • '), year });
    });
    return out;
}
// An album page (browse MPREb_…): its link, song count, title, artist and year. The count is
// the header's "13 songs • 1 hour, 14 minutes", else the tracklist's length.
async function fetchYtmAlbum(id, label = 'YouTube Music') {
    const j = await ytmCall('browse', { browseId: id }, label);
    if (!j) return null;
    let h = null, shelf = null;
    ytmWalk(j, o => { if (!h && o.musicResponsiveHeaderRenderer) h = o.musicResponsiveHeaderRenderer; if (!shelf && o.musicShelfRenderer) shelf = o.musicShelfRenderer; });
    if (!h) { appendLog(label, `browse ${id}: no album header in the answer — YouTube Music's page may have changed`, 'error'); return null; }
    const sub = ytmText(h.subtitle).split(' • ');                                  // "Album • 2013"
    const m = ytmText(h.secondSubtitle).match(/^([\d,.]+)\s+(?:song|track)s?\b/i);   // "13 songs • …"
    const tracks = m ? parseInt(m[1].replace(/\D/g, ''), 10) : (shelf && shelf.contents ? shelf.contents.length : null);
    const canon = (j.microformat && j.microformat.microformatDataRenderer && j.microformat.microformatDataRenderer.urlCanonical) || '';
    const list = (canon.match(/[?&]list=(OLAK5uy_[\w-]+)/) || JSON.stringify(j).match(/"(OLAK5uy_[\w-]+)"/) || [])[1];
    // The page's "Other versions" shelf: editions YouTube Music groups with this one (#639,
    // rinsuki). A barcode belonging to one of them can bring up this album instead, and they
    // can share title and tracklist — so the row names them, for you to check.
    const otherVersions = [];
    ytmWalk(j, o => {
        const c = o.musicCarouselShelfRenderer;
        if (!c || !/^other versions$/i.test(ytmText(c.header && c.header.musicCarouselShelfBasicHeaderRenderer && c.header.musicCarouselShelfBasicHeaderRenderer.title))) return;
        for (const it of c.contents || []) {
            const r = it.musicTwoRowItemRenderer;
            if (r) otherVersions.push({ title: ytmText(r.title), sub: ytmText(r.subtitle), id: (r.navigationEndpoint && r.navigationEndpoint.browseEndpoint && r.navigationEndpoint.browseEndpoint.browseId) || null });
        }
    });
    const songIds = ytmSongIds(shelf);   // whose credits name the label (#649)
    return {
        url: list ? `https://music.youtube.com/playlist?list=${list}` : `https://music.youtube.com/browse/${id}`,
        tracks, title: ytmText(h.title) || null, artist: ytmText(h.straplineTextOne) || null,
        year: sub.find(s => /^\d{4}$/.test(s)) || null, kind: sub[0] || null, otherVersions, songIds,
    };
}
// The songs a list links to, in order. Only a song (an "ATV" video) has credits; an album's
// tracks can link to the official audio or music video instead ("OMV": every track of Random
// Access Memories), which answers with an empty Credits dialog (#649).
function ytmSongIds(o) {
    const ids = [];
    ytmWalk(o, x => {
        const w = x.watchEndpoint;
        const type = w && w.watchEndpointMusicSupportedConfigs && w.watchEndpointMusicSupportedConfigs.watchEndpointMusicConfig && w.watchEndpointMusicSupportedConfigs.watchEndpointMusicConfig.musicVideoType;
        if (type === 'MUSIC_VIDEO_TYPE_ATV' && w.videoId && !ids.includes(w.videoId)) ids.push(w.videoId);
    });
    return ids;
}
// A song's credits (browse MPTC<videoId>, the ⋮ → Credits dialog), as { 'Performed by': [names], … }.
function ytmCreditSections(j) {
    const out = {};
    ytmWalk(j, o => {
        const s = o.dismissableDialogContentSectionRenderer;
        if (s) out[ytmText(s.title)] = ((s.subtitle && s.subtitle.runs) || []).map(r => r.text.trim()).filter(Boolean);
    });
    return out;
}
// The album's label (#649). The album page names none; every song's credits end with "Music
// metadata provided by", whoever delivered the metadata — the label, sometimes a distributor or
// a combined "Darkroom/Interscope Records", like other platforms' ℗ lines. Read for the matched
// album only, from its first song: the album page's, else the album playlist's, which lists the
// songs where the album page links videos. One or two requests; the row's cache keeps the label.
async function ytmAlbumLabel(meta, label = 'YouTube Music') {
    if (!meta) return null;
    let ids = meta.songIds || [];
    const list = (String(meta.url).match(/[?&]list=(OLAK5uy_[\w-]+)/) || [])[1];
    if (!ids.length && list) {
        appendLog(label, `Label: the album page links no song (only videos) — reading its playlist ${list}`);
        ids = ytmSongIds(await ytmCall('browse', { browseId: 'VL' + list }, label));
    }
    if (!ids.length) { appendLog(label, `Label: no song to read the credits of`, 'warn'); return null; }
    for (const id of ids.slice(0, 2)) {
        const j = await ytmCall('browse', { browseId: 'MPTC' + id }, label);
        if (!j) return null;
        const sec = ytmCreditSections(j);
        const names = sec['Music metadata provided by'];
        appendLog(label, `Label: credits of ${id} have ${Object.keys(sec).map(k => `"${k}" (${sec[k].length})`).join(', ') || 'no sections'} → ${names && names.length ? '"' + names.join(' / ') + '"' : 'none'}`, names && names.length ? 'ok' : 'warn');
        if (names && names.length) return names.join(' / ');
    }
    return null;
}
// The row's tooltip names the album's other versions (#639); the ✓ stays — Platform Check finds
// the same or a close release, and you decide (majkinetor). Kept in the cache, so a cached row says it too.
function ytmNoteOtherVersions(v, label = 'YouTube Music') {
    if (!v || !v.length) return;
    const names = v.map(x => `"${x.title}"${x.sub ? ' (' + x.sub + ')' : ''}`).join('; ');
    appendLog(label, `The album has ${v.length} other version(s) on YouTube Music: ${names} — check the match is the right one`, 'warn');
    const a = document.getElementById('mb-online-ytmusic');
    if (a && a.href && /music\.youtube\.com/.test(a.href)) a.title = (a.title ? a.title + '\n' : '') + `Also on YouTube Music as ${v.length} other version(s): ${names}. They can share title and tracks — check it's this one.`;
}
// The album behind a YouTube Music link: …/browse/MPREb_… directly, …/playlist?list=OLAK5uy_…
// through the playlist's page, which names its album.
async function ytmAlbumIdOf(url, label = 'YouTube Music') {
    const b = String(url).match(/music\.youtube\.com\/browse\/(MPREb_[\w-]+)/i);
    if (b) return b[1];
    const l = String(url).match(/[?&]list=(OLAK5uy_[\w-]+)/);
    if (!l) return null;
    const j = await ytmCall('browse', { browseId: 'VL' + l[1] }, label);
    const id = j && (JSON.stringify(j).match(/"(MPREb_[\w-]+)"/) || [])[1];
    if (j && !id) appendLog(label, `playlist ${l[1]}: its page names no album`, 'warn');
    return id || null;
}

async function scanYtmusic({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'YouTube Music';
    const cached = cacheGet(mbid, 'ytmusic');
    if (cached?.url && (!existingUrl || pcSameUrl(existingUrl, cached.url))) { applyCachedRow('ytmusic', label, cached, mbTracks); ytmNoteOtherVersions(cached.otherVersions, label); return; }
    if (cached && !cached.url && !existingUrl) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('ytmusic', label, cached, mbTracks); return; }
    const none = source => { cacheSet(mbid, 'ytmusic', { url: null, tracks: null, year: null, label: null, source }); updateRow('ytmusic', { url: null, mbTracks, remoteTracks: null }); };

    if (existingUrl) {
        appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok');
        const id = await ytmAlbumIdOf(existingUrl, label);
        const meta = id ? await fetchYtmAlbum(id, label) : null;
        if (meta) appendLog(label, `Album parsed: tracks=${meta.tracks ?? '?'} title="${meta.title}" artist="${meta.artist || '?'}" year=${meta.year || '?'}`, meta.tracks ? 'ok' : 'warn');
        else appendLog(label, `Couldn't read the linked album — shown unverified`, 'warn');
        const lbl = await ytmAlbumLabel(meta, label);
        cacheSet(mbid, 'ytmusic', { url: existingUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: lbl, source: 'MB rels', otherVersions: meta?.otherVersions || [] });
        updateRow('ytmusic', { url: existingUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: lbl, source: 'MB rels' });
        ytmNoteOtherVersions(meta?.otherVersions, label);
        return;
    }

    // Candidates are checked in order, each by its album page, until one scores as a match.
    // Up to 3 per search: the right album is nearly always first (#639), and each costs a request.
    const tried = new Set();
    const verify = async (cands, how) => {
        let best = null;
        for (const c of cands.filter(c => !tried.has(c.id)).slice(0, 3)) {
            tried.add(c.id);
            // a clearly different title and artist aren't worth a page fetch
            if (scoreCandidate({ tracks: null, title: c.title, artist: c.artist }, mbTracks, album, artist, isVariousArtists) < 0) { appendLog(label, `  skip "${c.title}" by ${c.artist || '?'} (${c.kind}) — title and artist don't match`); continue; }
            const meta = await fetchYtmAlbum(c.id, label);
            const sc = scoreCandidate(meta, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand (${how}) score=${sc}  tracks=${meta?.tracks ?? '?'}  artist="${meta?.artist || '?'}"  title="${meta?.title || '?'}"  ${meta?.kind || ''}  url=${meta?.url || c.id}`);
            if (meta && (!best || sc > best.score)) best = { score: sc, meta };
            if (sc >= 150) break;
        }
        return best && best.score >= 120 ? best : null;
    };

    let pick = null, source = null;
    if (barcode) {
        const found = await upcTry(barcode, async u => {
            const res = ytmAlbumResults(await ytmCall('search', { query: u, params: YTM_ALBUMS_FILTER }, label));
            appendLog(label, `Barcode ${u}: ${res.length} album(s)${res.length ? ' — ' + res.slice(0, 3).map(a => `"${a.title}" by ${a.artist}`).join(', ') : ''}`);
            return res.length ? res : null;
        });
        pick = found ? await verify(found, 'barcode') : null;
        if (pick) source = 'barcode search';
        else appendLog(label, `Barcode ${barcode}: ${found ? 'no album found for it matches the release' : 'no album'} — falling back to search`);
    }
    if (!pick) {
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const res = ytmAlbumResults(await ytmCall('search', { query: q, params: YTM_ALBUMS_FILTER }, label));
        appendLog(label, `Search "${q}": ${res.length} album(s)`);
        pick = res.length ? await verify(res, 'search') : null;
        if (pick) source = 'search';
    }
    if (!pick) { appendLog(label, `No verifiable match — leaving URL unset`, 'warn'); none('search'); return; }

    const { meta } = pick;
    // No barcode is claimed, not even for a barcode search's hit with the same songs and title:
    // YouTube Music groups editions ("Other versions"), and a barcode that belongs to one of them
    // brings up the group's primary album, whose barcode differs (rinsuki, #639). Nothing on the
    // page tells them apart, so strict barcode mode withholds YouTube Music like any platform
    // whose barcode can't be read.
    appendLog(label, `Picked (score=${pick.score}, ${source}): ${meta.url}`, pick.score >= 150 ? 'ok' : 'warn');
    const lbl = await ytmAlbumLabel(meta, label);
    cacheSet(mbid, 'ytmusic', { url: meta.url, tracks: meta.tracks, year: meta.year, label: lbl, source, otherVersions: meta.otherVersions });
    updateRow('ytmusic', { url: meta.url, mbTracks, remoteTracks: meta.tracks, year: meta.year, label: lbl, source });
    ytmNoteOtherVersions(meta.otherVersions, label);
}

// ─── Amazon Music (#644) ────────────────────────────────────────────────────
// Read through the API Amazon Music's own web player uses (na.mesk.skill.music.a2z.com),
// which answers a guest: music.amazon.com/config.json hands out a session (CSRF token,
// device and session id, no login), and each request carries it as a JSON "headers" string
// in its body. Amazon Music has no barcode search and shows no barcode or ISRC, so the row
// is found by name only — artist + album, every hit checked on its album page (song count,
// title, artist; the release year breaks a tie between editions) — and never claims the
// barcode: strict barcode mode withholds it. The guest session is amazon.com's catalogue
// (US). It is an internal API: when it changes, the log says so and the row isn't found.
const AMZ_API = 'https://na.mesk.skill.music.a2z.com/api/';
let _amzSession = null;
function amzSession(label = 'Amazon Music') {
    if (!_amzSession) _amzSession = (async () => {
        const r = await gmPost('https://music.amazon.com/config.json', '', { anonymous: true });
        let j = null; try { j = JSON.parse(r.responseText); } catch {}
        if (!r.ok || !j || !j.csrf || !j.deviceId) {
            appendLog(label, `config.json: HTTP ${r.status}${r.error ? ' (' + r.error + ')' : ''} in ${r.ms}ms — no guest session; Amazon Music's player may have changed`, 'error');
            return null;
        }
        appendLog(label, `guest session in ${r.ms}ms (marketplace ${j.marketplaceId || '?'}, player ${j.version || '?'})`);
        return j;
    })().then(s => { if (!s) _amzSession = null; return s; });   // a failed session is asked for again next time
    return _amzSession;
}
async function amzCall(endpoint, body, label = 'Amazon Music') {
    const s = await amzSession(label);
    if (!s) return null;
    const headers = JSON.stringify({
        'x-amzn-authentication': JSON.stringify({ interface: 'ClientAuthenticationInterface.v1_0.ClientTokenElement', accessToken: s.accessToken || '' }),
        'x-amzn-device-model': 'WEBPLAYER', 'x-amzn-device-width': '1920', 'x-amzn-device-family': 'WebPlayer', 'x-amzn-device-id': s.deviceId,
        'x-amzn-user-agent': navigator.userAgent, 'x-amzn-session-id': s.sessionId, 'x-amzn-device-height': '1080',
        'x-amzn-request-id': (crypto.randomUUID ? crypto.randomUUID() : String(Math.random()).slice(2)), 'x-amzn-device-language': 'en_US',
        'x-amzn-currency-of-preference': 'USD', 'x-amzn-os-version': '1.0', 'x-amzn-application-version': s.version,
        'x-amzn-device-time-zone': 'UTC', 'x-amzn-timestamp': String(Date.now()),
        'x-amzn-csrf': JSON.stringify({ interface: 'CSRFInterface.v1_0.CSRFHeaderElement', token: s.csrf.token, timestamp: s.csrf.ts, rndNonce: s.csrf.rnd }),
        'x-amzn-music-domain': 'music.amazon.com', 'x-amzn-referer': '', 'x-amzn-affiliate-tags': '', 'x-amzn-ref-marker': '', 'x-amzn-page-url': 'https://music.amazon.com/',
        'x-amzn-weblab-id-overrides': '', 'x-amzn-video-player-token': '', 'x-amzn-feature-flags': '', 'x-amzn-has-profile-id': '', 'x-amzn-age-band': '',
    });
    const r = await gmPost(AMZ_API + endpoint, JSON.stringify({ ...body, headers }), { headers: { 'Content-Type': 'text/plain;charset=UTF-8' }, anonymous: true });
    let j = null; try { j = JSON.parse(r.responseText); } catch {}
    const tpl = j && j.methods && (j.methods.find(m => m.template) || {}).template;
    const what = body.id || body.suggestedKeyword;
    if (!r.ok || !tpl) appendLog(label, `${endpoint} ${JSON.stringify(what)}: HTTP ${r.status}${r.error ? ' (' + r.error + ')' : ''}${r.ok && !tpl ? ', no page in the answer' : ''} in ${r.ms}ms — Amazon Music's API may have changed`, 'error');
    else appendLog(label, `${endpoint} ${JSON.stringify(what)}: ${r.responseText.length}b in ${r.ms}ms`);
    return tpl || null;
}
const amzText = t => (t && typeof t === 'object' ? t.text : t) || '';
// The albums a search returned, in order: { id: 'B00CRMWMZ0', title, artist, year } — from its
// "Top Results" and "Albums" shelves (a song's link carries ?trackAsin= and is left out).
function amzAlbumResults(tpl) {
    const out = [];
    for (const w of (tpl && tpl.widgets) || []) for (const it of w.items || []) {
        const m = String((it.primaryLink && it.primaryLink.deeplink) || '').match(/^\/albums\/([A-Z0-9]{10})$/);
        if (!m || out.some(x => x.id === m[1])) continue;
        out.push({ id: m[1], title: amzText(it.primaryText), artist: amzText(it.secondaryText), year: /^\d{4}$/.test(amzText(it.tertiaryText)) ? amzText(it.tertiaryText) : null });
    }
    return out;
}
// An album page: its link, song count, title, artist, year and kind ("Album", "EP", …). The header
// reads "13 SONGS • 1 HOUR AND 14 MINUTES • MAY 17 2013"; without it, the tracklist's length.
async function fetchAmzAlbum(id, label = 'Amazon Music') {
    const tpl = await amzCall('showCatalogAlbum', { id, userHash: JSON.stringify({ level: 'LIBRARY_MEMBER' }) }, label);
    if (!tpl) return null;
    const title = amzText(tpl.headerText);
    if (!title) { appendLog(label, `album ${id}: no album header in the answer — Amazon Music's page may have changed`, 'error'); return null; }
    const sub = String(tpl.headerTertiaryText || '').split(/\s*•\s*/);
    const m = (sub[0] || '').match(/^([\d,.]+)\s+(?:song|track)s?\b/i);
    const rows = ((tpl.widgets || []).find(w => (w.items || []).some(it => /trackAsin=/.test((it.primaryLink && it.primaryLink.deeplink) || ''))) || {}).items || [];
    const date = sub.find(x => /\b\d{4}$/.test(x)) || '';
    return {
        url: `https://music.amazon.com/albums/${id}`, id,
        tracks: m ? parseInt(m[1].replace(/\D/g, ''), 10) : (rows.length || null),
        title, artist: amzText(tpl.headerPrimaryText) || null, year: (date.match(/(\d{4})$/) || [])[1] || null,
        kind: amzText(tpl.headerLabel) || null, date: date || null,
        label: stripCopyright(String(tpl.footer || '')) || null,   // the page's ℗ line: "(P) 2013 Daft Life Limited under exclusive license to Columbia Records…"
    };
}
async function scanAmazon({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, mbYear }) {
    const label = 'Amazon Music';
    const cached = cacheGet(mbid, 'amazonmusic');
    if (cached?.url && (!existingUrl || pcSameUrl(existingUrl, cached.url))) { applyCachedRow('amazonmusic', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('amazonmusic', label, cached, mbTracks); return; }
    const none = source => { cacheSet(mbid, 'amazonmusic', { url: null, tracks: null, year: null, label: null, source }); updateRow('amazonmusic', { url: null, mbTracks, remoteTracks: null }); };

