优化，现有bug处理

Cursor/hide viewer admin UI

$null

@@ -0,0 +1,2 @@
+'Get-Content' is not recognized as an internal or external command,
+operable program or batch file.

.github/workflows/Auto-docker-publish.yml

@@ -115,7 +115,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - name: Install
@@ -196,8 +196,12 @@ jobs:
           path: web/dist
       - name: Build binary
         run: |
+          LDFLAGS="-s -w -X main.version=${{ needs.build-image.outputs.release_tag }}"
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            LDFLAGS="$LDFLAGS -H=windowsgui"
+          fi
           CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
-            go build -trimpath -ldflags="-s -w -X main.version=${{ needs.build-image.outputs.release_tag }}" \
+            go build -trimpath -ldflags="$LDFLAGS" \
             -o "dist/mebox-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.ext }}" ./cmd/server
       - name: Package
         run: |

.github/workflows/beta-build.yml

@@ -48,7 +48,7 @@ jobs:
       # before the Go toolchain touches the web package.
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - name: Build SPA
@@ -77,7 +77,7 @@ jobs:
       - name: Build linux/arm64
         run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags="-s -w -X main.version=${{ steps.version.outputs.full_version }}" -o dist/mebox-beta-linux-arm64 ./cmd/server
       - name: Build windows/amd64
-        run: CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-s -w -X main.version=${{ steps.version.outputs.full_version }}" -o dist/mebox-beta-windows-amd64.exe ./cmd/server
+        run: CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-s -w -H=windowsgui -X main.version=${{ steps.version.outputs.full_version }}" -o dist/mebox-beta-windows-amd64.exe ./cmd/server
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
@@ -130,4 +130,4 @@ jobs:
           build-args: |
             VERSION=${{ steps.version.outputs.full_version }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       # before the Go toolchain touches the `web` package.
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - name: Build SPA
@@ -51,7 +51,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
 

.nvmrc

@@ -0,0 +1 @@
+20.19.0

Dockerfile

@@ -2,7 +2,7 @@
 # =============================================================================
 # Multi-architecture build for MeBox.
 #
-# Stage 1 (frontend) :  Node 20  -> static SPA bundle
+# Stage 1 (frontend) :  Node 20.19+ -> static SPA bundle
 # Stage 2 (backend)  :  Go 1.25  -> single static binary (CGO_ENABLED=0)
 # Stage 3 (runtime)  :  Alpine 3.23 -> ffmpeg + tzdata + non-root user
 #
@@ -15,7 +15,7 @@
 # =============================================================================
 
 # ---- Stage 1: frontend (always build on the host architecture) -------------
-FROM --platform=$BUILDPLATFORM node:20-alpine AS frontend
+FROM --platform=$BUILDPLATFORM node:20.19-alpine AS frontend
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
 WORKDIR /app/web
 COPY web/package*.json ./

README.md

@@ -199,6 +199,11 @@ environment:
 **硬链接失败（cross-device link）？**  
 硬链接要求源与目标在同一文件系统/子卷；跨盘、跨 btrfs 子卷或网盘挂载时请改用复制或软链接。
 
+**日志保留时间太短？**
+
+默认应用日志为 `20MB x 5`，容器 stdout 日志为 `20m x 3`。排障时可在 compose 中调大
+`MEBOX_LOGGING_MAX_SIZE_MB`、`MEBOX_LOGGING_MAX_BACKUPS` 与服务的 `logging.options.max-size/max-file`。
+
 **第三方播放器连不上？**  
 确认地址为 `http://IP:18080`，使用 MeBox 用户账号；反代部署需正确配置外部 URL 与 HTTPS 头。
 
@@ -207,6 +212,7 @@ environment:
 ## 开发构建
 
 后端通过 `go:embed` 嵌入 `web/dist`，**编译前必须先构建前端**。
+前端构建要求 Node.js `20.19+` 或 `22.12+`。
 
 ```bash
 npm --prefix web ci
@@ -219,6 +225,14 @@ npm --prefix web run dev     # http://127.0.0.1:3000
 
 CI 会在 Release 中提供 Windows / Linux / macOS 的 amd64、arm64 单文件可执行程序。
 
+Windows 本地打包：
+
+```powershell
+.\scripts\build-windows.ps1 -Version dev
+```
+
+Windows 可执行程序使用项目 Logo，不显示控制台窗口；启动后会常驻系统托盘。托盘菜单可打开 MeBox、切换开机自启、查看日志、重启或退出。
+
 ---
 
 ## 鸣谢

README_EN.md

@@ -199,6 +199,14 @@ npm --prefix web run dev
 
 Release builds ship single-file binaries for Windows, Linux, and macOS on amd64 and arm64.
 
+Build the Windows executable locally:
+
+```powershell
+.\scripts\build-windows.ps1 -Version dev
+```
+
+The Windows executable uses the project logo and runs without a console window. It stays in the notification area, with menu actions for opening MeBox, toggling auto-start, viewing logs, restarting, and exiting.
+
 ---
 
 ## Acknowledgements

cmd/server/application.go

@@ -0,0 +1,197 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/truewhile/MeBox/internal/config"
+	"github.com/truewhile/MeBox/internal/database"
+	"github.com/truewhile/MeBox/internal/helper"
+	"github.com/truewhile/MeBox/internal/repository"
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+// application owns the long-running MeBox server and all resources created
+// during startup. Platform entry points decide how the application is
+// controlled: a console signal loop or a Windows notification-area icon.
+type application struct {
+	cfg              *config.Config
+	logger           *zap.Logger
+	embyCompatLogger *zap.Logger
+	serverManager    *serverManager
+	services         *service.Container
+
+	closeMu     sync.Mutex
+	closeFuncs  []func()
+	shutdown    sync.Once
+	shutdownErr error
+}
+
+func newApplication() (*application, error) {
+	cfg, err := config.Load()
+	if err != nil {
+		return nil, fmt.Errorf("config load failed: %w", err)
+	}
+
+	logger, closeLogger, err := newLoggerWithCloser(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("logger init failed: %w", err)
+	}
+
+	app := &application{
+		cfg:        cfg,
+		logger:     logger,
+		closeFuncs: []func(){closeLogger},
+	}
+	if err := app.start(); err != nil {
+		app.closeLoggers()
+		return nil, err
+	}
+	return app, nil
+}
+
+func (a *application) start() error {
+	embyCompatLogger, closeEmbyCompatLogger, err := newEmbyCompatLogger(a.cfg)
+	if err != nil {
+		a.logger.Error("Emby compatibility logger init failed", zap.Error(err))
+		return fmt.Errorf("Emby compatibility logger init failed: %w", err)
+	}
+	a.embyCompatLogger = embyCompatLogger
+	a.addCloser(closeEmbyCompatLogger)
+
+	appVersion := effectiveVersion(version)
+	a.logger.Info("starting MeBox",
+		zap.String("version", appVersion),
+		zap.Int("port", a.cfg.App.Port),
+		zap.String("data_dir", a.cfg.App.DataDir),
+		zap.String("emby_compat_log", embyCompatLogPath(a.cfg)),
+	)
+
+	for _, dir := range []string{a.cfg.App.DataDir, a.cfg.Cache.CacheDir} {
+		if err := os.MkdirAll(dir, 0o750); err != nil {
+			a.logger.Error("create dir failed", zap.String("dir", dir), zap.Error(err))
+			return fmt.Errorf("create dir %s failed: %w", dir, err)
+		}
+	}
+
+	db, err := database.Open(a.cfg, a.logger)
+	if err != nil {
+		a.logger.Error("database open failed", zap.Error(err))
+		return fmt.Errorf("database open failed: %w", err)
+	}
+	if err := waitForDatabase(db, a.logger); err != nil {
+		a.logger.Error("database not ready", zap.Error(err))
+		return fmt.Errorf("database not ready: %w", err)
+	}
+	if err := database.AutoMigrate(db); err != nil {
+		a.logger.Error("auto-migrate failed", zap.Error(err))
+		return fmt.Errorf("auto-migrate failed: %w", err)
+	}
+	if err := database.MigrateSQLiteToCurrentIfNeeded(a.cfg, db, a.logger); err != nil {
+		a.logger.Error("sqlite to postgres migration failed", zap.Error(err))
+		return fmt.Errorf("sqlite to postgres migration failed: %w", err)
+	}
+
+	repos := repository.New(db)
+	service.ApplyRuntimeSettings(context.Background(), a.cfg, repos, a.logger)
+	applyCPUThreadLimit(a.cfg, a.logger)
+	a.services = service.NewWithVersion(a.cfg, a.logger, repos, appVersion)
+
+	// 一次性清洗历史脏数据: 老版本把单集 episode id / 单集名写进整剧字段, 导致