    if (existingUrl) {
        appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok');
        const id = (String(existingUrl).match(/\/albums\/([A-Z0-9]{10})/i) || [])[1];
        const meta = id ? await fetchAmzAlbum(id.toUpperCase(), label) : null;
        if (meta) appendLog(label, `Album parsed: tracks=${meta.tracks ?? '?'} title="${meta.title}" artist="${meta.artist || '?'}" date=${meta.date || '?'} label="${meta.label || '?'}"`, meta.tracks ? 'ok' : 'warn');
        else appendLog(label, `Couldn't read the linked album — shown unverified`, 'warn');
        cacheSet(mbid, 'amazonmusic', { url: existingUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'MB rels' });
        updateRow('amazonmusic', { url: existingUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'MB rels' });
        return;
    }

    // Candidates are checked in order, each by its album page, up to 3. Editions often share
    // title and song count (Random Access Memories has two of 13 songs); the one from the
    // release's year is preferred, so a match from another year doesn't stop the search.
    const q = isVariousArtists ? album : `${artist} ${album}`;
    const res = amzAlbumResults(await amzCall('showSearch', {
        filter: JSON.stringify({ IsLibrary: ['false'] }),
        keyword: JSON.stringify({ interface: 'Web.TemplatesInterface.v1_0.Touch.SearchTemplateInterface.SearchKeywordClientInformation', keyword: q }),
        suggestedKeyword: q, userHash: JSON.stringify({ level: 'LIBRARY_MEMBER' }),
    }, label));
    appendLog(label, `Search "${q}": ${res.length} album(s)${res.length ? ' — ' + res.slice(0, 4).map(a => `"${a.title}" by ${a.artist}${a.year ? ' (' + a.year + ')' : ''}`).join(', ') : ''}`);
    let best = null, checked = 0;
    for (const c of res) {
        if (checked >= 3) break;
        // a clearly different title and artist aren't worth a page fetch
        if (scoreCandidate({ tracks: null, title: c.title, artist: c.artist }, mbTracks, album, artist, isVariousArtists) < 0) { appendLog(label, `  skip "${c.title}" by ${c.artist || '?'} — title and artist don't match`); continue; }
        checked++;
        const meta = await fetchAmzAlbum(c.id, label);
        const sc = scoreCandidate(meta, mbTracks, album, artist, isVariousArtists);
        const sameYear = !!(meta && mbYear && meta.year === String(mbYear));
        appendLog(label, `  cand score=${sc}${sameYear ? ' +year' : ''}  tracks=${meta?.tracks ?? '?'}  artist="${meta?.artist || '?'}"  title="${meta?.title || '?'}"  ${meta?.kind || ''} ${meta?.date || ''}  url=${meta?.url || c.id}`);
        // found by name only, so the title and the song count must both match: the same artist and song count alone can be
        // another album (Philip Cohran's self-titled 6 songs vs Amazon's "The Zulu 45s Collection", 6 songs)
        if (meta && !titleSimilar(meta.title || '', album)) { appendLog(label, `  not taken: the title differs from "${album}"`); continue; }
        if (meta && meta.tracks !== mbTracks) { appendLog(label, `  not taken: ${meta.tracks ?? '?'} songs, the release has ${mbTracks}`); continue; }
        const rank = sc + (sameYear ? 10 : 0);
        if (meta && (!best || rank > best.rank)) best = { score: sc, rank, meta };
        if (sc >= 150 && (sameYear || !mbYear)) break;
    }
    if (!best || best.score < 120) { appendLog(label, `No verifiable match — leaving URL unset`, 'warn'); none('search'); return; }
    const { meta } = best;
    // found by name: no barcode is claimed (Amazon Music shows none), so strict barcode mode withholds it
    appendLog(label, `Picked (score=${best.score}, search): ${meta.url}`, best.score >= 150 ? 'ok' : 'warn');
    cacheSet(mbid, 'amazonmusic', { url: meta.url, tracks: meta.tracks, year: meta.year, label: meta.label, source: 'search' });
    updateRow('amazonmusic', { url: meta.url, mbTracks, remoteTracks: meta.tracks, year: meta.year, label: meta.label, source: 'search' });
}

// ─── Deezer ─────────────────────────────────────────────────────────────────
// Deezer's public API (api.deezer.com) is unauthenticated and structured —
// search returns album id + title + artist + nb_tracks; detail adds release_date
// + label. No CAPTCHA, no anti-bot, ~50 req / 5 sec / IP. Use it for both
// the search step and the detail step; no need for any HTML scraping.
async function fetchDeezerMeta(albumUrl) {
    const m = albumUrl.match(/deezer\.com\/(?:[a-z]+\/)?album\/(\d+)/i);
    if (!m) return null;
    const r = await gmGet(`https://api.deezer.com/album/${m[1]}`);
    if (!r.ok) return null;
    try {
        const d = JSON.parse(r.responseText);
        return {
            tracks: d.nb_tracks ?? null,
            title:  d.title || null,
            year:   d.release_date ? d.release_date.slice(0, 4) : null,
            label:  d.label || null,
            artist: d.artist?.name || null,
            barcode: d.upc || null,
        };
    } catch { return null; }
}

async function scanDeezer({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'Deezer';

    const cached = cacheGet(mbid, 'deezer');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        applyCachedRow('deezer', label, cached, mbTracks);
        return;
    }
    if (cached && !cached.url && !existingUrl && !barcode) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('deezer', label, cached, mbTracks);
        return;
    }

    // Barcode-first: Deezer's `album/upc:<UPC>`. NOTE it is NOT reliably exact — for a
    // barcode it doesn't have, Deezer sometimes returns an UNRELATED album instead of an
    // error (e.g. upc:827565029525 → "Ayamma", whose real UPC is 885686990360). So trust
    // the hit only when the returned album's OWN upc matches what we asked for; otherwise
    // treat it as no barcode match and fall through to the artist+album search.
    if (!existingUrl && barcode) {
        // #354: try the raw barcode first, then the other GTIN paddings on a miss. Each
        // hit is accepted only when the returned album's OWN upc matches (Deezer's
        // album/upc: can hand back an unrelated album for a barcode it lacks — #356).
        const bd = await upcTry(barcode, async (u) => {
            const br = await gmGet(`https://api.deezer.com/album/upc:${u}`);
            let d = null; try { d = JSON.parse(br.responseText); } catch {}
            if (!(d && d.id && !d.error)) return null;
            if (normBarcode(d.upc) === normBarcode(barcode)) return d;
            appendLog(label, `Barcode ${u}: Deezer returned a different-barcode album (upc ${d.upc || '?'}, "${d.title || ''}") — ignoring`, 'warn');
            return null;
        });
        if (bd) {
            const albumUrl = bd.link || `https://www.deezer.com/album/${bd.id}`;
            appendLog(label, `Barcode ${barcode} → ${albumUrl}`, 'ok');
            const meta = await fetchDeezerMeta(albumUrl);
            const bc = bd.upc || meta?.barcode || barcode;
            cacheSet(mbid, 'deezer', { url: albumUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode', barcode: bc });
            updateRow('deezer', { url: albumUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode', barcode: bc });
            return;
        }
        appendLog(label, `Barcode ${barcode}: no UPC match — falling back to search`);
    }

    let albumUrl = existingUrl;
    let source   = null;

    if (albumUrl) {
        appendLog(label, `Using existing MB URL: ${albumUrl}`, 'ok');
        source = 'MB rels';
    } else {
        // Deezer search-query syntax supports field-prefix matching, so we can
        // narrow exactly to artist + album. VA compilations: query by album only
        // (Deezer credits compilations to the label/aggregator, not to a
        // literal "Various Artists" string).
        const q = isVariousArtists ? `album:"${album}"` : `artist:"${artist}" album:"${album}"`;
        const searchUrl = `https://api.deezer.com/search/album?q=${encodeURIComponent(q)}&limit=10`;
        appendLog(label, `API search: ${searchUrl}`);
        const sr = await gmGet(searchUrl);
        appendLog(label, `API search: status=${sr.status} ${sr.responseText.length}b in ${sr.ms}ms`);
        if (!sr.ok) {
            appendLog(label, `API search failed`, 'error');
            cacheSet(mbid, 'deezer', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('deezer', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        let results = [];
        try {
            const data = JSON.parse(sr.responseText);
            results = data.data || [];
        } catch (e) {
            appendLog(label, `API JSON parse error: ${e.message}`, 'error');
            updateRow('deezer', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        appendLog(label, `API search: ${results.length} candidate(s)`);
        if (!results.length) {
            cacheSet(mbid, 'deezer', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('deezer', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        // Search results already carry nb_tracks + title + artist so no
        // per-candidate detail fetch needed at this stage.
        let best = null;
        for (const it of results) {
            const sc = scoreCandidate({ tracks: it.nb_tracks, title: it.title, artist: it.artist?.name }, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand score=${sc}  tracks=${it.nb_tracks ?? '?'}  artist="${it.artist?.name || '?'}"  title="${it.title}"  url=${it.link}`);
            if (!best || sc > best.score) best = { score: sc, item: it };
            if (sc >= 150) break;
        }
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'deezer', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('deezer', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        albumUrl = best.item.link;
        source = 'API search';
        appendLog(label, `Picked best (score=${best.score}): ${albumUrl}`, best.score >= 150 ? 'ok' : 'warn');
    }

    const meta = await fetchDeezerMeta(albumUrl);
    if (meta) {
        appendLog(label, `Album parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'}`, meta.tracks ? 'ok' : 'warn');
    } else {
        appendLog(label, `Detail fetch failed`, 'error');
    }
    const tracks = meta?.tracks ?? null;
    const year   = meta?.year   ?? null;
    const lbl    = meta?.label  ?? null;
    cacheSet(mbid, 'deezer', { url: albumUrl, tracks, year, label: lbl, source, barcode: meta?.barcode ?? null });
    updateRow('deezer', { url: albumUrl, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: meta?.barcode ?? null });
}

// ─── Apple Music ────────────────────────────────────────────────────────────
// iTunes Search API (itunes.apple.com/{search,lookup}) is unauthenticated and
// returns structured JSON — same shape as Deezer. trackCount, releaseDate, and
// `copyright` (label name on most releases) are exposed directly. URL field is
// `collectionViewUrl` which points at music.apple.com/<country>/album/<slug>/<id>.
async function fetchAppleMeta(albumUrl) {
    const m = albumUrl.match(/\/album\/(?:[^/]+\/)?(\d+)/);
    if (!m) return null;
    const r = await gmGet(`https://itunes.apple.com/lookup?id=${m[1]}&entity=album`);
    if (!r.ok) return null;
    try {
        const d = JSON.parse(r.responseText);
        const a = d.results?.[0];
        if (!a) return null;
        return {
            tracks: a.trackCount ?? null,
            title:  a.collectionName || null,
            year:   a.releaseDate ? a.releaseDate.slice(0, 4) : null,
            label:  stripCopyright(a.copyright),
            artist: a.artistName || null,
        };
    } catch { return null; }
}