+	// 同一部剧被拆成多张单集卡。清空被污染的字段并重置为 pending(借后续重刮修正)。
+	if cleaned, err := a.services.NormalizePollutedEpisodeMetadata(context.Background()); err != nil {
+		a.logger.Warn("polluted episode metadata cleanup failed", zap.Error(err))
+	} else if cleaned > 0 {
+		a.logger.Info("polluted episode metadata cleanup completed", zap.Int("media_count", cleaned))
+	}
+
+	if err := a.services.Auth.SeedAdmin(context.Background()); err != nil {
+		a.logger.Warn("seed admin failed", zap.Error(err))
+	}
+
+	router := buildRouter(a.cfg, a.logger, a.embyCompatLogger, a.services)
+	a.serverManager = newServerManager(a.cfg, a.logger, router)
+	a.services.ReloadHTTPServer = a.serverManager.Reload
+	if err := a.serverManager.Start(); err != nil {
+		a.logger.Error("listen failed", zap.Error(err))
+		return fmt.Errorf("listen failed: %w", err)
+	}
+
+	go func() {
+		scheme := "http"
+		if a.cfg.App.HTTPSEnabled {
+			scheme = "https"
+		}
+		if publicIP := getPublicIP(3 * time.Second); publicIP != "" {
+			a.logger.Info("server public endpoint",
+				zap.String("public", fmt.Sprintf("%s://%s:%d", scheme, publicIP, a.cfg.App.Port)),
+			)
+		}
+	}()
+	helper.Go(a.logger, "services.boot", a.services.Boot)
+	return nil
+}
+
+// Shutdown is idempotent and safe to call from both the tray handler and the
+// systray exit callback.
+func (a *application) Shutdown() error {
+	a.shutdown.Do(func() {
+		a.logger.Info("shutdown requested")
+
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		if a.serverManager != nil {
+			if err := a.serverManager.Shutdown(ctx); err != nil {
+				a.shutdownErr = err
+				a.logger.Error("graceful shutdown failed", zap.Error(err))
+			}
+		}
+		cancel()
+
+		if a.services != nil {
+			a.services.Close()
+		}
+		a.logger.Info("MeBox stopped")
+		_ = a.logger.Sync()
+		if a.embyCompatLogger != nil {
+			_ = a.embyCompatLogger.Sync()
+		}
+		a.closeLoggers()
+	})
+	return a.shutdownErr
+}
+
+func (a *application) addCloser(fn func()) {
+	if fn == nil {
+		return
+	}
+	a.closeMu.Lock()
+	a.closeFuncs = append(a.closeFuncs, fn)
+	a.closeMu.Unlock()
+}
+
+func (a *application) closeLoggers() {
+	a.closeMu.Lock()
+	closers := append([]func(){}, a.closeFuncs...)
+	a.closeFuncs = nil
+	a.closeMu.Unlock()
+
+	for i := len(closers) - 1; i >= 0; i-- {
+		closers[i]()
+	}
+}
+
+func (a *application) localURL() string {
+	config.RuntimeMu.RLock()
+	scheme := "http"
+	if a.cfg.App.HTTPSEnabled {
+		scheme = "https"
+	}
+	port := a.cfg.App.Port
+	config.RuntimeMu.RUnlock()
+	return fmt.Sprintf("%s://127.0.0.1:%d", scheme, port)
+}

cmd/server/main.go

@@ -11,21 +11,8 @@
 package main
 
 import (
-	"context"
-	"fmt"
 	"os"
-	"os/signal"
 	"strings"
-	"syscall"
-	"time"
-
-	"go.uber.org/zap"
-
-	"github.com/truewhile/MeBox/internal/config"
-	"github.com/truewhile/MeBox/internal/database"
-	"github.com/truewhile/MeBox/internal/helper"
-	"github.com/truewhile/MeBox/internal/repository"
-	"github.com/truewhile/MeBox/internal/service"
 )
 
 // version is overwritten at build time via -ldflags="-X main.version=...".
@@ -46,105 +33,5 @@ func effectiveVersion(buildVersion string) string {
 }
 
 func main() {
-	cfg, err := config.Load()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "config load failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	logger, err := newLogger(cfg)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "logger init failed: %v\n", err)
-		os.Exit(1)
-	}
-	defer func() { _ = logger.Sync() }()
-
-	embyCompatLogger, closeEmbyCompatLogger, err := newEmbyCompatLogger(cfg)
-	if err != nil {
-		logger.Fatal("Emby compatibility logger init failed", zap.Error(err))
-	}
-	defer func() {
-		_ = embyCompatLogger.Sync()
-		closeEmbyCompatLogger()
-	}()
-
-	appVersion := effectiveVersion(version)
-	logger.Info("starting MeBox",
-		zap.String("version", appVersion),
-		zap.Int("port", cfg.App.Port),
-		zap.String("data_dir", cfg.App.DataDir),
-		zap.String("emby_compat_log", embyCompatLogPath(cfg)),
-	)
-
-	// Ensure data / cache / web dirs exist.
-	for _, d := range []string{cfg.App.DataDir, cfg.Cache.CacheDir} {
-		if err := os.MkdirAll(d, 0o750); err != nil {
-			logger.Fatal("create dir failed", zap.String("dir", d), zap.Error(err))
-		}
-	}
-
-	db, err := database.Open(cfg, logger)
-	if err != nil {
-		logger.Fatal("database open failed", zap.Error(err))
-	}
-	if err := waitForDatabase(db, logger); err != nil {
-		logger.Fatal("database not ready", zap.Error(err))
-	}
-	if err := database.AutoMigrate(db); err != nil {
-		logger.Fatal("auto-migrate failed", zap.Error(err))
-	}
-	if err := database.MigrateSQLiteToCurrentIfNeeded(cfg, db, logger); err != nil {
-		logger.Fatal("sqlite to postgres migration failed", zap.Error(err))
-	}
-
-	repos := repository.New(db)
-	service.ApplyRuntimeSettings(context.Background(), cfg, repos, logger)
-	applyCPUThreadLimit(cfg, logger)
-	services := service.NewWithVersion(cfg, logger, repos, appVersion)
-
-	// 一次性清洗历史脏数据: 老版本把单集 episode id / 单集名写进整剧字段, 导致
-	// 同一部剧被拆成多张单集卡。清空被污染的字段并重置为 pending(借后续重刮修正)。
-	if cleaned, err := services.NormalizePollutedEpisodeMetadata(context.Background()); err != nil {
-		logger.Warn("polluted episode metadata cleanup failed", zap.Error(err))
-	} else if cleaned > 0 {
-		logger.Info("polluted episode metadata cleanup completed", zap.Int("media_count", cleaned))
-	}
-
-	if err := services.Auth.SeedAdmin(context.Background()); err != nil {
-		logger.Warn("seed admin failed", zap.Error(err))
-	}
-
-	router := buildRouter(cfg, logger, embyCompatLogger, services)
-
-	serverMgr := newServerManager(cfg, logger, router)
-	services.ReloadHTTPServer = serverMgr.Reload
-	if err := serverMgr.Start(); err != nil {
-		logger.Fatal("listen failed", zap.Error(err))
-	}
-	go func() {
-		scheme := "http"
-		if cfg.App.HTTPSEnabled {
-			scheme = "https"
-		}
-		if publicIP := getPublicIP(3 * time.Second); publicIP != "" {
-			logger.Info("server public endpoint",
-				zap.String("public", fmt.Sprintf("%s://%s:%d", scheme, publicIP, cfg.App.Port)),
-			)
-		}
-	}()
-	helper.Go(logger, "services.boot", services.Boot)
-
-	// Graceful shutdown.
-	stop := make(chan os.Signal, 1)
-	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
-	<-stop
-	logger.Info("shutdown requested")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-	if err := serverMgr.Shutdown(ctx); err != nil {
-		logger.Error("graceful shutdown failed", zap.Error(err))
-	}
-	services.Close()
-	logger.Info("MeBox stopped")
+	runProgram()
 }

cmd/server/program_other.go

@@ -0,0 +1,33 @@
+//go:build !windows
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+func runProgram() {
+	app, err := newApplication()
+	if err != nil {
+		reportError("MeBox 启动失败", err)
+		os.Exit(1)
+	}
+
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
+	<-stop
+
+	if err := app.Shutdown(); err != nil {
+		reportError("MeBox 退出失败", err)
+	}
+}
+
+func reportError(title string, err error) {
+	if err == nil {
+		return
+	}
+	fmt.Fprintf(os.Stderr, "%s: %v\n", title, err)
+}

cmd/server/program_windows.go

@@ -0,0 +1,330 @@
+//go:build windows
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"syscall"
+
+	"fyne.io/systray"
+	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+
+	"github.com/truewhile/MeBox/internal/brand"
+)
+
+const (
+	runRegistryKey     = `Software\Microsoft\Windows\CurrentVersion\Run`
+	runRegistryValue   = "MeBox"
+	singleInstanceName = `Local\MeBox-Server`
+)
+
+var errAlreadyRunning = errors.New("MeBox is already running")
+
+func runProgram() {
+	if err := prepareWorkingDirectory(); err != nil {
+		reportError("MeBox 启动失败", fmt.Errorf("切换工作目录失败: %w", err))
+		return
+	}
+
+	instance, err := acquireSingleInstance()
+	if errors.Is(err, errAlreadyRunning) {
+		reportError("MeBox", errors.New("MeBox 已在运行，请查看右下角托盘图标"))
+		return
+	}
+	if err != nil {
+		reportError("MeBox 启动失败", fmt.Errorf("创建单实例锁失败: %w", err))
+		return
+	}
+
+	app, err := newApplication()
+	if err != nil {
+		_ = instance.Close()
+		reportError("MeBox 启动失败", err)
+		return
+	}
+
+	controller := &trayController{app: app}
+	systray.Run(controller.onReady, controller.onExit)
+
+	// Release the mutex before starting the replacement process. The new
+	// process must be able to acquire it immediately after the old one exits.
+	_ = instance.Close()
+
+	if !controller.readyClosed.Load() {
+		_ = app.Shutdown()
+		reportError("MeBox 启动失败", errors.New("系统托盘初始化失败"))
+		return
+	}
+	if controller.restartRequested.Load() {
+		if err := launchSelf(); err != nil {
+			reportError("MeBox 重启失败", err)
+		}
+	}
+}
+