// #627: Apple Music's own catalogue (amp-api.music.apple.com), read anonymously with the
// bearer token the web player's public JS bundle carries — the token ISRC Scout and Credit
// Hoarder use, shared through one cache. Unlike the iTunes Search API below it returns each
// album's UPC, so a barcode lookup takes the album whose UPC it is (iTunes put a different
// album first for 808391067776, Harmony #196), and Apple links can pass strict barcode mode.
// Its track count is songs only: amp's own trackCount also counts music videos, and iTunes'
// counted digital booklets (Harmony #192). The iTunes API stays, as the fallback when the
// token or amp-api fails.
const APPLE_AMP_V1 = 'https://amp-api.music.apple.com/v1';
const APPLE_TOKEN_KEY = 'mbtools:apple-token';   // shared with ISRC Scout and Credit Hoarder
let _appleTok = null, _appleTokP = null;
// one fetch at a time: the storefronts are read in parallel, and each would otherwise fetch its own
function appleToken(fresh) {
    if (_appleTok && !fresh) return Promise.resolve(_appleTok);
    if (!_appleTokP) _appleTokP = appleTokenFetch(fresh).finally(() => { _appleTokP = null; });
    return _appleTokP;
}
async function appleTokenFetch(fresh) {
    if (_appleTok && !fresh) return _appleTok;
    if (!fresh) {
        try { const c = JSON.parse(localStorage.getItem(APPLE_TOKEN_KEY) || 'null'); if (c && c.t && c.at && Date.now() - c.at < 12 * 3600e3) return (_appleTok = c.t); } catch (e) {}
    }
    appendLog('Apple', 'amp-api: fetching the web player\'s token');
    const home = await gmGet('https://music.apple.com/us/browse', { headers: { Accept: 'text/html' } });
    const asset = (home.responseText.match(/\/assets\/index-legacy~[a-z0-9]+\.js/i) || home.responseText.match(/\/assets\/index~[a-z0-9]+\.js/i) || [])[0];
    if (!asset) throw new Error('the web player\'s JS was not found');
    const js = await gmGet('https://music.apple.com' + asset);
    const tok = (js.responseText.match(/eyJ[A-Za-z0-9._-]{80,}/) || [])[0];
    if (!tok) throw new Error('no token in the web player\'s JS');
    try { localStorage.setItem(APPLE_TOKEN_KEY, JSON.stringify({ t: tok, at: Date.now() })); } catch (e) {}
    return (_appleTok = tok);
}
// One amp-api read: its JSON, or throws (the caller falls back to iTunes). A 401 is a rotated
// token: a new one is fetched, once.
const appleAmp = path => appleAmpV1('catalog/' + path);
async function appleAmpV1(path) {
    for (let attempt = 0; attempt < 2; attempt++) {
        const tok = await appleToken(attempt > 0);
        const r = await gmGet(`${APPLE_AMP_V1}/${path}${path.includes('?') ? '&' : '?'}l=en-US`, { headers: { Authorization: 'Bearer ' + tok, Origin: 'https://music.apple.com', Accept: 'application/json' } });
        if (r.status === 401 && attempt === 0) { appendLog('Apple', 'amp-api: the token was refused (401) — fetching a new one', 'warn'); continue; }
        if (r.status === 404) return { data: [] };
        if (!r.ok) throw new Error(`amp-api HTTP ${r.status || r.error || '?'}`);
        return JSON.parse(r.responseText);
    }
    throw new Error('amp-api refused a fresh token');
}
// the album whose UPC it is — amp-api lists others first too (808391067776: the single 808391068360 comes first)
const applePickByUpc = (items, upc) => (items || []).find(a => normBarcode(a.attributes?.upc) === normBarcode(upc)) || null;
const appleStorefront = url => ((String(url || '').match(/music\.apple\.com\/([a-z]{2})\//i) || [])[1] || 'us').toLowerCase();
// Apple's catalogue is per storefront: an album is only in the ones it is licensed to (majkinetor,
// #627: "better to find any release in any store than no release in particular store"). The short
// list is read first, all at once: eight storefronts in parallel answered in 83 ms. Only when it has
// nothing is every storefront read, again all at once: 172 in about a second. (Apple's own site
// checks a release's availability one storefront at a time, about a second each.)
const APPLE_SHORTLIST = ['us', 'gb', 'de', 'fr', 'jp', 'br', 'au'];
async function appleAllStorefronts() {
    try { const c = JSON.parse(localStorage.getItem('pc:apple-storefronts') || 'null'); if (c && c.ids && c.ids.length && Date.now() - c.at < 7 * 864e5) return c.ids; } catch (e) {}
    const ids = [];
    for (let next = 'storefronts?limit=200'; next;) {
        const j = await appleAmpV1(next);
        (j.data || []).forEach(s => ids.push(s.id));
        next = j.next ? String(j.next).replace(/^\/v1\//, '') : null;
    }
    try { localStorage.setItem('pc:apple-storefronts', JSON.stringify({ ids, at: Date.now() })); } catch (e) {}
    appendLog('Apple', `amp-api: ${ids.length} storefronts`);
    return ids;
}
// One catalogue read in several storefronts at once: [{ sf, j }] for each that answered. Throws when
// none did (the caller falls back to iTunes); a few that fail are only logged.
async function appleEach(sfs, path) {
    await appleToken();   // once, before the parallel reads
    const res = await Promise.all(sfs.map(s => appleAmp(`${s}/${path}`).then(j => ({ sf: s, j }), e => ({ sf: s, err: e.message }))));
    const ok = res.filter(r => r.j), bad = res.filter(r => !r.j);
    if (!ok.length) throw new Error(bad.length ? bad[0].err : 'no storefront to ask');
    if (bad.length) appendLog('Apple', `amp-api: ${bad.length} of ${res.length} storefront(s) didn't answer (${bad.slice(0, 5).map(b => b.sf).join(', ')}${bad.length > 5 ? '…' : ''})`, 'warn');
    return ok;
}
// An amp-api album → what the row shows. Songs only: the videos are in trackCount too.
function appleAlbumMeta(a) {
    const at = (a && a.attributes) || {}, rel = a && a.relationships && a.relationships.tracks;
    const list = rel && !rel.next && Array.isArray(rel.data) ? rel.data : null;   // a paged list isn't all of it
    const songs = list ? list.filter(t => t.type === 'songs').length : null;
    return {
        url: String(at.url || '').split('?')[0], title: at.name || null, artist: at.artistName || null,
        tracks: songs ?? at.trackCount ?? null,
        tracksNote: songs == null ? 'its trackCount, which may include videos' : list.length > songs ? `${list.length - songs} video(s) left out` : 'songs',
        year: at.releaseDate ? at.releaseDate.slice(0, 4) : null, label: at.recordLabel || null, barcode: at.upc || null,
    };
}
async function scanApple(args) {
    const { mbTracks, existingUrl, mbid, barcode } = args;
    const label = 'Apple';
    const cached = cacheGet(mbid, 'apple');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        applyCachedRow('apple', label, cached, mbTracks);
        return;
    }
    if (cached && !cached.url && !existingUrl && !barcode) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('apple', label, cached, mbTracks);
        return;
    }
    try { if (await scanAppleAmp(args)) return; }
    catch (e) { appendLog(label, `amp-api unavailable (${e.message}) — falling back to the iTunes API`, 'warn'); }
    return scanAppleItunes(args);
}
// true once it has set the row
async function scanAppleAmp({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, wikidataAppleId, barcode }) {
    const label = 'Apple', sf = appleStorefront(existingUrl);
    const done = (meta, source) => {
        appendLog(label, `Album: "${meta.title}" — ${meta.tracks ?? '?'} track(s) (${meta.tracksNote}), ${meta.year || '?'}, ${meta.label || '?'}, UPC ${meta.barcode || '?'}`, meta.tracks ? 'ok' : 'warn');
        cacheSet(mbid, 'apple', { url: meta.url, tracks: meta.tracks, year: meta.year, label: meta.label, source, barcode: meta.barcode });
        updateRow('apple', { url: meta.url, mbTracks, remoteTracks: meta.tracks, year: meta.year, label: meta.label, source, barcode: meta.barcode });
        return true;
    };
    const none = source => {
        cacheSet(mbid, 'apple', { url: null, tracks: null, year: null, label: null, source });
        updateRow('apple', { url: null, mbTracks, remoteTracks: null });
        return true;
    };

    const shortSfs = [...new Set([sf, ...APPLE_SHORTLIST])];
    // the rest of the storefronts, for a second round when the short list had nothing
    const otherSfs = async () => (await appleAllStorefronts()).filter(s => !shortSfs.includes(s));

    // Barcode first: the album whose UPC it is, not the first one Apple lists. Every zero-padding
    // of the barcode goes in the one request per storefront (filter[upc] takes a list).
    if (!existingUrl && !wikidataAppleId && barcode) {
        const forms = gtinVariants(barcode);
        const upcIn = async sfs => {
            const got = await appleEach(sfs, `albums?filter[upc]=${forms.map(encodeURIComponent).join(',')}`);
            const seen = new Set();
            for (const { sf: s, j } of got) for (const a of (j.data || [])) {
                if (seen.has(a.id)) continue;
                seen.add(a.id);
                appendLog(label, `  UPC ${forms.join('/')} in "${s}": "${a.attributes?.name}" has UPC ${a.attributes?.upc || '?'} — ${a.attributes?.url}`);
            }
            for (const { sf: s, j } of got) for (const u of forms) { const hit = applePickByUpc(j.data, u); if (hit) return { hit, sf: s }; }
            return null;
        };
        let found = await upcIn(shortSfs);
        if (!found) {
            const rest = await otherSfs();
            appendLog(label, `Barcode ${barcode}: no album with that UPC in ${shortSfs.join(', ')} — asking the other ${rest.length} storefronts`);
            found = await upcIn(rest);
        }
        if (found) {
            const meta = appleAlbumMeta(found.hit);
            appendLog(label, `Barcode ${barcode} → ${meta.url} (its UPC, in the "${found.sf}" storefront)`, 'ok');
            return done(meta, 'barcode');
        }
        appendLog(label, `Barcode ${barcode}: no album with that UPC in any storefront — falling back to search`);
    }

    // A link MusicBrainz or Wikidata already has: read the album itself
    let id = null, source = null;
    if (existingUrl) { id = (existingUrl.match(/\/album\/(?:[^/?#]+\/)?(?:id)?(\d+)/) || [])[1] || null; source = 'MB rels'; appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok'); }
    else if (wikidataAppleId) { id = String(wikidataAppleId); source = 'Wikidata'; appendLog(label, `Wikidata answer: album ${id}`, 'ok'); }
    if (id) {
        const a = ((await appleAmp(`${sf}/albums/${id}`)).data || [])[0];
        const url = existingUrl ? existingUrl.split('?')[0] : `https://music.apple.com/${sf}/album/${id}`;
        if (!a) {
            appendLog(label, `amp-api: album ${id} is not in the "${sf}" storefront — keeping the link, details unknown`, 'warn');
            cacheSet(mbid, 'apple', { url, tracks: null, year: null, label: null, source });
            updateRow('apple', { url, mbTracks, remoteTracks: null, source });
            return true;
        }
        const meta = appleAlbumMeta(a);
        meta.url = url;
        return done(meta, source);
    }

    // Search. VA compilations: the album title alone (Apple doesn't credit a literal "Various Artists").
    const term = isVariousArtists ? album : `${artist} ${album}`;
    // every storefront's candidates, pooled: one album is one candidate, from the first storefront that has it
    const searchIn = async sfs => {
        const got = await appleEach(sfs, `search?term=${encodeURIComponent(term)}&types=albums&limit=10`);
        const byId = new Map();
        for (const { sf: s, j } of got) for (const a of ((j.results && j.results.albums && j.results.albums.data) || [])) if (!byId.has(a.id)) byId.set(a.id, { a, sf: s });
        return [...byId.values()];
    };
    let pool = await searchIn(shortSfs);
    appendLog(label, `amp-api search "${term}" in ${shortSfs.join(', ')}: ${pool.length} candidate(s)`);
    if (!pool.length) {
        const rest = await otherSfs();
        pool = await searchIn(rest);
        appendLog(label, `amp-api search "${term}" in the other ${rest.length} storefronts: ${pool.length} candidate(s)${pool.length ? ' (' + [...new Set(pool.map(p => p.sf))].slice(0, 8).join(', ') + ')' : ''}`);
    }
    if (!pool.length) return none('API search');
    const results = pool.map(p => Object.assign(p.a, { _sf: p.sf }));
    let best = null;
    for (const a of results) {
        const at = a.attributes || {};
        // a candidate carrying the release's own barcode is the answer, whatever its score
        const upcHit = !!(barcode && at.upc && normBarcode(at.upc) === normBarcode(barcode));
        const sc = upcHit ? 1000 : scoreCandidate({ tracks: at.trackCount, title: at.name, artist: at.artistName }, mbTracks, album, artist, isVariousArtists);
        appendLog(label, `  cand ${upcHit ? 'UPC match' : 'score=' + sc}  tracks=${at.trackCount ?? '?'}  artist="${at.artistName || '?'}"  title="${at.name}"  upc=${at.upc || '?'}  url=${at.url}`);
        if (!best || sc > best.score) best = { score: sc, a };
        if (upcHit) break;
    }
    if (best.score < 120) {
        appendLog(label, `No verifiable match (best score=${best.score}) — leaving URL unset`, 'warn');
        return none('API search');
    }
    // the album itself, for the songs-only count (a search result has no track list)
    const full = ((await appleAmp(`${best.a._sf || sf}/albums/${best.a.id}`)).data || [])[0] || best.a;
    const meta = appleAlbumMeta(full);
    appendLog(label, `Picked best (${best.score >= 1000 ? 'UPC match' : 'score=' + best.score}): ${meta.url}`, best.score >= 150 ? 'ok' : 'warn');
    return done(meta, 'API search');
}

// The iTunes Search API: the fallback when amp-api is unavailable (#627).
async function scanAppleItunes({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, wikidataAppleId, barcode }) {
    const label = 'Apple';

    const cached = cacheGet(mbid, 'apple');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) {
        applyCachedRow('apple', label, cached, mbTracks);
        return;
    }
    if (cached && !cached.url && !existingUrl && !barcode) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('apple', label, cached, mbTracks);
        return;
    }

    // Barcode-first: iTunes `lookup?upc=<UPC>` is an exact match. Falls through
    // to the term search (and Wikidata) when there's no UPC hit.
    if (!existingUrl && !wikidataAppleId && barcode) {
        // #354: try the raw barcode first, then the other GTIN paddings on a miss.
        const hit = await upcTry(barcode, async (u) => {
            const br = await gmGet(`https://itunes.apple.com/lookup?upc=${u}&entity=album`);
            let d = null; try { d = JSON.parse(br.responseText); } catch {}
            return (d && (d.results || []).find(r => r.collectionViewUrl)) || null;
        });
        if (hit) {
            const albumUrl = hit.collectionViewUrl.split('?')[0];
            appendLog(label, `Barcode ${barcode} → ${albumUrl}`, 'ok');
            const meta = await fetchAppleMeta(albumUrl);
            cacheSet(mbid, 'apple', { url: albumUrl, tracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode' });
            updateRow('apple', { url: albumUrl, mbTracks, remoteTracks: meta?.tracks ?? null, year: meta?.year ?? null, label: meta?.label ?? null, source: 'barcode' });
            return;
        }
        appendLog(label, `Barcode ${barcode}: no UPC match — falling back to search`);
    }

    let albumUrl = existingUrl;
    let source   = null;

    if (albumUrl) {
        appendLog(label, `Using existing MB URL: ${albumUrl}`, 'ok');
        source = 'MB rels';
    } else if (wikidataAppleId) {
        // P5121 stores the bare numeric Apple Music album ID. Construct the
        // canonical /us/album/<id> URL (no slug needed for resolution).
        albumUrl = `https://music.apple.com/us/album/${wikidataAppleId}`;
        appendLog(label, `Wikidata answer: ${albumUrl}`, 'ok');
        source = 'Wikidata';
    } else {
        // iTunes Search API. VA compilations: query album-only (the API
        // doesn't credit compilations to a literal "Various Artists" string).
        const term = isVariousArtists ? album : `${artist} ${album}`;
        const searchUrl = `https://itunes.apple.com/search?term=${encodeURIComponent(term)}&entity=album&limit=10`;
        appendLog(label, `API search: ${searchUrl}`);
        const sr = await gmGet(searchUrl);
        appendLog(label, `API search: status=${sr.status} ${sr.responseText.length}b in ${sr.ms}ms`);
        let results = [];
        if (sr.ok) {
            try { results = (JSON.parse(sr.responseText).results) || []; }
            catch (e) { appendLog(label, `API JSON parse error: ${e.message}`, 'error'); }
        }
        appendLog(label, `API search: ${results.length} candidate(s)`);
        if (!results.length) {
            cacheSet(mbid, 'apple', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('apple', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        let best = null;
        for (const it of results) {
            const sc = scoreCandidate({ tracks: it.trackCount, title: it.collectionName, artist: it.artistName }, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand score=${sc}  tracks=${it.trackCount ?? '?'}  artist="${it.artistName || '?'}"  title="${it.collectionName}"  url=${it.collectionViewUrl}`);
            if (!best || sc > best.score) best = { score: sc, item: it };
            if (sc >= 150) break;
        }
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'apple', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('apple', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        // Strip the `?uo=4` affiliate tail that iTunes Search returns on
        // collectionViewUrl — MB normalises to the clean form.
        albumUrl = best.item.collectionViewUrl.split('?')[0];
        source = 'API search';
        appendLog(label, `Picked best (score=${best.score}): ${albumUrl}`, best.score >= 150 ? 'ok' : 'warn');
    }

    const meta = await fetchAppleMeta(albumUrl);
    if (meta) {
        appendLog(label, `Album parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'}`, meta.tracks ? 'ok' : 'warn');
    } else {
        appendLog(label, `Detail fetch failed`, 'error');
    }
    const tracks = meta?.tracks ?? null;
    const year   = meta?.year   ?? null;
    const lbl    = meta?.label  ?? null;
    cacheSet(mbid, 'apple', { url: albumUrl, tracks, year, label: lbl, source });
    updateRow('apple', { url: albumUrl, mbTracks, remoteTracks: tracks, year, label: lbl, source });
}

// ─── Tidal ──────────────────────────────────────────────────────────────────
// Official API (JSON:API). All calls need an app token (client-credentials), so
// catalog reads are anonymous to the user. Existing MB URL → Wikidata P4577 →
// searchResults API. Each candidate album carries title + numberOfItems inline,
// so scoring needs no per-candidate fetch (like Deezer); the picked album is
// then fetched once for year/label.
async function fetchTidalAlbumMeta(albumId, token) {
    const r = await gmGet(`${TIDAL.api}/albums/${albumId}?countryCode=${TIDAL.country}`,
        { headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/vnd.api+json' } });
    if (!r.ok) return null;
    try {
        const a = JSON.parse(r.responseText)?.data?.attributes;
        if (!a) return null;
        const lbl = stripCopyright(a.copyright?.text);
        return { tracks: a.numberOfItems ?? null, title: a.title || null, year: a.releaseDate ? a.releaseDate.slice(0, 4) : null, label: lbl, barcode: a.barcodeId || null };
    } catch { return null; }
}
// Barcode-first (#182): Tidal v2 /albums?filter[barcodeId] is an exact match.
async function tidalAlbumByBarcode(barcode, token) {
    const r = await gmGet(`${TIDAL.api}/albums?countryCode=${TIDAL.country}&filter%5BbarcodeId%5D=${encodeURIComponent(barcode)}`,
        { headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/vnd.api+json' } });
    if (!r.ok) return null;
    try { const a = (JSON.parse(r.responseText).data || [])[0]; return a ? { id: a.id, barcode: a.attributes?.barcodeId || barcode } : null; }
    catch { return null; }
}
async function scanTidal({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, wikidataTidalId, barcode }) {
    const label = 'Tidal';
    const cached = cacheGet(mbid, 'tidal');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) { applyCachedRow('tidal', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl && !wikidataTidalId) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('tidal', label, cached, mbTracks); return;
    }

    const idFromUrl = u => (String(u || '').match(/tidal\.com\/(?:browse\/)?album\/(\d+)/) || [])[1];