+type trayController struct {
+	app *application
+
+	readyClosed      atomic.Bool
+	restartRequested atomic.Bool
+	shutdownStarted  atomic.Bool
+}
+
+func (c *trayController) onReady() {
+	defer func() {
+		c.readyClosed.Store(true)
+	}()
+
+	systray.SetIcon(brand.Icon)
+	systray.SetTooltip("MeBox")
+
+	mOpen := systray.AddMenuItem("打开 MeBox", "在浏览器中打开 MeBox")
+	mAutoStart := systray.AddMenuItemCheckbox("开机自启", "登录 Windows 后自动启动 MeBox", autoStartEnabled())
+	mLogs := systray.AddMenuItem("查看日志", "打开 MeBox 应用日志")
+	systray.AddSeparator()
+	mRestart := systray.AddMenuItem("重启 MeBox", "重启 MeBox 服务")
+	mQuit := systray.AddMenuItem("退出 MeBox", "停止服务并退出")
+
+	initialAutoStart := mAutoStart.Checked()
+	go func() {
+		for {
+			select {
+			case <-mOpen.ClickedCh:
+				if err := openURL(c.app.localURL()); err != nil {
+					reportError("MeBox", fmt.Errorf("打开 MeBox 失败: %w", err))
+				}
+			case <-mAutoStart.ClickedCh:
+				enable := !mAutoStart.Checked()
+				if err := setAutoStart(enable); err != nil {
+					if initialAutoStart {
+						mAutoStart.Check()
+					} else {
+						mAutoStart.Uncheck()
+					}
+					reportError("MeBox", fmt.Errorf("更新开机自启设置失败: %w", err))
+					continue
+				}
+				if enable {
+					mAutoStart.Check()
+				} else {
+					mAutoStart.Uncheck()
+				}
+				initialAutoStart = enable
+			case <-mLogs.ClickedCh:
+				if err := c.app.openLog(); err != nil {
+					reportError("MeBox", fmt.Errorf("打开日志失败: %w", err))
+				}
+			case <-mRestart.ClickedCh:
+				c.restart()
+			case <-mQuit.ClickedCh:
+				c.quit()
+			}
+		}
+	}()
+}
+
+func (c *trayController) onExit() {
+	_ = c.app.Shutdown()
+}
+
+func (c *trayController) quit() {
+	if !c.shutdownStarted.CompareAndSwap(false, true) {
+		return
+	}
+	go func() {
+		_ = c.app.Shutdown()
+		systray.Quit()
+	}()
+}
+
+func (c *trayController) restart() {
+	if !c.shutdownStarted.CompareAndSwap(false, true) {
+		return
+	}
+	c.restartRequested.Store(true)
+	go func() {
+		_ = c.app.Shutdown()
+		systray.Quit()
+	}()
+}
+
+func (a *application) openLog() error {
+	appLog, _, _ := logFilePaths(a.cfg)
+	if appLog != "" {
+		if _, err := os.Stat(appLog); err == nil {
+			return openPath(appLog)
+		}
+		_ = os.MkdirAll(filepath.Dir(appLog), 0o750)
+		return openPath(filepath.Dir(appLog))
+	}
+
+	logDir := filepath.Join(a.cfg.App.DataDir, "logs")
+	if err := os.MkdirAll(logDir, 0o750); err != nil {
+		return err
+	}
+	return openPath(logDir)
+}
+
+func prepareWorkingDirectory() error {
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	exeDir := filepath.Dir(exe)
+	cwd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+	if samePath(exeDir, cwd) || looksLikeProjectDirectory(cwd) {
+		return nil
+	}
+	return os.Chdir(exeDir)
+}
+
+func looksLikeProjectDirectory(dir string) bool {
+	for _, name := range []string{"go.mod", "config.yaml", "data", filepath.Join("web", "dist")} {
+		if _, err := os.Stat(filepath.Join(dir, name)); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
+func samePath(left, right string) bool {
+	return strings.EqualFold(filepath.Clean(left), filepath.Clean(right))
+}
+
+type singleInstance struct {
+	handle windows.Handle
+}
+
+func acquireSingleInstance() (*singleInstance, error) {
+	name, err := windows.UTF16PtrFromString(singleInstanceName)
+	if err != nil {
+		return nil, err
+	}
+	handle, err := windows.CreateMutex(nil, false, name)
+	if errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+		if handle != 0 {
+			_ = windows.CloseHandle(handle)
+		}
+		return nil, errAlreadyRunning
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &singleInstance{handle: handle}, nil
+}
+
+func (s *singleInstance) Close() error {
+	if s == nil || s.handle == 0 {
+		return nil
+	}
+	err := windows.CloseHandle(s.handle)
+	s.handle = 0
+	return err
+}
+
+func launchSelf() error {
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	cwd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+
+	cmd := exec.Command(exe, os.Args[1:]...)
+	cmd.Dir = cwd
+	cmd.Env = os.Environ()
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		HideWindow:    true,
+		CreationFlags: windows.CREATE_NEW_PROCESS_GROUP | windows.DETACHED_PROCESS,
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	return cmd.Process.Release()
+}
+
+func autoStartEnabled() bool {
+	key, err := registry.OpenKey(registry.CURRENT_USER, runRegistryKey, registry.QUERY_VALUE)
+	if err != nil {
+		return false
+	}
+	defer key.Close()
+
+	value, _, err := key.GetStringValue(runRegistryValue)
+	if err != nil {
+		return false
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return false
+	}
+	return strings.EqualFold(strings.TrimSpace(strings.Trim(value, `"`)), filepath.Clean(exe))
+}
+
+func setAutoStart(enabled bool) error {
+	key, _, err := registry.CreateKey(registry.CURRENT_USER, runRegistryKey, registry.SET_VALUE)
+	if err != nil {
+		return err
+	}
+	defer key.Close()
+
+	if !enabled {
+		if err := key.DeleteValue(runRegistryValue); err != nil && !errors.Is(err, registry.ErrNotExist) {
+			return err
+		}
+		return nil
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	return key.SetStringValue(runRegistryValue, syscall.EscapeArg(filepath.Clean(exe)))
+}
+
+func openURL(url string) error {
+	return shellOpen(url)
+}
+
+func openPath(path string) error {
+	return shellOpen(path)
+}
+
+func shellOpen(target string) error {
+	targetPtr, err := windows.UTF16PtrFromString(target)
+	if err != nil {
+		return err
+	}
+	verbPtr, err := windows.UTF16PtrFromString("open")
+	if err != nil {
+		return err
+	}
+	return windows.ShellExecute(0, verbPtr, targetPtr, nil, nil, 1)
+}
+
+func reportError(title string, err error) {
+	if err == nil {
+		return
+	}
+	text, textErr := windows.UTF16PtrFromString(title + "\r\n\r\n" + err.Error())
+	if textErr != nil {
+		return
+	}
+	caption, captionErr := windows.UTF16PtrFromString("MeBox")
+	if captionErr != nil {
+		return
+	}
+	_, _ = windows.MessageBox(0, text, caption, windows.MB_OK|windows.MB_ICONERROR|windows.MB_SETFOREGROUND)
+}

cmd/server/resources_windows.go

@@ -0,0 +1,11 @@
+//go:build windows
+
+package main
+
+// Regenerate the linked Windows resources after changing the project logo or
+// manifest:
+//
+//	go generate ./cmd/server
+//
+//go:generate go run github.com/akavel/rsrc@v0.10.2 -arch amd64 -ico ../../internal/brand/logo.ico -manifest winres/mebox.manifest -o rsrc_windows_amd64.syso
+//go:generate go run github.com/akavel/rsrc@v0.10.2 -arch arm64 -ico ../../internal/brand/logo.ico -manifest winres/mebox.manifest -o rsrc_windows_arm64.syso

cmd/server/winres/mebox.manifest

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity
+    version="1.0.0.0"
+    processorArchitecture="*"
+    name="MeBox"
+    type="win32"
+  />
+  <description>MeBox media server</description>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
+    </application>
+  </compatibility>
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
+    </windowsSettings>
+  </application>
+</assembly>

docker-compose.metatube.yml

@@ -0,0 +1,216 @@
+# MeBox + MetaTube 一体部署 Docker Compose 部署文件
+#
+# 组件：
+#   MeBox + PostgreSQL + Redis + MetaTube
+#
+# 与 docker-compose.standard.yml 的区别：
+#   额外内置一个 MetaTube 后端（番号元数据刮削 / 封面人脸裁剪），
+#   并与 MeBox 共用同一个 PostgreSQL 实例，不需要再单独起一套数据库。
+#
+# 使用方式二选一：
+#   1. 保存为 docker-compose.yml 后执行：
+#        docker compose up -d
+#   2. 保留本文件名时执行：
+#        docker compose -f docker-compose.metatube.yml up -d
+#
+# 首次启动后需要做一次配置（只有这一处是手动的）：
+#   登录 MeBox → 设置 → 番号刮削：
+#     - 番号刮削引擎：MetaTube 后端服务，或 智能混合
+#     - MetaTube 服务端地址：http://metatube:8080
+#     - 访问 Token：留空（仅内部网络，未启用认证；如需认证两边填同一个值）
+#
+# 说明：
+#   - MetaTube 使用独立数据库 metatube，由 metatube-db-init 一次性容器自动创建；
+#     和 MeBox 的 mebox 库共用同一个 PostgreSQL 实例，只是分成两个库。
+#   - MetaTube 不向宿主机映射端口，只在本 Compose 内部网络提供服务。
+#   - MeBox 故意不依赖 MetaTube：MetaTube 未就绪或挂掉时，智能混合模式会自动回退到内置刮削源。
+#   - 更新全部组件：
+#       docker compose -f docker-compose.metatube.yml pull
+#       docker compose -f docker-compose.metatube.yml up -d
+#     保留本文件名时，管理面板「系统更新」需要把「Compose 安装目录」指向本文件所在目录，
+#     或把更新命令改成带 -f docker-compose.metatube.yml 的形式。
+#
+# 默认账号：
+#   admin / admin123
+
+services:
+  mebox:
+    image: ghcr.io/truewhile/mebox:latest
+
+    restart: unless-stopped
+    init: true
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+    ports:
+      - "18080:8080"
+
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+    volumes:
+      # 程序运行数据：JWT 密钥、运行配置、旧 SQLite 迁移源。
+      - ./data:/data
+
+      # 缓存目录：海报缓存、临时文件等。通常不用备份。
+      - ./cache:/cache
+
+      # 媒体库目录。自动整理/重命名/入库需要读写权限。