    let albumId = null, source = null, foundBarcode = null;
    // Barcode-first (#182): an exact-UPC hit beats Wikidata/search (which may
    // point at a different-barcode edition). Only when there's no MB rel.
    if (!existingUrl && barcode) {
        const tok = await tidalToken();
        if (tok) {
            const hit = await tidalAlbumByBarcode(barcode, tok);
            if (hit) { albumId = hit.id; source = 'barcode'; foundBarcode = hit.barcode || barcode; appendLog(label, `Barcode ${barcode} → album ${albumId}`, 'ok'); }
            else appendLog(label, `Barcode ${barcode}: no Tidal UPC match — falling back`);
        }
    }
    if (!albumId && existingUrl) {
        albumId = idFromUrl(existingUrl); source = 'MB rels';
        appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok');
    } else if (!albumId && wikidataTidalId) {
        albumId = wikidataTidalId; source = 'Wikidata';
        appendLog(label, `Wikidata answer: album ${albumId}`, 'ok');
    } else if (!albumId) {
        // Only the SEARCH path needs a token — an existing/Wikidata URL is shown
        // (and circled, for MB rels) even if the token grant fails.
        const token = await tidalToken();
        if (!token) { updateRow('tidal', { url: null, mbTracks, remoteTracks: null }); return; }
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const searchUrl = `${TIDAL.api}/searchResults/${encodeURIComponent(q)}?countryCode=${TIDAL.country}&include=albums`;
        appendLog(label, `API search: ${searchUrl}`);
        const sr = await gmGet(searchUrl, { headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/vnd.api+json' } });
        appendLog(label, `API search: status=${sr.status} ${sr.responseText.length}b in ${sr.ms}ms`);
        if (!sr.ok) { cacheSet(mbid, 'tidal', { url: null, tracks: null, year: null, label: null, source: 'API search' }); updateRow('tidal', { url: null, mbTracks, remoteTracks: null }); return; }
        let albums = [];
        try {
            const data = JSON.parse(sr.responseText);
            const order = (data.data?.relationships?.albums?.data || []).map(d => d.id);
            const byId = {};
            (data.included || []).forEach(x => { if (x.type === 'albums') byId[x.id] = x.attributes || {}; });
            albums = order.map(id => ({ id, attr: byId[id] })).filter(x => x.attr);
        } catch (e) { appendLog(label, `API JSON parse error: ${e.message}`, 'error'); updateRow('tidal', { url: null, mbTracks, remoteTracks: null }); return; }
        appendLog(label, `API search: ${albums.length} candidate(s)`);
        let best = null;
        for (const it of albums) {
            const sc = scoreCandidate({ tracks: it.attr.numberOfItems, title: it.attr.title, artist: null }, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand score=${sc}  tracks=${it.attr.numberOfItems ?? '?'}  title="${it.attr.title}"  id=${it.id}`);
            if (!best || sc > best.score) best = { score: sc, id: it.id };
            if (sc >= 150) break;
        }
        if (!best || best.score < 120) {
            appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
            cacheSet(mbid, 'tidal', { url: null, tracks: null, year: null, label: null, source: 'API search' });
            updateRow('tidal', { url: null, mbTracks, remoteTracks: null }); return;
        }
        albumId = best.id; source = 'API search';
        appendLog(label, `Picked best (score=${best.score}): album ${albumId}`, best.score >= 150 ? 'ok' : 'warn');
    }

    if (!albumId) { updateRow('tidal', { url: null, mbTracks, remoteTracks: null }); return; }
    const albumUrl = `https://tidal.com/album/${albumId}`;
    // Track-count/year/label are best-effort — needs a token, but its absence
    // must NOT drop an existing/Wikidata link (it just stays count-unverified).
    const metaTok = await tidalToken();
    const meta = metaTok ? await fetchTidalAlbumMeta(albumId, metaTok) : null;
    if (meta) appendLog(label, `Album parsed: tracks=${meta.tracks} title="${meta.title}" year=${meta.year || '?'} label=${meta.label || '?'}`, meta.tracks ? 'ok' : 'warn');
    else appendLog(label, `Detail unavailable (no token / fetch failed) — showing URL without track count`, 'warn');
    const tracks = meta?.tracks ?? null, year = meta?.year ?? null, lbl = meta?.label ?? null;
    const bc = foundBarcode || meta?.barcode || null;
    cacheSet(mbid, 'tidal', { url: albumUrl, tracks, year, label: lbl, source, barcode: bc });
    updateRow('tidal', { url: albumUrl, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: bc });
}

// ─── Beatport ─────────────────────────────────────────────────────────────────
// Logged in (⚙ setup → Beatport account): the official API gives track counts, so
// matches are VERIFIED (→ the + insert works) — resolved by barcode, then artist+album
// search, and an existing MB-rel/Wikidata id is verified too. Not logged in: Beatport's
// pages are Cloudflare-walled (unfetchable), so we fall back to MB rel → Wikidata (P11312)
// → web search, surfaced UNVERIFIED (no track count).
async function scanBeatport({ artist, album, existingUrl, mbTracks, mbid, isVariousArtists, wikidataBeatportId, barcode }) {
    const label = 'Beatport';
    const cached = cacheGet(mbid, 'beatport');
    const idFromUrl = u => (String(u || '').match(/beatport\.com\/release\/[^/]+\/(\d+)/) || [])[1];
    // A cached hit short-circuits — EXCEPT when we're now logged in and the
    // cached entry was never track-count verified (e.g. a web-search result
    // cached while logged out, tracks=null). In that case fall through to the
    // authed API below to upgrade it to a verified match, reusing the cached
    // URL's release id, instead of leaving it UNVERIFIED forever (#168).
    const cachedUnverified = !!(cached?.url && cached.tracks == null && bpLoggedIn());
    if (cached?.url && (!existingUrl || existingUrl === cached.url) && !cachedUnverified) { applyCachedRow('beatport', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl && !wikidataBeatportId && !bpLoggedIn()) {
        appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn');
        applyCachedRow('beatport', label, cached, mbTracks); return;
    }
    if (cachedUnverified) appendLog(label, `Cached match is unverified — re-checking via API now that you're logged in`);

    let relId  = existingUrl ? idFromUrl(existingUrl) : (wikidataBeatportId || (cachedUnverified ? idFromUrl(cached.url) : null));
    let url    = existingUrl || (cachedUnverified ? cached.url : null);
    let source = existingUrl ? 'MB rels' : (wikidataBeatportId ? 'Wikidata' : (cachedUnverified ? (cached.source || 'cache') : null));

    // ── Authed: official API → verified track count ──
    if (bpLoggedIn()) {
        let rel = null;
        if (!relId) {
            if (barcode) {
                const s = await beatportApi(`/catalog/search/?q=${encodeURIComponent(barcode)}&type=releases&per_page=5`);
                rel = (s && (s.releases || []).find(r => String(r.upc) === String(barcode))) || null;
                if (rel) { source = 'barcode'; appendLog(label, `Barcode ${barcode} → release ${rel.id} "${rel.name}"`, 'ok'); }
            }
            if (!rel) {
                const q = isVariousArtists ? album : `${artist} ${album}`;
                const s = await beatportApi(`/catalog/search/?q=${encodeURIComponent(q)}&type=releases&per_page=10`);
                const cands = (s && s.releases) || [];
                appendLog(label, `API search: ${cands.length} candidate(s)`);
                let best = null;
                for (const it of cands) {
                    const sc = scoreCandidate({ tracks: it.track_count, title: it.name, artist: (it.artists || []).map(a => a.name).join(' ') }, mbTracks, album, artist, isVariousArtists);
                    appendLog(label, `  cand score=${sc}  tracks=${it.track_count ?? '?'}  artist="${(it.artists || []).map(a => a.name).join(' ') || '?'}"  title="${it.name || ''}"  id=${it.id}`);
                    if (!best || sc > best.score) best = { score: sc, it };
                    if (sc >= 150) break;
                }
                if (best && best.score >= 120) { rel = best.it; source = 'API search'; appendLog(label, `Picked best (score=${best.score}): release ${rel.id}`, best.score >= 150 ? 'ok' : 'warn'); }
                else if (cands.length) appendLog(label, `No verifiable match via authed API (best score=${best?.score ?? 'n/a'}) — falling back to unauthed resolvers`, 'warn');
            }
        }
        // Verify via detail — covers an MB-rel / Wikidata id, and fills the count for a search hit.
        const detail = rel || (relId ? await beatportApi(`/catalog/releases/${relId}/`) : null);
        if (detail) {
            const slug = detail.slug || (url && (url.match(/\/release\/([^/]+)\//) || [])[1]) || '-';
            url = `https://www.beatport.com/release/${slug}/${detail.id}`;
            const tracks = detail.track_count != null ? detail.track_count : ((detail.tracks || []).length || null);
            const year = String(detail.new_release_date || detail.publish_date || '').slice(0, 4) || null;
            const lbl = detail.label?.name || null;
            const bc = detail.upc || (source === 'barcode' ? barcode : null);   // (#182) Beatport exposes the UPC
            appendLog(label, `Verified: tracks=${tracks} year=${year || '?'} label=${lbl || '?'}${bc ? ` upc=${bc}` : ''}`, tracks ? 'ok' : 'warn');
            cacheSet(mbid, 'beatport', { url, tracks, year, label: lbl, source, barcode: bc });
            updateRow('beatport', { url, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: bc });
            return;
        }
        // authed but the API found nothing & no rel id → fall through to the no-auth resolvers
    }

    // ── Not authed (or API miss): MB rel → Wikidata → web search, UNVERIFIED ──
    if (!url && wikidataBeatportId) { url = `https://www.beatport.com/release/-/${wikidataBeatportId}`; source = 'Wikidata'; appendLog(label, `Wikidata answer: release ${wikidataBeatportId}`, 'ok'); }
    if (!url) {
        const q = `site:beatport.com/release/ ${searchTerms(artist)} ${searchTerms(album)}`;
        const hits = await searchWeb(q, u => /^https?:\/\/(?:www\.)?beatport\.com\/release\/[^/]+\/\d+/i.test(u), label, 5);
        if (!hits.length) {
            appendLog(label, `No match — no MB rel, no Wikidata P11312, no search hit`, 'warn');
            cacheSet(mbid, 'beatport', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('beatport', { url: null, mbTracks, remoteTracks: null });
            return;
        }
        // #380 DDG often returns unrelated releases (its fuzzy match), and repeating it trips Beatport's
        // protections — so the hit is untrustworthy. REQUIRE the release slug to actually match the album
        // (don't blindly take hits[0], which was returning e.g. "hard-trance-sessions-vol-1" for an African
        // comp). If none match, report no-match rather than a wrong release.
        const slugOf = u => decodeURIComponent((u.match(/\/release\/([^/]+)\//) || [])[1] || '').replace(/-/g, ' ');
        // min-mode: most of the (short) slug's tokens must appear in the album title — lenient enough for a
        // short official slug vs a long MB title, but rejects an unrelated release that shares ~nothing.
        let pick = null;
        for (const h of hits) { if (tokenMatch(slugOf(h), album, 'min', 0.6)) { pick = h; break; } }
        if (!pick) {
            appendLog(label, `Search hits didn't match “${album}” (top: ${slugOf(hits[0])}) — skipping to avoid a wrong release (#380)`, 'warn');
            cacheSet(mbid, 'beatport', { url: null, tracks: null, year: null, label: null, source: 'search' });
            updateRow('beatport', { url: null, mbTracks, remoteTracks: null, source: 'search' });
            return;
        }
        url = pick.split(/[?#]/)[0]; source = 'search';
        // #380 if we happen to be logged in, verify the search hit against the API before trusting it
        if (bpLoggedIn()) {
            const vid = idFromUrl(url), detail = vid ? await beatportApi(`/catalog/releases/${vid}/`) : null;
            if (detail) {
                const sc = scoreCandidate({ tracks: detail.track_count, title: detail.name, artist: (detail.artists || []).map(a => a.name).join(' ') }, mbTracks, album, artist, isVariousArtists);
                if (sc < 100) {
                    appendLog(label, `Search hit "${detail.name}" failed API verification (score=${sc}) — rejecting (#380)`, 'warn');
                    cacheSet(mbid, 'beatport', { url: null, tracks: null, year: null, label: null, source: 'search' });
                    updateRow('beatport', { url: null, mbTracks, remoteTracks: null, source: 'search' });
                    return;
                }
                const tracks = detail.track_count != null ? detail.track_count : ((detail.tracks || []).length || null);
                const year = String(detail.new_release_date || detail.publish_date || '').slice(0, 4) || null;
                const lbl = detail.label?.name || null, bc = detail.upc || null;
                appendLog(label, `Search hit verified via API (score=${sc}): tracks=${tracks} year=${year || '?'}`, 'ok');
                cacheSet(mbid, 'beatport', { url, tracks, year, label: lbl, source: 'search+api', barcode: bc });
                updateRow('beatport', { url, mbTracks, remoteTracks: tracks, year, label: lbl, source: 'search+api', barcode: bc });
                return;
            }
        }
        appendLog(label, `Found via search (UNVERIFIED — log in via ⚙ for track-count verification): ${url}`, 'warn');
    } else if (source === 'MB rels') {
        appendLog(label, `Using existing MB URL: ${url}`, 'ok');
    }
    cacheSet(mbid, 'beatport', { url, tracks: null, year: null, label: null, source });
    updateRow('beatport', { url, mbTracks, remoteTracks: null, source });
}

// ─── Volumo ─────────────────────────────────────────────────────────────────
// Electronic-music store with a clean, unauthenticated JSON API
// (volumo.com/api/v1) — no Cloudflare, no captcha, no token. A release lookup
// returns the full tracklist (with ISRCs) in one call. We resolve by existing
// MB rel → barcode (ICPN) → artist+album search. Volumo's canonical page is
// /album/{icpn}-{slug}, but the bare /album/{id} form 308-redirects to it.
// #202: MB doesn't normalize Volumo URLs yet (MBS-14369), so we emit the
// clean, slug-less /album/{id} form ourselves — drop the human-readable
// "-{slug}" tail (it's purely cosmetic and only invites duplicate-link noise).
// {id} is the ICPN (barcode) when known, else Volumo's internal album id.
const volumoUrl   = a => a && a.icpn ? `https://volumo.com/album/${a.icpn}` : (a && a.id ? `https://volumo.com/album/${a.id}` : null);
// Normalize any Volumo album URL to that slug-less form so a slugged MB rel and
// our clean URL compare equal (avoids a false "differs" / re-add).
const volumoClean = u => { const m = String(u || '').match(/\/album\/(\d+)/i); return m ? `https://volumo.com/album/${m[1]}` : (u || null); };
async function volumoApi(path) { const r = await gmGet('https://volumo.com/api/v1' + path); if (!r.ok) return null; try { const j = JSON.parse(r.responseText); return Array.isArray(j) ? j[0] : (j.album || j); } catch { return null; } }
async function scanVolumo({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'Volumo';
    const cached = cacheGet(mbid, 'volumo');
    if (cached?.url && (!existingUrl || volumoClean(existingUrl) === volumoClean(cached.url))) { applyCachedRow('volumo', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl && !barcode) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('volumo', label, cached, mbTracks); return; }

    let a = null, source = null;
    if (existingUrl) {
        source = 'MB rels'; appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok');
        const m = existingUrl.match(/\/album\/(\d{8,14})(?:-|$)/) || existingUrl.match(/\/album\/(\d+)/);
        if (m) a = m[1].length >= 8 ? await volumoApi('/album_by_icpn/' + m[1]) : await volumoApi('/albums/' + m[1]);
    } else if (barcode) {
        a = await volumoApi('/album_by_icpn/' + barcode);
        if (a) { source = 'barcode'; appendLog(label, `Barcode ${barcode} → album ${a.id} "${a.title}"`, 'ok'); }
    }
    if (!a && !existingUrl) {
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const searchUrl = `https://volumo.com/api/v1/search?query=${encodeURIComponent(q)}&limit=10`;
        appendLog(label, `API search: ${searchUrl}`);
        const j = await gmGet(searchUrl);
        appendLog(label, `API search: status=${j.status} ${(j.responseText || '').length}b in ${j.ms}ms`);
        let albums = [];
        // Volumo returns each bucket as an array when populated, but an empty {} when there are no hits — coerce.
        try { const ab = JSON.parse(j.responseText).albums; albums = Array.isArray(ab) ? ab : []; } catch (e) { appendLog(label, `API search: JSON parse error: ${e.message}`, 'error'); }
        appendLog(label, `API search: ${albums.length} candidate(s)`);
        let best = null;
        for (const it of albums) {
            const sc = scoreCandidate({ tracks: (it.tracks || []).length || null, title: it.title, artist: (it.artists || []).map(x => x.name).join(' ') }, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand score=${sc}  tracks=${(it.tracks || []).length || '?'}  artist="${(it.artists || []).map(x => x.name).join(' ') || '?'}"  title="${it.title || ''}"  id=${it.id}`);
            if (!best || sc > best.score) best = { score: sc, a: it };
            if (sc >= 150) break;
        }
        if (best && best.score >= 120) { a = best.a; source = 'API search'; appendLog(label, `Picked best (score=${best.score}): album ${a.id}`, best.score >= 150 ? 'ok' : 'warn'); }
        else appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
    }
    if (!a) { cacheSet(mbid, 'volumo', { url: null, tracks: null, year: null, label: null, source: 'search' }); updateRow('volumo', { url: null, mbTracks, remoteTracks: null }); return; }
    // search hits may omit the full tracklist — refetch by ICPN for an accurate count
    if (!(a.tracks && a.tracks.length) && a.icpn) { const full = await volumoApi('/album_by_icpn/' + a.icpn); if (full) a = full; }
    const tracks = (a.tracks || []).length || null;
    const year = String(a.original_release_date || '').slice(0, 4) || null;
    const lbl = a.recordlabel?.name || (typeof a.recordlabel === 'string' ? a.recordlabel : null);   // recordlabel is an object {id,name,…}
    const url = volumoUrl(a);
    const vbc = a.icpn || a.upc || null;
    appendLog(label, `Album: tracks=${tracks} title="${a.title}" year=${year || '?'}`, tracks ? 'ok' : 'warn');
    cacheSet(mbid, 'volumo', { url, tracks, year, label: lbl, source, barcode: vbc });
    updateRow('volumo', { url, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: vbc });
}