+      # NAS 示例：source: /vol1/1000/Media
+      # Windows Docker Desktop 示例：source: D:/Media
+      # create_host_path=false 可以避免路径写错时 Docker 自动创建空文件夹。
+      - ./media: /media
+
+    environment:
+      TZ: Asia/Shanghai
+
+      PUID: "0"
+      PGID: "0"
+
+      MEBOX_APP_HOST: 0.0.0.0
+      MEBOX_APP_PORT: 8080
+      MEBOX_APP_WEB_DIR: /app/web/dist
+      MEBOX_APP_DATA_DIR: /data
+      MEBOX_LOGGING_LEVEL: info
+      MEBOX_LOGGING_FORMAT: console
+      MEBOX_LOGGING_OUTPUT_PATH: /data/logs
+      MEBOX_LOGGING_MAX_SIZE_MB: "20"
+      MEBOX_LOGGING_MAX_BACKUPS: "5"
+      MEBOX_LOGGING_MAX_AGE_DAYS: "30"
+
+      MEBOX_DATABASE_TYPE: postgres
+      MEBOX_DATABASE_DSN: postgres://mebox:mebox@postgres:5432/mebox?sslmode=disable
+      MEBOX_DATABASE_DB_PATH: /data/mebox.db
+
+      # Redis 只做热缓存，源数据仍在 PostgreSQL；Redis 丢失可自动重建。
+      MEBOX_CACHE_REDIS_URL: redis://redis:6379/0
+      MEBOX_CACHE_CACHE_DIR: /cache
+
+      MEBOX_UPDATE_IMAGE: ghcr.io/truewhile/mebox:latest
+
+      # 路径换算配置。左边宿主机真实路径要和 volumes 左边保持一致。
+      MEBOX_MEDIA_DIR: /media
+      MEBOX_MEDIA_CONTAINER_DIR: /media
+      MEBOX_DOWNLOAD_DIR: /downloads
+      MEBOX_DOWNLOAD_CONTAINER_DIR: /downloads
+
+      MEBOX_TRANSCODER_ENABLED: "true"
+      MEBOX_TRANSCODER_HARDWARE_ACCEL: "false"
+      MEBOX_TRANSCODER_REALTIME: "true"
+      MEBOX_TRANSCODER_THREADS: "2"
+      MEBOX_TRANSCODER_MAX_CONCURRENT: "1"
+      MEBOX_TRANSCODER_IDLE_TIMEOUT_SECONDS: "120"
+
+    healthcheck:
+      test: ["CMD-SHELL", "busybox wget -qO- http://127.0.0.1:8080/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+  postgres:
+    image: postgres:16-alpine
+    # 首次部署允许拉取；日常更新请只 pull mebox。
+    # MetaTube 与 MeBox 共用本实例（不同数据库），无需第二套 PostgreSQL。
+    pull_policy: missing
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: mebox
+      POSTGRES_USER: mebox
+      POSTGRES_PASSWORD: mebox
+      TZ: Asia/Shanghai
+    volumes:
+      # 同时存放 mebox 与 metatube 两个数据库，备份这一个目录即可。
+      - ./postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U mebox -d mebox"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+  # 一次性容器：确保 metatube 库存在。
+  # MetaTube 自己的 -db-auto-migrate 只建表不建库，所以必须先建库。
+  # 数据库已存在时它会直接退出，重复执行无副作用。
+  metatube-db-init:
+    image: postgres:16-alpine
+    pull_policy: missing
+    restart: "no"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PGPASSWORD: mebox
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        psql -h postgres -U mebox -d mebox -tAc "SELECT 1 FROM pg_database WHERE datname='metatube'" | grep -q 1 || psql -h postgres -U mebox -d mebox -c "CREATE DATABASE metatube OWNER mebox"
+    logging:
+      driver: json-file
+      options:
+        max-size: "5m"
+        max-file: "1"
+
+  metatube:
+    image: ghcr.io/metatube-community/metatube-server:latest
+    restart: unless-stopped
+    depends_on:
+      metatube-db-init:
+        condition: service_completed_successfully
+    environment:
+      TZ: Asia/Shanghai
+      # 需要走代理时在这里填写，例如 http://192.168.1.2:7890
+      HTTP_PROXY: ""
+      HTTPS_PROXY: ""
+    # 不需要 ports：MeBox 通过内部网络访问 http://metatube:8080。
+    # 只有想让局域网内其他工具直连时才映射，且建议只映射到 127.0.0.1。
+    command:
+      - -dsn
+      - postgres://mebox:mebox@postgres:5432/metatube?sslmode=disable
+      - -port
+      - "8080"
+      - -db-auto-migrate
+      - -db-prepared-stmt
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+  redis:
+    image: redis:7-alpine
+    pull_policy: missing
+    restart: unless-stopped
+    command:
+      - redis-server
+      - --appendonly
+      - "yes"
+      - --maxmemory
+      - 256mb
+      - --maxmemory-policy
+      - allkeys-lru
+    volumes:
+      - ./redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "3"

docker-compose.search.yml

@@ -81,8 +81,8 @@ services:
       MEBOX_LOGGING_LEVEL: info
       MEBOX_LOGGING_FORMAT: console
       MEBOX_LOGGING_OUTPUT_PATH: /data/logs
-      MEBOX_LOGGING_MAX_SIZE_MB: "50"
-      MEBOX_LOGGING_MAX_BACKUPS: "20"
+      MEBOX_LOGGING_MAX_SIZE_MB: "20"
+      MEBOX_LOGGING_MAX_BACKUPS: "5"
       MEBOX_LOGGING_MAX_AGE_DAYS: "30"
 
       MEBOX_DATABASE_TYPE: postgres
@@ -124,8 +124,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   postgres:
     image: postgres:16-alpine