// ─── HDtracks ────────────────────────────────────────────────────────────────
// High-resolution download store (#176) with a clean, unauthenticated, CORS-open
// JSON API (hdtracks.azurewebsites.net/api/v1) — no Cloudflare, no captcha, no
// token. The album id is a 24-char hex ObjectId; a barcode/UPC is resolved to it
// via the search endpoint. /album/<id> embeds the full tracklist + per-track
// ISRCs in one call. Bad ids / unknown GTINs return HTTP 200 with an empty body,
// so presence is read from the JSON, not the status code. The 5009 legacy MB rels
// use old URL forms (valbum_code=<UPC>, slug-id, artist page); the new canonical
// web URL is https://www.hdtracks.com/#/album/<id>. We resolve by existing MB rel
// → barcode → artist+album search.
const HD_API = 'https://hdtracks.azurewebsites.net/api/v1';
const hdtracksUrl = id => id ? `https://www.hdtracks.com/#/album/${id}` : null;
async function hdtracksAlbum(id) { const r = await gmGet(`${HD_API}/album/${id}`); if (!r.ok) return null; try { const j = JSON.parse(r.responseText); return j && j.id ? j : null; } catch { return null; } }
async function hdtracksSearch(q) {
    const url = `${HD_API}/albums/search?q=${encodeURIComponent(q)}`;
    appendLog('HDtracks', `API search: ${url}`);
    const r = await gmGet(url);
    appendLog('HDtracks', `API search: status=${r.status} ${(r.responseText || '').length}b in ${r.ms}ms`);
    if (!r.ok) return [];
    try { const j = JSON.parse(r.responseText); return Array.isArray(j.albums) ? j.albums : []; } catch (e) { appendLog('HDtracks', `API search: JSON parse error: ${e.message}`, 'error'); return []; }
}
async function scanHDtracks({ artist, album, mbTracks, existingUrl, mbid, isVariousArtists, barcode }) {
    const label = 'HDtracks';
    const cached = cacheGet(mbid, 'hdtracks');
    if (cached?.url && (!existingUrl || existingUrl === cached.url)) { applyCachedRow('hdtracks', label, cached, mbTracks); return; }
    if (cached && !cached.url && !existingUrl && !barcode) { appendLog(label, `No match (cached from previous scan — use ↻ to force a re-search)`, 'warn'); applyCachedRow('hdtracks', label, cached, mbTracks); return; }

    let a = null, source = null;
    if (existingUrl) {
        source = 'MB rels'; appendLog(label, `Using existing MB URL: ${existingUrl}`, 'ok');
        let m = existingUrl.match(/\/album\/([a-f0-9]{24})/i);
        if (m) a = await hdtracksAlbum(m[1]);
        else if ((m = existingUrl.match(/[?&]valbum_code=(\d{8,})/i))) {   // legacy URL: valbum_code is the UPC
            const hits = await hdtracksSearch(m[1]);
            if (hits[0]?.id) a = await hdtracksAlbum(hits[0].id);
        }
        // legacy slug-id / artist-page rels have no clean id mapping — fall through to barcode/search
    }
    if (!a && barcode) {
        const hits = await hdtracksSearch(barcode);
        if (hits[0]?.id) { a = await hdtracksAlbum(hits[0].id); if (a) { source = 'barcode'; appendLog(label, `Barcode ${barcode} → album ${a.id} "${a.name}"`, 'ok'); } }
    }
    if (!a && !existingUrl) {
        const q = isVariousArtists ? album : `${artist} ${album}`;
        const albums = await hdtracksSearch(q);
        appendLog(label, `API search: ${albums.length} candidate(s)`);
        let best = null;
        for (const it of albums) {
            const sc = scoreCandidate({ tracks: it.tracksCount || null, title: it.name, artist: (it.artists || []).join(' ') || it.mainArtist }, mbTracks, album, artist, isVariousArtists);
            appendLog(label, `  cand score=${sc}  tracks=${it.tracksCount ?? '?'}  artist="${(it.artists || []).join(' ') || it.mainArtist || '?'}"  title="${it.name || ''}"  id=${it.id}`);
            if (!best || sc > best.score) best = { score: sc, a: it };
            if (sc >= 150) break;
        }
        if (best && best.score >= 120) { a = (await hdtracksAlbum(best.a.id)) || best.a; source = 'API search'; appendLog(label, `Picked best (score=${best.score}): album ${best.a.id}`, best.score >= 150 ? 'ok' : 'warn'); }
        else appendLog(label, `No verifiable match (best score=${best?.score ?? 'n/a'}) — leaving URL unset`, 'warn');
    }
    if (!a) { cacheSet(mbid, 'hdtracks', { url: null, tracks: null, year: null, label: null, source: 'search' }); updateRow('hdtracks', { url: null, mbTracks, remoteTracks: null }); return; }
    const tracks = (a.tracks && a.tracks.length) || a.tracksCount || null;
    const year = String(a.release || a.originalRelease || '').slice(0, 4) || null;
    const lbl = a.label || null;
    const url = hdtracksUrl(a.id);
    const hbc = a.upc || null;
    appendLog(label, `Album: tracks=${tracks} title="${a.name}" year=${year || '?'}`, tracks ? 'ok' : 'warn');
    cacheSet(mbid, 'hdtracks', { url, tracks, year, label: lbl, source, barcode: hbc });
    updateRow('hdtracks', { url, mbTracks, remoteTracks: tracks, year, label: lbl, source, barcode: hbc });
}

// ─── Main entry ────────────────────────────────────────────────────────────
const mbid = window.location.pathname.split('/')[2];
if (!mbid || mbid.length < 10) {
    appendLog('System', `No valid MBID parsed from URL`, 'error');
    return;
}

// Reset each platform row back to its initial ⚪ / -- state. Used by the
// refresh button before re-running the scans.
function resetRows() {
    for (const p of ALL_PROVIDERS) {
        const ico = document.getElementById(`ico-${p}`);
        const val = document.getElementById(`val-${p}`);
        const a    = document.getElementById(`mb-online-${p}`);
        if (ico)  { ico.textContent = '⚪'; ico.style.color = 'var(--mbu-text-dim)'; ico.style.fontWeight = 'normal'; ico.onclick = null; ico.style.cursor = ''; ico.classList.remove('pc-ico-circled'); }
        const plat = document.getElementById(`plat-${p}`);
        if (plat) { plat.onclick = null; plat.style.cursor = 'default'; pcWireForce(plat, null); }
        if (ico) pcWireForce(ico, null);
        const row = document.getElementById(`row-${p}`);
        if (row) { row.classList.remove('pc-inmb', 'pc-st-mismatch', 'pc-st-match', 'pc-rise'); row.classList.add('pc-st-notfound'); }   // back to "not found" — refreshCompactStrip re-folds it (#355)
        if (val)  { val.textContent = '—'; val.style.color = 'var(--mbu-error)'; }   // neutral dash while re-scanning
        setMetaCells(`year-${p}`, `format-${p}`, `label-${p}`, null, null, null);
        // Reset the anchor href to its search-fallback so parseMbFromDom on
        // a subsequent refresh doesn't see the previous /album/<id> result
        // as an "existing MB rel" — covered by the #mb-pc-panel exclusion
        // in parseMbFromDom too, but defensive cleanup either way.
        if (a)    { a.href = '#'; a.title = ''; }
        // The row stays clickable across a reset — dataset.searchUrl survives, so
        // a re-scanning row still opens the provider's search (it's the same
        // release). runScans re-seeds and re-wires a moment later anyway.
        wireRowOpen(p);
    }
    refreshCompactStrip();   // #355: clear the strip while re-scanning
}

// VA detection used by both the DOM and API parse paths. Hoisted so both
// can share the regex without duplication.
const VA_MBID = '89ad4ac3-39f7-470e-963a-56509c546377';
const VA_NAME_RE = /^various(\s+artists?)?$/i;

// Scrape the MB release record from the *currently-rendered page DOM* — we're
// already running on /release/<mbid>, so the data is in front of us. This
// avoids the typical 10s /ws/2 round-trip when MB is under load. Returns the
// same shape as parseMbData() or null when the DOM doesn't have what we need
// (in which case the caller falls back to the API). Selectors are defensive:
// MB occasionally shuffles its markup; the API fallback covers regressions.
function parseMbFromDom() {
    try {
        // Album title. MB wraps the title in <bdi> inside the release header's
        // h1. Several layouts exist — use a chain of fallbacks.
        const titleNode = document.querySelector(
            '.releaseheader h1 bdi, .release-information h1 bdi, h1 bdi'
        );
        const album = titleNode?.textContent?.trim()
                   || (document.title.match(/^Release\s+["“]([^"”]+)["”]/) || [])[1]
                   || '';

        // Artist credit. Anchors to /artist/<mbid> appearing in the release
        // header (or its `.subheader` / `.artist-credit` span). VA detection
        // by MBID or by literal name.
        const headerScope = document.querySelector('.releaseheader, .release-information, #content') || document;
        const artistAnchors = headerScope.querySelectorAll(
            '.artist-credit a[href^="/artist/"], .subheader a[href^="/artist/"], h1 ~ p a[href^="/artist/"]'
        );
        const artistNames = [...artistAnchors].map(a => a.textContent.trim()).filter(Boolean);
        const artistIds   = [...artistAnchors].map(a => (a.getAttribute('href') || '').match(/\/artist\/([0-9a-f-]{36})/)?.[1]).filter(Boolean);
        const artist = artistNames[0] || '';

        // Track count. Current MB markup renders each track as a bare <tr>
        // inside `table.tbl.medium tbody`, the first row being `<tr class="subh">`
        // (header). Tracks have a `<td class="pos">` cell — counting those
        // skips the header automatically and works for multi-disc releases
        // (one table per medium, all summed). The older `tr.track` selector
        // is kept as a fallback for any legacy renderer.
        const mbTracks = document.querySelectorAll('table.tbl.medium tbody tr > td.pos').length
                       || document.querySelectorAll('tr.track').length;

        // Release-group MBID — usually present as a /release-group/<mbid>
        // anchor in the release-information sidebar block. Some skins or
        // partially-rendered pages have it only in an inline data attribute
        // or a meta tag; cast a wider net.
        const rgFromHref = [...document.querySelectorAll('a[href*="/release-group/"]')]
            .map(a => a.getAttribute('href').match(/release-group\/([0-9a-f-]{36})/)?.[1])
            .find(Boolean);
        const rgFromText = document.body.innerHTML.match(/release-group\/([0-9a-f-]{36})/)?.[1];
        const releaseGroupMbid = rgFromHref || rgFromText || null;

        // Existing URL rels. MB renders the release's URL relationships in
        // different places depending on layout state — sometimes under
        // "External links" in #sidebar, sometimes inline in the main #content
        // under a "Credits" / "External links" section (verified on the
        // "Mambo loco" release where Discogs / Spotify / Bandcamp all appear
        // in the main content's credits table). Search both. The platform
        // URL patterns below are specific enough that we won't false-positive
        // on unrelated outbound links.
        //
        // Some MB anchors use protocol-relative `href="//host/path"` so we
        // query every `a[href]` and filter on the *resolved* `.href` property
        // (always absolute) rather than the attribute selector.
        const scope = document.querySelector('#content, #wrap, body') || document;
        const sidebar = document.querySelector('#sidebar');
        // Exclude our own panel — after the first scan finishes, its provider
        // <a> tags hold the URLs we *found* (e.g. open.spotify.com/album/…)
        // which look identical to real MB rel anchors. Without this filter a
        // subsequent ↻ refresh sees every row's discovered URL as "existing
        // in MB", flips source to 'MB rels', and the entire panel circles
        // even when MB has no rels at all. (Witnessed on the Threads release
        // with zero external links.)
        const pcPanel = document.getElementById('mb-pc-panel');
        const allAnchors = [
            ...(sidebar ? sidebar.querySelectorAll('a[href]') : []),
            ...scope.querySelectorAll('a[href]'),
        ].filter(a => !pcPanel || !pcPanel.contains(a));
        const externalHrefs = allAnchors.map(a => a.href).filter(u => /^https?:\/\//.test(u));
        const existing = {
            spotify:  externalHrefs.find(u => /^https?:\/\/open\.spotify\.com\/(?:intl-[a-z-]+\/)?album\//i.test(u)) || null,
            discogs:  externalHrefs.find(u => /^https?:\/\/www\.discogs\.com\/(?:[a-z-]+\/)?release\/\d+/i.test(u)) || null,
            bandcamp:      externalHrefs.find(u => /^https?:\/\/[a-z0-9-]+\.bandcamp\.com\/album\//i.test(u)) || null,
            deezer:        externalHrefs.find(u => /^https?:\/\/(?:www\.)?deezer\.com\/(?:[a-z]+\/)?album\/\d+/i.test(u)) || null,
            apple:         externalHrefs.find(u => /^https?:\/\/music\.apple\.com\/(?:[a-z]{2}\/)?album\/(?:[^/]+\/)?\d+/i.test(u)) || null,
            tidal:         externalHrefs.find(u => /^https?:\/\/(?:listen\.)?tidal\.com\/(?:browse\/)?album\/\d+/i.test(u)) || null,
            qobuz:         externalHrefs.find(u => /^https?:\/\/(?:www\.|play\.|open\.)?qobuz\.com\/(?:[a-z]{2}-[a-z]{2}\/)?album\//i.test(u)) || null,
            beatport:      externalHrefs.find(u => /^https?:\/\/(?:www\.)?beatport\.com\/release\/[^/]+\/\d+/i.test(u)) || null,
            volumo:        externalHrefs.find(u => /^https?:\/\/(?:www\.)?volumo\.com\/album\//i.test(u)) || null,
            hdtracks:      externalHrefs.find(u => /^https?:\/\/(?:www\.)?hdtracks\.com\//i.test(u)) || null,
            ytmusic:       externalHrefs.find(u => /^https?:\/\/music\.youtube\.com\/(?:playlist\?(?:[^#]*&)?list=OLAK5uy_|browse\/MPREb_)/i.test(u)) || null,
            amazonmusic:   externalHrefs.find(u => /^https?:\/\/music\.amazon\.[a-z.]+\/albums\/[A-Z0-9]{10}/i.test(u)) || null,
            soundcloud:    externalHrefs.find(u => /^https?:\/\/(?:www\.|m\.)?soundcloud\.com\/[^/?#]+\/(?:sets\/)?[^/?#]+/i.test(u)) || null,
            audiomack:     externalHrefs.find(u => /^https?:\/\/(?:www\.)?audiomack\.com\/[^/?#]+\/(?:album|song)\/[^/?#]+/i.test(u)) || null,
            discogsMaster: externalHrefs.find(u => /^https?:\/\/www\.discogs\.com\/(?:[a-z-]+\/)?master\/\d+/i.test(u)) || null,
        };

        const isVariousArtists = artistIds.includes(VA_MBID) || artistNames.some(n => VA_NAME_RE.test(n));

        // Shared key matcher for "Date:" / "Label:" / "Format:" header
        // detection across the various skins MB renders.
        const matchKey = (el, ...wanted) => {
            const txt = (el.textContent || '').trim().replace(/:$/, '').toLowerCase();
            return wanted.includes(txt);
        };
        const FORMAT_RE = /\b(CD|Vinyl|Cassette|Digital\s*Media|File|SACD|DVD|Blu-?ray|Flexi-?disc|Minidisc|12"\s*Vinyl|7"\s*Vinyl|10"\s*Vinyl)\b/i;

        // Release format. MB renders it in several places: a sidebar
        // dl/dt/dd "Format:" row, a table th/td variant, or a medium-table
        // header above each tracklist. Try them all.
        let format = null;
        for (const dt of document.querySelectorAll('dl.properties dt, dl dt')) {
            const dd = dt.nextElementSibling;
            if (!dd || dd.tagName !== 'DD') continue;
            if (matchKey(dt, 'format', 'formats')) {
                const m = dd.textContent.match(FORMAT_RE);
                if (m) { format = m[1]; break; }
            }
        }
        if (!format) {
            for (const th of document.querySelectorAll('table th')) {
                const td = th.nextElementSibling;
                if (!td) continue;
                if (matchKey(th, 'format', 'formats')) {
                    const m = td.textContent.match(FORMAT_RE);
                    if (m) { format = m[1]; break; }
                }
            }
        }
        if (!format) {
            for (const t of document.querySelectorAll('table.tbl.medium, table.medium-list')) {
                const head = (t.previousElementSibling?.textContent || t.querySelector('caption, thead')?.textContent || '').trim();
                const m = head.match(FORMAT_RE);
                if (m) { format = m[1]; break; }
            }
        }
        // Pattern D: sidebar text scan for `Format: <FMT>`. Catches the
        // <strong>Format:</strong> CD layout MB renders inside the
        // "Release information" block on many releases.
        if (!format) {
            const sb = document.querySelector('#sidebar');
            if (sb) {
                const m = (sb.textContent || '').match(/Format:?\s+(CD|Vinyl|Cassette|Digital\s*Media|File|SACD|DVD|Blu-?ray|Flexi-?disc|Minidisc)\b/i);
                if (m) format = m[1];
            }
        }

        // Year + label for the header subtitle. Same multi-pattern approach.
        let year = null, releaseLabel = null;
        // Pattern A: dl/dt/dd.
        for (const dt of document.querySelectorAll('dl.properties dt, dl dt')) {
            const dd = dt.nextElementSibling;
            if (!dd || dd.tagName !== 'DD') continue;
            if (!year && matchKey(dt, 'date', 'release date')) {
                const m = dd.textContent.match(/\b(19\d{2}|20\d{2})\b/);
                if (m) year = m[1];
            }
            if (!releaseLabel && matchKey(dt, 'label', 'labels')) {
                const aLabels = [...dd.querySelectorAll('a[href*="/label/"]')].map(a => a.textContent.trim()).filter(Boolean);
                if (aLabels.length) releaseLabel = [...new Set(aLabels)].join(', ');
            }
        }
        // Pattern B: table th/td (some MB skins use this for release info).
        if (!year || !releaseLabel) {
            for (const th of document.querySelectorAll('table th')) {
                const td = th.nextElementSibling;
                if (!td) continue;
                if (!year && matchKey(th, 'date', 'release date')) {
                    const m = td.textContent.match(/\b(19\d{2}|20\d{2})\b/);
                    if (m) year = m[1];
                }
                if (!releaseLabel && matchKey(th, 'label', 'labels')) {
                    const aLabels = [...td.querySelectorAll('a[href*="/label/"]')].map(a => a.textContent.trim()).filter(Boolean);
                    if (aLabels.length) releaseLabel = [...new Set(aLabels)].join(', ');
                }
            }
        }
        // Fallback: any /label/ anchor in #sidebar; year from the rendered
        // sidebar text (with `<script type="application/json">` embeds and
        // `<style>` content stripped — otherwise the first match is often
        // a country entity's "last_updated" timestamp inside MB's React
        // bootstrap blob, not the release year).
        const sb = document.querySelector('#sidebar');
        if (sb) {
            if (!releaseLabel) {
                const aLabels = [...sb.querySelectorAll('a[href*="/label/"]')].map(a => a.textContent.trim()).filter(Boolean);
                if (aLabels.length) releaseLabel = [...new Set(aLabels)].join(', ');
            }
            // Helper: read element textContent with <script>/<style>/<noscript>
            // stripped. The Release events section embeds a React bootstrap
            // blob whose first year is the country entity's `last_updated`
            // timestamp (e.g. "2013-08-28" for the [Worldwide] entity), not
            // the release date — only the rendered "[Worldwide]2017-06-15"
            // sibling carries the actual year we want.
            const cleanText = el => {
                const c = el.cloneNode(true);
                c.querySelectorAll('script, style, noscript').forEach(n => n.remove());
                return c.textContent || '';
            };
            if (!year) {
                // Prefer the "Release events" section directly when available —
                // it's the canonical home of the release date.
                //
                // Two subtleties learned the hard way:
                //
                // (1) Skip <script> siblings ENTIRELY. The cleanText helper
                //     strips descendant scripts from a cloned subtree, but
                //     if the sibling element itself is a <script>, its own
                //     content is preserved. MB embeds a JSON bootstrap blob
                //     as the first Release-events sibling whose JSON order
                //     varies: sometimes `{"date":{"year":2021},…}` is first
                //     (we'd luckily land on the right year), sometimes the
                //     country entity is first with `"last_updated":"2013-…"`
                //     (we'd extract Germany's last-updated year, not the
                //     release year). Safer to ignore the script outright.
                //
                // (2) Drop the leading \b from the date regex. The rendered
                //     date sits inside text like "Germany2021-12-03" — no
                //     word boundary between the country name and the year.
                //     A trailing \b still rejects the `last_updated`
                //     "2013-05-27T…" case (T is word-class, no boundary).
                const reHeader = [...sb.querySelectorAll('h2, h3')].find(h => /release events?/i.test(h.textContent));
                if (reHeader) {
                    let dateYear = null, anyYear = null;
                    for (let n = reHeader.nextElementSibling; n && !/^h[1-6]$/i.test(n.tagName); n = n.nextElementSibling) {
                        if (/^(script|style|noscript)$/i.test(n.tagName)) continue;
                        const t = cleanText(n);
                        if (!dateYear) {
                            const d = t.match(/(19\d{2}|20\d{2})-(?:0\d|1[0-2])-(?:0\d|[12]\d|3[01])\b/);
                            if (d) dateYear = d[1];
                        }
                        if (!anyYear) {
                            const m = t.match(/(19\d{2}|20\d{2})\b/);
                            if (m) anyYear = m[1];
                        }
                        if (dateYear) break;
                    }
                    year = dateYear || anyYear || null;
                }
            }
            if (!year) {
                const clone = sb.cloneNode(true);
                clone.querySelectorAll('script, style, noscript').forEach(n => n.remove());
                const m = (clone.textContent || '').match(/\b(19\d{2}|20\d{2})\b/);
                if (m) year = m[1];
            }
        }

        // Barcode (UPC/EAN) — MB renders it as a "Barcode:" dt/dd, th/td, or in
        // the sidebar text. Strip to digits. Used to resolve Volumo (and, as an
        // exact match, Deezer/Apple) by UPC. Scraped from the page here; the WS2
        // `data.barcode` is only a fallback (parseMbData).
        let barcode = null;
        for (const dt of document.querySelectorAll('dl.properties dt, dl dt, table th')) {
            const dd = dt.nextElementSibling;
            if (!dd) continue;
            if (matchKey(dt, 'barcode')) { const m = (dd.textContent || '').replace(/\s+/g, '').match(/\d{8,14}/); if (m) { barcode = m[0]; break; } }
        }
        if (!barcode && sidebar) { const m = (sidebar.textContent || '').match(/Barcode:?\s*([\d\s]{8,})/i); if (m) barcode = m[1].replace(/\D/g, '') || null; }

        // Sanity gate: we need artist + album + at least one track row. Anything
        // less is an unrendered or unfamiliar layout — bail to API.
        if (!artist || !album || mbTracks < 1) return null;
        return { artist, album, mbTracks, releaseGroupMbid, isVariousArtists, existing, format, year, releaseLabel, barcode };
    } catch (e) {
        appendLog('System', `parseMbFromDom threw: ${e.message}`, 'error');
        return null;
    }
}

// Parse a successful MB release-API payload into the lean record we cache and
// pass to the scanners. Returns null when the payload is missing the artist
// or album (treated as a fatal-for-this-MBID parse error upstream).
function parseMbData(data) {
    const artist = data['artist-credit']?.[0]?.name || data['artist-credit']?.[0]?.artist?.name || '';
    const album  = data.title || '';
    if (!artist || !album) return null;
    const mbTracks = data.media?.reduce((s, m) => s + (m['track-count'] || 0), 0) || 0;
    const releaseGroupMbid = data['release-group']?.id || null;
    // MB's "Various Artists" entity. Compilations on Bandcamp / Spotify
    // typically aren't credited to literally "Various Artists" — they go under
    // the label (e.g. "Analog Africa", "Soul Jazz Records"). Detect via the
    // special MBID OR a literal "Various"/"Various Artists" string match so
    // we can drop the artist term from the search query; the verifier picks
    // the right candidate from the wider net.
    const isVA = c => c.artist?.id === VA_MBID
                   || VA_NAME_RE.test(c.artist?.name || '')
                   || VA_NAME_RE.test(c.name || '');
    const isVariousArtists = !!data['artist-credit']?.some(isVA);
    const relUrls = (data.relations || [])
        .filter(r => r['target-type'] === 'url' && r.url?.resource)
        .map(r => r.url.resource);
    const existing = {
        spotify:  relUrls.find(u => /^https?:\/\/open\.spotify\.com\/(?:intl-[a-z-]+\/)?album\//i.test(u)) || null,
        discogs:  relUrls.find(u => /^https?:\/\/www\.discogs\.com\/(?:[a-z-]+\/)?release\/\d+/i.test(u)) || null,
        bandcamp:      relUrls.find(u => /^https?:\/\/[a-z0-9-]+\.bandcamp\.com\/album\//i.test(u)) || null,
        deezer:        relUrls.find(u => /^https?:\/\/(?:www\.)?deezer\.com\/(?:[a-z]+\/)?album\/\d+/i.test(u)) || null,
        apple:         relUrls.find(u => /^https?:\/\/music\.apple\.com\/(?:[a-z]{2}\/)?album\/(?:[^/]+\/)?\d+/i.test(u)) || null,
        tidal:         relUrls.find(u => /^https?:\/\/(?:listen\.)?tidal\.com\/(?:browse\/)?album\/\d+/i.test(u)) || null,
        qobuz:         relUrls.find(u => /^https?:\/\/(?:www\.|play\.|open\.)?qobuz\.com\/(?:[a-z]{2}-[a-z]{2}\/)?album\//i.test(u)) || null,
        beatport:      relUrls.find(u => /^https?:\/\/(?:www\.)?beatport\.com\/release\/[^/]+\/\d+/i.test(u)) || null,
        volumo:        relUrls.find(u => /^https?:\/\/(?:www\.)?volumo\.com\/album\//i.test(u)) || null,
        hdtracks:      relUrls.find(u => /^https?:\/\/(?:www\.)?hdtracks\.com\//i.test(u)) || null,
        ytmusic:       relUrls.find(u => /^https?:\/\/music\.youtube\.com\/(?:playlist\?(?:[^#]*&)?list=OLAK5uy_|browse\/MPREb_)/i.test(u)) || null,
        amazonmusic:   relUrls.find(u => /^https?:\/\/music\.amazon\.[a-z.]+\/albums\/[A-Z0-9]{10}/i.test(u)) || null,
        soundcloud:    relUrls.find(u => /^https?:\/\/(?:www\.|m\.)?soundcloud\.com\/[^/?#]+\/(?:sets\/)?[^/?#]+/i.test(u)) || null,
        audiomack:     relUrls.find(u => /^https?:\/\/(?:www\.)?audiomack\.com\/[^/?#]+\/(?:album|song)\/[^/?#]+/i.test(u)) || null,
    discogsMaster: relUrls.find(u => /^https?:\/\/www\.discogs\.com\/(?:[a-z-]+\/)?master\/\d+/i.test(u)) || null,
    };
    const format = data.media?.[0]?.format || null;
    const year   = data.date ? String(data.date).slice(0, 4) : null;
    const barcode = String(data.barcode || '').replace(/\D/g, '') || null;   // WS2 fallback (DOM scrape preferred)
    const releaseLabel = (data['label-info'] || [])
        .map(li => li.label?.name)
        .filter(Boolean)
        .filter((v, i, a) => a.indexOf(v) === i)
        .join(', ') || null;
    return { artist, album, mbTracks, releaseGroupMbid, isVariousArtists, existing, format, year, releaseLabel, barcode };
}

// (#422, per maintainer review) the ↻ button ITSELF is the progress indicator — it spins
// and can't be clicked while scans run (no separate icon, no ticking seconds, no end-state
// noise); the total scan time goes into the button's tooltip when done.
let _scanT0 = 0;
const REFRESH_TITLE = 'Refresh — clear cache and re-scan';
function setScanStatus(state) {
    const btn = document.getElementById('mb-refresh-btn'); if (!btn) return;
    if (state === 'busy') { _scanT0 = Date.now(); btn.classList.add('pc-scanning'); btn.title = 'Scanning platforms…'; return; }
    btn.classList.remove('pc-scanning');
    const secs = ((Date.now() - _scanT0) / 1000).toFixed(1);
    btn.title = state === 'done' ? `${REFRESH_TITLE} (last scan: ${secs}s)` : `${REFRESH_TITLE} (last scan halted — see the log)`;
}
async function runScans() {
    // (#422) thin status wrapper — the scan body lives in runScansInner; `false` = halted.
    setScanStatus('busy');
    let ok = false;
    try { ok = await runScansInner() !== false; }
    catch (e) { appendLog('System', `Scan failed: ${e && e.message}`, 'error'); }
    setScanStatus(ok ? 'done' : 'halt');
}
async function runScansInner() {
    // Source precedence: DOM (instant, no network) > /ws/2 API (~10s when MB is
    // hot) > mbDataCache (transient MB outage). DOM is identical data to API
    // for our purposes — both give artist/album/tracks/rg/url-rels — and we're
    // already running on the page so it's free.
    let mbData = parseMbFromDom();
    let dataSource = 'dom';

    if (mbData) {
        appendLog('MusicBrainz', `Parsed from page DOM — skipping API call`, 'ok');
    } else {
        appendLog('MusicBrainz', `DOM scrape incomplete — falling back to /ws/2 API`);
        const mb = await gmGet(`${MB_ORIGIN}/ws/2/release/${mbid}?inc=artists+media+url-rels+release-groups+labels&fmt=json`);
        appendLog('MusicBrainz', `status=${mb.status} ${mb.responseText.length}b in ${mb.ms}ms`);
        if (mb.ok) {
            try {
                const data = JSON.parse(mb.responseText);
                mbData = parseMbData(data);
                if (mbData) dataSource = 'api';
                else appendLog('MusicBrainz', `Missing artist/album in API payload`, 'error');
            } catch (e) { appendLog('MusicBrainz', `JSON parse failed: ${e.message}`, 'error'); }
        }
        if (!mbData) {
            const cached = mbDataGet(mbid);
            if (cached) {
                appendLog('MusicBrainz', `Falling back to cached release data (no fresh fetch this load)`, 'warn');
                mbData = cached;
                dataSource = 'cache';
            } else {
                appendLog('MusicBrainz', `Halted: no DOM, no API, no cache (status ${mb.status})`, 'error');
                return false;   // (#422) wrapper shows the halt state
            }
        }
    }
    // Persist DOM- and API-sourced records to the long-term cache so a later
    // MB 503 can still render. Don't re-persist when we're already inside the
    // cache-fallback branch.
    // #567 (majkinetor): "The Discogs master checkmark is always circled only on
    // Overview page and it mostly isn't on other tabs." His logs are decisive:
    //
    //   overview    Existing RG master: https://www.discogs.com/master/284062
    //   cover art   Existing RG master: none
    //
    // The release-group's Discogs master is read out of the page DOM, and only the
    // Overview tab renders it early enough (it appears twice there — once in the
    // body, once in the sidebar; every other tab has the sidebar copy alone). So on
    // the other tabs the parse can run before it exists, records null, and CACHES
    // that null — which is why pressing the refresh button does not help either.
    //
    // The release group is the authority on its own links, so ask it rather than
    // hoping the page has rendered. One cheap request, only when the DOM came up
    // empty, and never on the Overview path where the DOM already answered.
    if (!mbData.existing?.discogsMaster && mbData.releaseGroupMbid) {
        try {
            const rgRes = await gmGet(`${MB_ORIGIN}/ws/2/release-group/${mbData.releaseGroupMbid}?inc=url-rels&fmt=json`);
            const rgJson = rgRes && rgRes.status === 200 ? JSON.parse(rgRes.responseText) : null;
            const found = (rgJson?.relations || [])
                .map(r => r?.url?.resource)
                .find(u => u && /^https?:\/\/www\.discogs\.com\/(?:[a-z-]+\/)?master\/\d+/i.test(u));
            if (found) {
                mbData.existing = { ...(mbData.existing || {}), discogsMaster: found };
                appendLog('MusicBrainz', `RG Discogs master resolved from the API (the page DOM had none): ${found}`);
            }
        } catch (e) {
            appendLog('MusicBrainz', `RG master lookup failed — ${(e && e.message) || e}`, 'warn');
        }
    }

    if (dataSource !== 'cache') mbDataSet(mbid, mbData);

    // 2nd-line under the MusicBrainz source-info log: clickable link straight
    // to the release page. Convenient when the user opens the diagnostic log
    // from a different tab and wants to jump back to MB without re-typing.
    appendLog('MusicBrainz', `Release: <a href="${MB_ORIGIN}/release/${mbid}" target="_blank" rel="noopener" style="color:var(--mbu-accent-text);text-decoration:underline;">${MB_ORIGIN}/release/${mbid}</a>`);

    const { artist, album, mbTracks, releaseGroupMbid, isVariousArtists, existing, format, year, releaseLabel, barcode } = mbData;
    /* majkinetor: "still can't click first 2 rows in PC but only on initial load.
       If I click refresh, its there." This block used to sit ~70 lines further
       down, after the release-group lookup, the cache-upgrade pass and the
       Wikidata SPARQL — all network. The rows are wired here, so on a fresh load
       they were dead for as long as those took, which is precisely the window in
       which you look at a panel that just appeared. ↻ felt instant only because
       the rows were still wired from the previous run.

       It only ever needed the artist and the album, and both are on the line
       above, parsed from the page DOM with no request at all. */
    // Seed search fallback URLs. Each provider link starts pointed at the
    // provider's native search results — overridden to the resolved album
    // URL once a scan finds a confident match. The original search URL is
    // stashed on the anchor's dataset so right-click can re-open it even
    // after a positive match (convenient for cross-checking).
    const searchUrls = {
        spotify:  `https://open.spotify.com/search/${encodeURIComponent(`${artist} ${album}`)}`,
        discogs:  `https://www.discogs.com/search/?q=${encodeURIComponent(`${artist} ${album}`)}&type=release`,
        bandcamp: `https://bandcamp.com/search?q=${encodeURIComponent(`${artist} ${album}`)}&item_type=a`,
        deezer:   `https://www.deezer.com/search/${encodeURIComponent(`${artist} ${album}`)}`,
        apple:    `https://music.apple.com/us/search?term=${encodeURIComponent(`${artist} ${album}`)}`,
        tidal:    `https://tidal.com/search?q=${encodeURIComponent(`${artist} ${album}`)}`,
        qobuz:    `https://www.qobuz.com/us-en/search/albums/${encodeURIComponent(`${artist} ${album}`)}`,
        beatport: `https://www.beatport.com/search?q=${encodeURIComponent(`${artist} ${album}`)}`,
        volumo:   `https://volumo.com/releases?search=${encodeURIComponent(`${artist} ${album}`)}`,
        hdtracks: `https://www.hdtracks.com/#/search?q=${encodeURIComponent(`${artist} ${album}`)}`,
        ytmusic:  `https://music.youtube.com/search?q=${encodeURIComponent(`${artist} ${album}`)}`,
        amazonmusic: `https://music.amazon.com/search/${encodeURIComponent(`${artist} ${album}`)}`,
        soundcloud: `https://soundcloud.com/search/sets?q=${encodeURIComponent(`${artist} ${album}`)}`,
        audiomack: `https://audiomack.com/search?q=${encodeURIComponent(`${artist} ${album}`)}&tab=albums`,
    };
    for (const [p, u] of Object.entries(searchUrls)) {
        const a = document.getElementById(`mb-online-${p}`);
        if (!a) continue;
        a.href = u;
        a.dataset.searchUrl = u;
        // Right-click → open native search. Preserves the browser's own
        // copy-link affordance on middle-click / shift-click; only the
        // bare-right-click is intercepted.
        if (!a.dataset.pcContextMenuWired) {
            a.addEventListener('contextmenu', e => {
                e.preventDefault();
                const search = a.dataset.searchUrl;
                if (search) window.open(search, '_blank', 'noopener');
            });
            a.dataset.pcContextMenuWired = '1';
        }
        // Make the whole row clickable NOW, not when the scan reports — a pending
        // Discogs/Bandcamp row (they never fold into the compact strip) was dead
        // to clicks for the whole scan otherwise.
        wireRowOpen(p);
    }

    // Header subtitle: year · label · format (left-aligned), and the MB
    // track count right-aligned so it sits in the same column as the
    // platform vals below.
    setMetaCells('mb-mb-year', 'mb-mb-format', 'mb-mb-label', year, format, releaseLabel);
    const trkEl = document.getElementById('mb-mb-tracks');
    if (trkEl) trkEl.textContent = `${mbTracks}`;
    const nameEl = document.getElementById('mb-mb-name');
    if (nameEl) nameEl.href = `${MB_ORIGIN}/release/${mbid}`;
    appendLog('MusicBrainz', `Artist: "${artist}"${isVariousArtists ? ' (Various Artists — search by album only)' : ''}  Album: "${album}"  Tracks: ${mbTracks}  rg=${releaseGroupMbid || '(none)'}`);
    appendLog('MusicBrainz', `Header meta — year=${year || '?'}  format=${format || '?'}  label=${releaseLabel || '?'}  source=${dataSource}`);
    // #527 follow-up (majkinetor, live): this line used to hardcode only 5 of
    // the 11 providers (spotify/discogs/bandcamp/deezer/apple) — soundcloud
    // (among others) was silently left out of the summary even though
    // `existing.soundcloud` was populated and used later in the very same
    // run, which read as "MB has no existing rel" when it actually did.
    // Drive it off ALL_PROVIDERS so nothing gets silently omitted again.
    appendLog('MusicBrainz', `Existing rels — ${ALL_PROVIDERS.map(p => `${p}=${existing[p] ? 'YES' : 'no'}`).join('  ')}`);

    // Cache upgrade: if MB has acquired a URL rel matching a cached URL (the
    // user just added the URL via + and came back), promote the cached row's
    // source from search/Wikidata to "MB rels" so the circled icon shows
    // immediately on the cache short-circuit — without it the user has to
    // hit ↻ to see the circle, even though MB now considers it an
    // editor-added rel.
    //
    // …and the downgrade counterpart: if a cache entry claims source='MB rels'
    // but MB no longer has that URL relationship (or never did — possible
    // since the panel-self-contamination bug used to write 'MB rels' for
    // every platform whenever the user hit ↻), demote to 'search' so the
    // row uncircles and click-to-add re-enables. Without this, users who
    // hit a buggy build keep seeing every row as circled+unclickable until
    // they manually ↻ refresh.
    for (const p of ALL_PROVIDERS) {
        const cached = cacheGet(mbid, p);
        if (!cached?.url) continue;
        // #556: pcSameUrl, not === . MB rewrites URLs on insert, so an exact
        // comparison missed links that ARE on the release — the row stayed an
        // un-circled ✓ and the + button kept re-queueing a duplicate.
        if (pcSameUrl(existing[p], cached.url) && cached.source !== 'MB rels') {
            cacheSet(mbid, p, { ...cached, source: 'MB rels' });
            appendLog('MusicBrainz', `Cache upgrade: ${p} URL now in MB rels — source bumped to "MB rels"${existing[p] === cached.url ? '' : ` (MB spells it ${existing[p]})`}`, 'ok');
        } else if (!pcSameUrl(existing[p], cached.url) && cached.source === 'MB rels') {
            cacheSet(mbid, p, { ...cached, source: 'search' });
            appendLog('MusicBrainz', `Cache downgrade: ${p} URL no longer in MB rels (stale 'MB rels' tag) — source bumped to "search"`, 'warn');
        }
    }

    // Wikidata lookup — fires whenever we don't already have a positive Spotify
    // URL. A cached "no match" (url:null) doesn't block Wikidata: it's a cheap
    // independent data source curated by humans, and the cache may have been
    // written before Wikidata had this album indexed (or before the user
    // hit ↻ themselves).
    // Wikidata also curates Tidal (P4577) and Beatport (P11312) IDs, so run it
    // unless EVERY Wikidata-backed provider is already resolved. Beatport in
    // particular has no other reliable resolver (it's Cloudflare-walled), so
    // Wikidata is its primary path.
    const spotifyCache = cacheGet(mbid, 'spotify');
    const spotifyKnown = !!(existing.spotify || spotifyCache?.url);
    const tidalKnown    = !!(existing.tidal    || cacheGet(mbid, 'tidal')?.url);
    const beatportKnown = !!(existing.beatport || cacheGet(mbid, 'beatport')?.url);
    const tidalWanted    = providerEnabled('tidal')    && !tidalKnown;
    const beatportWanted = providerEnabled('beatport') && !beatportKnown;
    // Non-blocking: the lookup runs alongside the scans instead of in front of
    // them. Only a Wikidata-backed provider that could still USE the answer
    // waits for it (no MB link yet — and for Spotify, no cached URL, which it
    // prefers over Wikidata); every other provider starts straight away.
    let wdP = Promise.resolve(null);
    if (spotifyKnown && !tidalWanted && !beatportWanted) {
        appendLog('Wikidata', `skipped — Spotify/Tidal/Beatport already resolved`);
    } else {
        wdP = lookupWikidata(releaseGroupMbid, mbid).catch(e => { appendLog('Wikidata', `lookup error: ${e.message}`, 'warn'); return null; });
    }
    const wdFor = (p, field) => {
        if (existing[p] || (p === 'spotify' && spotifyCache?.url)) return Promise.resolve(null);
        return wdP.then(wd => wd?.[field] || null);
    };

    MB_BARCODE = barcode || null;   // (#182) for the barcode-mismatch indicator
    MB_FORMAT  = format  || null;   // (#182) for the format-confidence check
    const ctx = { artist, album, mbTracks, mbid, isVariousArtists, format, barcode, mbYear: year || null, existingDiscogsMaster: existing.discogsMaster || null };
    const tasks = [];
    if (providerEnabled('spotify')) tasks.push(wdFor('spotify', 'spotifyId').then(id => scanSpotify({ ...ctx, existingUrl: existing.spotify, wikidataSpotifyId: id })));
    if (providerEnabled('discogs')) tasks.push(scanDiscogs ({ ...ctx, existingUrl: existing.discogs  }));
    if (providerEnabled('bandcamp')) tasks.push(scanBandcamp({ ...ctx, existingUrl: existing.bandcamp }));
    if (providerEnabled('deezer')) tasks.push(scanDeezer  ({ ...ctx, existingUrl: existing.deezer   }));
    if (providerEnabled('apple')) tasks.push(wdFor('apple', 'appleId').then(id => scanApple({ ...ctx, existingUrl: existing.apple, wikidataAppleId: id })));
    if (providerEnabled('tidal')) tasks.push(wdFor('tidal', 'tidalId').then(id => scanTidal({ ...ctx, existingUrl: existing.tidal, wikidataTidalId: id })));
    if (providerEnabled('qobuz')) tasks.push(scanQobuz   ({ ...ctx, existingUrl: existing.qobuz    }));
    if (providerEnabled('beatport')) tasks.push(wdFor('beatport', 'beatportId').then(id => scanBeatport({ ...ctx, existingUrl: existing.beatport, wikidataBeatportId: id })));
    if (providerEnabled('volumo')) tasks.push(scanVolumo  ({ ...ctx, existingUrl: existing.volumo   }));
    if (providerEnabled('hdtracks')) tasks.push(scanHDtracks({ ...ctx, existingUrl: existing.hdtracks }));
    if (providerEnabled('ytmusic')) tasks.push(scanYtmusic({ ...ctx, existingUrl: existing.ytmusic }));
    if (providerEnabled('amazonmusic')) tasks.push(scanAmazon({ ...ctx, existingUrl: existing.amazonmusic }));
    if (providerEnabled('soundcloud')) tasks.push(scanSoundcloud({ ...ctx, existingUrl: existing.soundcloud }));
    if (providerEnabled('audiomack')) tasks.push(scanAudiomack({ ...ctx, existingUrl: existing.audiomack }));
    await Promise.allSettled(tasks);
    appendLog('System', 'All scans completed', 'ok');
}

// ↻ REFRESH button: clear cached URLs for this MBID, blank the rows, re-run.
document.getElementById('mb-refresh-btn').addEventListener('click', () => {
    appendLog('System', `Refresh requested — clearing cache for ${mbid}`, 'warn');
    cacheClear(mbid);
    resetRows();
    runScans();
});

// + INJECT button: collect every confirmed (✓) URL that ISN'T already in MB's
// url-rels, stash it under `pc:pending:<mbid>` in localStorage, and open the
// edit-relationships page in a new tab. The companion handler that runs on
// that page (same script, @match'd against /edit-relationships) reads the
// pending entry and dispatches each URL into MB's relationship editor.
// Small floating toast near a target element, auto-fades after ~1.5 s.
// Reused as inline feedback for the + button when there's nothing to do.
// The visible per-row anchor for flashInfo. In icon mode the text glyph (`ico-…`)
// is display:none, so anchoring a tooltip to it lands at the page's top-left corner
// (zero-rect). Use the brand favicon (`plat-…`) when icons are shown. (#182)
function rowAnchor(platform) {
    const panel = document.getElementById('mb-pc-panel');
    const iconMode = panel && panel.classList.contains('pc-icons-mode');
    return (iconMode ? document.getElementById(`plat-${platform}`) : document.getElementById(`ico-${platform}`))
        || document.getElementById(`plat-${platform}`) || document.getElementById(`ico-${platform}`)
        || document.getElementById(`row-${platform}`) || document.body;
}
function flashInfo(targetEl, text, bg = '#5B82B0') {
    document.getElementById('pc-flash-info')?.remove();
    let rect = targetEl.getBoundingClientRect();
    // a hidden anchor reports a zero rect → the tip would jump to the top-left corner;
    // fall back to the panel so it stays in view (#182)
    if (!rect.width && !rect.height) { const panel = document.getElementById('mb-pc-panel'); if (panel) rect = panel.getBoundingClientRect(); }
    const tip = document.createElement('div');
    tip.id = 'pc-flash-info';
    tip.textContent = text;
    tip.style.cssText = `position:absolute;left:${rect.left + window.scrollX}px;top:${rect.bottom + window.scrollY + 4}px;background:${bg};color:#FFF;padding:4px 8px;border-radius:3px;font-size:11px;font-family:sans-serif;white-space:nowrap;z-index:99999;pointer-events:none;box-shadow:0 2px 6px rgba(0,0,0,0.2);transition:opacity .3s;`;
    document.body.appendChild(tip);
    setTimeout(() => { tip.style.opacity = '0'; }, 1500);
    setTimeout(() => { tip.remove(); }, 1850);
}

// Single-row click-to-add (icon click) — queues just one platform's URL and
// opens /release/<mbid>/edit. The bulk + button at the bottom still queues
// every ✓ row at once.
// (#182) "Check barcodes for link confidence" gates the + / ↗ actions. Two modes:
//   'exists' — withhold only links whose barcode is KNOWN and DIFFERS from MB's.
//   'strict' — also withhold links we couldn't barcode-confirm (provider exposes
//              no UPC, e.g. Apple/Spotify) — i.e. only barcode-confirmed links pass.
// On by default in "if they exist" mode; the subtle mismatch bar still shows known mismatches regardless.
function barcodeBlocks(platform) {
    if (!GM_getValue('pc:respect-barcode', true)) return false;
    const c = cacheGet(mbid, platform);
    if (!c || !c.url) return false;                // no found URL → nothing to withhold
    const strict = GM_getValue('pc:barcode-mode', 'exists') === 'strict';
    // MB has no barcode (missing OR [none]) → nothing here can be barcode-confirmed.
    // strict: withhold (only confirmed links pass); if-they-exist: allow. (#206 chaban-mb —
    // previously returned false unconditionally, so strict mode silently ignored the absence.)
    if (!MB_BARCODE) return strict;
    if (c.barcode) return normBarcode(c.barcode) !== normBarcode(MB_BARCODE);   // known → block iff differs
    return strict;                                 // provider exposes no barcode → block only in strict mode
}
// (#182) "Use format for link confidence" gates + / ↗ when the matched edition's
// format is incompatible with the MB release format (a different medium is a
// different MB release). Mirrors the barcode modes:
//   'exists' — withhold only when the remote format is KNOWN and incompatible.
//   'strict' — also withhold links whose format can't be determined.
// Digital-only platforms count as Digital (so streaming links pass on a digital
// release, withheld on a physical one); Bandcamp/Discogs use their parsed
// format. Off by default.
function formatBlocks(platform) {
    if (!GM_getValue('pc:respect-format', true)) return false;
    const mbCats = formatCategories(MB_FORMAT);
    if (mbCats.size === 0) return false;                       // MB format unknown → can't judge
    const c = cacheGet(mbid, platform);
    if (!c || !c.url) return false;
    const remote = remoteFormatCategories(platform, c.format);
    if (remote.size === 0) return GM_getValue('pc:format-mode', 'exists') === 'strict';  // unknown → block only in strict
    return ![...remote].some(x => mbCats.has(x));              // known → block iff no shared category
}
// #464: how the release editor opens for a queued add.
//   - foreground: honors the "Add links in a new tab" setting (default on) — off
//     navigates the current tab instead of spawning one chaban has to close by hand.
//   - background (right-click): mirrors Credit Hoarder / Apollo Editor — an inactive
//     GM tab injects the URL(s), auto-submits, and closes itself; runInjectHelper's
//     autoCommit branch does the submit+close, we just wait for its postMessage here.
//     Only release edits support this (release-group has no plain landing @match to
//     detect the redirect on), so callers must pass a release mbid.
function openReleaseEditTab(mbid_, { background = false } = {}) {
    const url = `${MB_ORIGIN}/release/${mbid_}/edit`;
    if (background) {
        if (typeof GM_openInTab !== 'function' || !PC_CHANNEL) {
            appendLog('System', `Background add needs GM_openInTab — opening in a normal tab instead`, 'warn');
            window.open(url, '_blank');
            return;
        }
        // #556: start this run's timeline clean, so the Log shows THIS background
        // add rather than every one since the page loaded.
        pcMarkReset();
        const bgTab = GM_openInTab(`${url}#pc-autocommit`, { active: false, insert: true });
        const onCommitted = (e) => {
            if (!e.data || e.data.type !== 'pc-edit-committed' || e.data.mbid !== mbid_) return;
            PC_CHANNEL.removeEventListener('message', onCommitted);
            try { if (bgTab && typeof bgTab.close === 'function') bgTab.close(); } catch (x) {}
            appendLog('System', `Background add committed for ${mbid_} — refreshing`, 'ok');
            location.reload();
        };
        PC_CHANNEL.addEventListener('message', onCommitted);
        return;
    }
    if (GM_getValue('pc:open-new-tab', true)) {
        const w = window.open(url, '_blank');
        if (!w) appendLog('System', `window.open returned null — popup blocked?`, 'error');
    } else {
        location.href = url;
    }
}
// #559: the same three steps for the release-GROUP editor, which is where the
// Discogs master URL goes. Kept as its own function rather than a parameter on
// openReleaseEditTab: the entity path, the channel message and the "open in this
// tab instead" rule all differ, and folding them together made every line a
// conditional.
function openRgEditTab(rgMbid, { background = false, sameTabAllowed = false } = {}) {
    const url = `${MB_ORIGIN}/release-group/${rgMbid}/edit`;
    if (background) {
        if (typeof GM_openInTab !== 'function' || !PC_CHANNEL) {
            appendLog('System', `Background master add needs GM_openInTab — opening in a normal tab instead`, 'warn');
            window.open(url, '_blank');
            return;
        }
        // #556: start this run's timeline clean, so the Log shows THIS background
        // add rather than every one since the page loaded.
        pcMarkReset();
        const bgTab = GM_openInTab(`${url}#pc-autocommit`, { active: false, insert: true });
        const onCommitted = (e) => {
            if (!e.data || e.data.type !== 'pc-rg-edit-committed' || e.data.mbid !== rgMbid) return;
            PC_CHANNEL.removeEventListener('message', onCommitted);
            try { if (bgTab && typeof bgTab.close === 'function') bgTab.close(); } catch (x) {}
            appendLog('System', `Background master add committed for release-group ${rgMbid}`, 'ok');
        };
        PC_CHANNEL.addEventListener('message', onCommitted);
        return;
    }
    // Same-tab navigation only when this is the ONLY tab being opened by this
    // click — the release bucket may already be claiming the current tab.
    if (sameTabAllowed && !GM_getValue('pc:open-new-tab', true)) location.href = url;
    else window.open(url, '_blank');
}
// Test hook only (#464) — no behavior change; lets verify-464.mjs exercise the
// tab-open decision + background-commit channel without driving the full row UI
// (which would mean faking a live ✓ match render for no added coverage).
if (mbuTestHooks()) window.__pcTest464 = { openReleaseEditTab, openRgEditTab, PC_CHANNEL };
// #556 test hook — URL identity + the inject helper, so the cache-staleness and
// payload-preservation paths can be driven without a live ✓ match render.
// #627 test hook — the amp-api pieces, driven against the live API without a row render
if (mbuTestHooks()) window.__pcTest627 = { appleAmp, appleToken, appleAlbumMeta, applePickByUpc, appleStorefront, appleEach, appleAllStorefronts, APPLE_SHORTLIST, setAppleToken: t => { _appleTok = t; } };
if (mbuTestHooks()) window.__pcTest639 = { ytmCall, ytmAlbumResults, fetchYtmAlbum, ytmAlbumIdOf, ytmAlbumLabel, ytmCreditSections, YTM_ALBUMS_FILTER };
if (mbuTestHooks()) window.__pcTest644 = { amzCall, amzAlbumResults, fetchAmzAlbum };
if (mbuTestHooks()) window.__pcTest664 = { audiomackGet, fetchAudiomack, audiomackRef, scanAudiomack, cacheGet };
if (mbuTestHooks()) window.__pcTest556 = { pcUrlKey, pcSameUrl, pcIsVerifyInterstitial, injectInto, runInjectHelper, cacheGet, cacheSet, mbDataGet };

// Why link confidence withholds this platform's link, for the edit note (#641); null when it doesn't.
function pcWithheldWhy(p) {
    if (barcodeBlocks(p)) return cacheGet(mbid, p)?.barcode ? `barcode ${cacheGet(mbid, p).barcode} differs from the release's` : 'barcode not confirmed';
    if (formatBlocks(p)) return "format differs from the release's";
    return null;
}
// force (#641, middle click): add it even when barcode/format confidence would withhold it.
function addSingleUrl(platform, background, force) {
    const cached = cacheGet(mbid, platform);
    if (!cached?.url) {
        appendLog('System', `Inject (click): no cached URL for ${platform} — abort`, 'warn');
        return;
    }
    if (force && (barcodeBlocks(platform) || formatBlocks(platform))) {
        appendLog('System', `Inject (middle-click): ${platform} is withheld by barcode/format confidence — added anyway, as asked`, 'warn');
    } else if (barcodeBlocks(platform)) {
        const why = cacheGet(mbid, platform)?.barcode ? 'barcode differs from MB' : 'barcode not confirmed';
        appendLog('System', `Inject (click): ${platform} ${why} — blocked (barcode-confidence is on)`, 'warn');
        flashInfo(rowAnchor(platform), cacheGet(mbid, platform)?.barcode ? 'Different barcode — not added' : 'Barcode not confirmed — not added');
        return;
    }
    if (formatBlocks(platform)) {
        appendLog('System', `Inject (click): ${platform} format incompatible with MB (${MB_FORMAT}) — blocked (format-confidence is on)`, 'warn');
        flashInfo(rowAnchor(platform), 'Format mismatch — not added');
        return;
    }
    localStorage.setItem(`pc:pending:${mbid}`, JSON.stringify({ [platform]: cached.url }));
    // #641: a forced add is recorded for the edit note; any other add clears an old record
    const forcedWhy = force ? pcWithheldWhy(platform) : null;
    if (forcedWhy) localStorage.setItem(`pc:forced:${mbid}`, JSON.stringify({ [cached.url]: forcedWhy })); else localStorage.removeItem(`pc:forced:${mbid}`);
    appendLog('System', `Inject (${force ? 'forced, ' : ''}${background ? 'background' : 'click'}): queued ${platform} URL — opening release editor`, 'ok');
    openReleaseEditTab(mbid, { background });
}

// Click-to-add on the Discogs master slot — queues the master URL for the
// release-group's edit page (different target than the release URLs). No
// background variant: release-group has no plain landing page to detect commit on.
function addMasterUrl(masterUrl) {
    const mb = mbDataGet(mbid);
    const rgMbid = mb?.releaseGroupMbid;
    if (!rgMbid) {
        appendLog('System', `Master add: no release-group MBID known for this release`, 'error');
        return;
    }
    localStorage.setItem(`pc:pending:rg:${rgMbid}`, JSON.stringify({ 'discogs-master': masterUrl }));
    appendLog('System', `Inject (master): queued ${masterUrl} for release-group ${rgMbid}`, 'ok');
    // #559: same opener as the + button's release-group bucket, so there is one
    // place that knows how to reach the release-group editor. Behaviour here is
    // unchanged — this path is a plain click on the master icon, never background,
    // and it is always the only tab being opened.
    openRgEditTab(rgMbid, { background: false, sameTabAllowed: true });
}

// force (#641, middle click on +): barcode/format confidence doesn't withhold anything.
async function runInjectBtn(e, background, force) {
    const triggerBtn = e.currentTarget;
    // Bucket 1: URLs going onto the release.
    const pendingRelease = {};
    let barcodeBlocked = 0;
    let formatBlocked = 0;
    let alreadyInMb = 0;
    const forcedUrls = {};   // #641: { url: reason } of the withheld links a middle click adds anyway
    // #556: the live rels parsed from THIS page load are the authority on what the
    // release already carries — the cached `source` is only a hint, and a stale one
    // after a previous add. Queueing a link MusicBrainz already has is a no-op in
    // the editor that leaves the tab sitting open with nothing to submit.
    const liveExisting = (mbDataGet(mbid) || {}).existing || {};
    for (const p of PROVIDER_ORDER) {
        if (!providerEnabled(p)) continue;   // #255 disabled in Settings — never queue its (possibly stale) cache
        const cached = cacheGet(mbid, p);
        if (!cached?.url) continue;
        if (cached.source === 'MB rels') continue;
        if (pcSameUrl(liveExisting[p], cached.url)) {
            alreadyInMb++;
            appendLog('System', `Inject: ${p} is already on the release (MB has ${liveExisting[p]}) — skipped`, 'warn');
            continue;
        }
        const icoText = document.getElementById(`ico-${p}`)?.textContent?.trim();
        if (icoText !== '✓') continue;
        if (force && (barcodeBlocks(p) || formatBlocks(p))) {
            forcedUrls[cached.url] = pcWithheldWhy(p);
            appendLog('System', `Inject (middle-click): ${p} is withheld by barcode/format confidence — added anyway, as asked`, 'warn');
        }
        else if (barcodeBlocks(p)) { barcodeBlocked++; appendLog('System', `Inject: ${p} ${cached.barcode ? 'barcode differs from MB' : 'barcode not confirmed'} — skipped (barcode-confidence on)`, 'warn'); continue; }
        else if (formatBlocks(p)) { formatBlocked++; appendLog('System', `Inject: ${p} format incompatible with MB (${MB_FORMAT}) — skipped (format-confidence on)`, 'warn'); continue; }
        pendingRelease[p] = cached.url;
    }

    // Bucket 2: Discogs master URL → goes onto the release-group, not the
    // release. Skip if MB already has it: check `existing.discogsMaster`
    // which parseMbFromDom / parseMbData populated from the release page
    // DOM (any /discogs.com/master/<id> anchor visible on the page). No
    // extra /ws/2 round-trip.
    const pendingRG = {};
    const discogsCache = cacheGet(mbid, 'discogs');
    const masterUrl    = discogsCache?.masterUrl;
    const mbCached     = mbDataGet(mbid);
    const rgMbid       = mbCached?.releaseGroupMbid;
    const existingMaster = mbCached?.existing?.discogsMaster;
    // #255 disabled provider → skip. #256 only queue the master when the Discogs RELEASE is a
    // confirmed match (✓): if text/Brave search landed on an unrelated album, its master isn't
    // this release-group's master. Barcode/format withholding deliberately does NOT apply here
    // (#416): a master is the whole release GROUP — it spans every edition's format and
    // barcode, so a different-pressing Discogs hit still shares this album's master.
    const discogsConfirmed = providerEnabled('discogs')
        && document.getElementById('ico-discogs')?.textContent?.trim() === '✓';
    if (!discogsConfirmed) {
        if (masterUrl) appendLog('System', `Inject: Discogs release isn't a confirmed match — not queueing master ${masterUrl}`, 'warn');
    } else if (masterUrl && rgMbid && !existingMaster) {
        pendingRG['discogs-master'] = masterUrl;
        appendLog('System', `Inject: queueing Discogs master ${masterUrl} for release-group ${rgMbid}`);
    } else if (masterUrl && existingMaster) {
        appendLog('System', `Inject: Discogs master already in MB rels (${existingMaster}) — skipping`);
    }

    const releaseCount = Object.keys(pendingRelease).length;
    const rgCount      = Object.keys(pendingRG).length;
    if (releaseCount + rgCount === 0) {
        // Explain WHY nothing is queued instead of the misleading "all OK URLs already in MB" (#117):
        //   • unmatched — a link WAS found but isn't a confirmed match (✓); shown as ~ / ? because its
        //     track count / format differs from this release, so it's NOT added (and is NOT in MB)
        //   • inMb      — a confirmed match exists but is already a relationship on the release
        let unmatched = 0, inMb = 0;
        for (const p of PROVIDER_ORDER) {
            if (!providerEnabled(p)) continue;   // #255 disabled providers don't factor into "why nothing queued"
            const c = cacheGet(mbid, p);
            if (!c?.url) continue;
            // #556: count a link the page already carries as "in MB" even when the
            // cached source still says 'search' — otherwise the explanation read
            // "no new links found" for a release whose links were all added a
            // moment ago, which is the opposite of what happened.
            if (c.source === 'MB rels' || pcSameUrl(liveExisting[p], c.url)) inMb++; else unmatched++;
        }
        const msg = unmatched > 0
            ? `Inject: nothing to add — ${unmatched} found link(s) aren't a confirmed match (✓) for this release (track count / format differs)${inMb ? `; ${inMb} already in MB` : ''}`
            : inMb > 0
                ? `Inject: nothing to add — all confirmed links are already in MB`
                : `Inject: nothing to add — no new links found`;
        const blockedNote = [barcodeBlocked > 0 ? `${barcodeBlocked} blocked by barcode mismatch` : '', formatBlocked > 0 ? `${formatBlocked} blocked by format mismatch` : '', alreadyInMb > 0 ? `${alreadyInMb} already on the release` : ''].filter(Boolean).join('; ');
        appendLog('System', blockedNote ? msg + `; ${blockedNote}` : msg, 'warn');
        flashInfo(triggerBtn, barcodeBlocked > 0 ? `${barcodeBlocked} blocked — different barcode` : formatBlocked > 0 ? `${formatBlocked} blocked — format mismatch` : unmatched > 0 ? "Found links don't match" : inMb > 0 ? 'Already in MB' : 'Nothing to add');
        return;
    }

    if (releaseCount > 0) {
        localStorage.setItem(`pc:pending:${mbid}`, JSON.stringify(pendingRelease));
        if (Object.keys(forcedUrls).length) localStorage.setItem(`pc:forced:${mbid}`, JSON.stringify(forcedUrls)); else localStorage.removeItem(`pc:forced:${mbid}`);
        appendLog('System', `Inject (${background ? 'background' : 'click'}): queued ${releaseCount} release URL(s) — opening release editor`, 'ok');
        openReleaseEditTab(mbid, { background });
    }
    if (rgCount > 0 && rgMbid) {
        localStorage.setItem(`pc:pending:rg:${rgMbid}`, JSON.stringify(pendingRG));
        // #559: the master now takes the background route too, instead of the
        // "background add doesn't cover the release-group master URL" tab it used
        // to leave open and focused.
        appendLog('System', `Inject (${background ? 'background' : 'click'}): queued ${rgCount} release-group URL(s) — opening release-group editor`, 'ok');
        openRgEditTab(rgMbid, { background, sameTabAllowed: releaseCount === 0 });
    }
}
document.getElementById('mb-inject-btn').addEventListener('click', (e) => runInjectBtn(e, e.altKey && pcBgKey(e), e.altKey));   // #653/#641: Alt+click = middle click; Ctrl+Alt: in the background
document.getElementById('mb-inject-btn').addEventListener('contextmenu', (e) => { e.preventDefault(); runInjectBtn(e, true); });
document.getElementById('mb-inject-btn').addEventListener('mousedown', (e) => { if (e.button === 1) e.preventDefault(); });
document.getElementById('mb-inject-btn').addEventListener('auxclick', (e) => { if (e.button !== 1) return; e.preventDefault(); runInjectBtn(e, pcBgKey(e), true); });   // #641: Ctrl+middle: in the background

// "↗" — open found platform pages that are NOT already in MB (non-circled links,
// source != 'MB rels') in their own new tabs. Circled = already an MB relationship.
document.getElementById('mb-openall-btn').addEventListener('click', (e) => {
    const urls = [];
    for (const p of PROVIDER_ORDER) {
        if (!providerEnabled(p)) continue;   // #255 disabled in Settings — don't open its (possibly stale) cache
        const cached = cacheGet(mbid, p);
        if (!cached?.url) continue;
        if (cached.source === 'MB rels') continue;   // circled — already in MB, skip
        // Only confirmed matches (✓). Skip '~' (track-count mismatch) and '?'
        // (found-but-unverifiable, e.g. Beatport) — same bar as the + inject button.
        if (document.getElementById(`ico-${p}`)?.textContent?.trim() !== '✓') continue;
        if (barcodeBlocks(p)) continue;   // (#182) barcode-confidence on + mismatch
        if (formatBlocks(p)) continue;    // (#182) format-confidence on + incompatible
        urls.push(cached.url);
    }
    // Discogs master: only if found and not already on the release-group (non-circled)
    const masterUrl = cacheGet(mbid, 'discogs')?.masterUrl;
    const existingMaster = mbDataGet(mbid)?.existing?.discogsMaster;
    // #255 skip if disabled; #256 only when the Discogs release is a confirmed match
    const discogsConfirmed = providerEnabled('discogs')
        && document.getElementById('ico-discogs')?.textContent?.trim() === '✓'
        && !barcodeBlocks('discogs') && !formatBlocks('discogs');
    if (discogsConfirmed && masterUrl && !existingMaster) urls.push(masterUrl);
    const uniq = [...new Set(urls)];
    if (!uniq.length) {
        appendLog('System', 'Open all: nothing new — all found links are already in MB', 'warn');
        flashInfo(e.currentTarget, 'Nothing new');
        return;
    }
    appendLog('System', `Open all: opening ${uniq.length} non-circled link(s) in new tabs`, 'ok');
    uniq.forEach(u => window.open(u, '_blank', 'noopener'));
    flashInfo(e.currentTarget, `Opened ${uniq.length}`);
});

runScans();

})();