@@ -147,8 +147,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   redis:
     image: redis:7-alpine
@@ -172,8 +172,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   opensearch:
     image: opensearchproject/opensearch:2
@@ -196,5 +196,5 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"

docker-compose.simple.yml

@@ -64,8 +64,8 @@ services:
       MEBOX_LOGGING_LEVEL: info
       MEBOX_LOGGING_FORMAT: console
       MEBOX_LOGGING_OUTPUT_PATH: /data/logs
-      MEBOX_LOGGING_MAX_SIZE_MB: "50"
-      MEBOX_LOGGING_MAX_BACKUPS: "20"
+      MEBOX_LOGGING_MAX_SIZE_MB: "20"
+      MEBOX_LOGGING_MAX_BACKUPS: "5"
       MEBOX_LOGGING_MAX_AGE_DAYS: "30"
 
     extra_hosts:
@@ -82,5 +82,5 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"

docker-compose.standard.yml

@@ -44,30 +44,13 @@ services:
       # NAS 示例：source: /vol1/1000/Media
       # Windows Docker Desktop 示例：source: D:/Media
       # create_host_path=false 可以避免路径写错时 Docker 自动创建空文件夹。
-      - type: bind
-        source: ./media
-        target: /media
-        bind:
-          create_host_path: false
-
-      # 下载目录。需要和下载器保存路径保持一致。
-      # NAS 示例：source: /vol1/1000/Downloads
-      # Windows Docker Desktop 示例：source: D:/Downloads
-      - type: bind
-        source: ./downloads
-        target: /downloads
-        bind:
-          create_host_path: false
-
-      # 管理面板「系统更新」需要访问 Docker 引擎。
-      # 需要一键更新 Docker 镜像时取消下一行注释。
-      # - /var/run/docker.sock:/var/run/docker.sock
+      - ./media: /media
 
     environment:
       TZ: Asia/Shanghai
 
-      PUID: "1000"
-      PGID: "1000"
+      PUID: "0"
+      PGID: "0"
 
       MEBOX_APP_HOST: 0.0.0.0
       MEBOX_APP_PORT: 8080
@@ -76,8 +59,8 @@ services:
       MEBOX_LOGGING_LEVEL: info
       MEBOX_LOGGING_FORMAT: console
       MEBOX_LOGGING_OUTPUT_PATH: /data/logs
-      MEBOX_LOGGING_MAX_SIZE_MB: "50"
-      MEBOX_LOGGING_MAX_BACKUPS: "20"
+      MEBOX_LOGGING_MAX_SIZE_MB: "20"
+      MEBOX_LOGGING_MAX_BACKUPS: "5"
       MEBOX_LOGGING_MAX_AGE_DAYS: "30"
 
       MEBOX_DATABASE_TYPE: postgres
@@ -113,8 +96,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   postgres:
     image: postgres:16-alpine
@@ -136,8 +119,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   redis:
     image: redis:7-alpine
@@ -161,5 +144,5 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"

docker-compose.yml

@@ -92,8 +92,8 @@ services:
       MEBOX_LOGGING_LEVEL: info
       MEBOX_LOGGING_FORMAT: console
       MEBOX_LOGGING_OUTPUT_PATH: /data/logs
-      MEBOX_LOGGING_MAX_SIZE_MB: "50"
-      MEBOX_LOGGING_MAX_BACKUPS: "20"
+      MEBOX_LOGGING_MAX_SIZE_MB: "20"
+      MEBOX_LOGGING_MAX_BACKUPS: "5"
       MEBOX_LOGGING_MAX_AGE_DAYS: "30"
 
       # 轻量模式默认只使用 PostgreSQL，适合大多数 NAS。
@@ -141,8 +141,8 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"
 
   postgres:
     image: postgres:16-alpine
@@ -166,5 +166,5 @@ services:
     logging:
       driver: json-file
       options:
-        max-size: "50m"
-        max-file: "10"
+        max-size: "20m"
+        max-file: "3"

docs/reading-module-design.md

@@ -0,0 +1,743 @@
+# 阅读模块（Reading Module）设计与实施方案
+
+> 状态：设计稿，待评审
+> 目标版本：v0.2.0（分期落地，见第 9 节）
+> 关联现有子系统：媒体库 / 网盘存储 / 权限体系 / 任务队列
+
+---
+
+## 1. 目标与范围
+
+### 1.1 已确认的产品决策
+
+| 维度 | 决策 |
+| --- | --- |
+| 内容类型 | **电子书 + 漫画统一书架**（EPUB / TXT / PDF / MOBI 与 CBZ / CBR / 图片文件夹） |
+| 书源 | **独立书库**（不复用影视媒体库）+ **网盘直链阅读** |
+| 首版范围 | **完整版**：多用户书库权限 + 阅读统计 |
+| 阅读形态 | **滚动流式与分页翻页双模式**，用户可切换并持久化偏好 |
+
+### 1.2 明确的非目标
+
+- **不接入 Emby/Jellyfin 协议。** Emby 的 `Items` / `Views` / `PlaybackInfo` 语义围绕音视频构建，没有书籍章节与阅读进度的对应概念。强行映射会污染 `internal/service/emby_*.go` 与 `internal/handler/emby_*.go` 的既有兼容层，收益极低。阅读能力只通过 MeBox 自己的 Web UI 提供。
+- **不复用 `model.Library` / `LibraryRoot`。** `Library.Type` 的取值域是 `movie/tv/anime/music`，且被海报墙轮播（`CarouselEnabled`）、自动整理管线、Emby 视图、首页预览等链路消费。把书库塞进去会导致这些链路需要到处加 `type != "book"` 判断。
+- 首版不做：听书 TTS、在线书源（笔趣阁类）、社交分享、跨设备同步批注冲突合并。
+
+---
+
+## 2. 总体架构
+
+### 2.1 分层落位
+
+完全沿用现有分层，不引入新模式：
+
+```
+web/src/pages/Books*.tsx            ← 页面
+web/src/components/Book*.tsx         ← 阅读器与书架组件
+web/src/api/books.ts                 ← axios 封装（仿 web/src/api/library.ts）
+        ↓ /api/books/*
+internal/handler/books*.go           ← 反序列化 + 权限校验 + 响应
+internal/service/book_*.go           ← 业务策略（扫描、解析、进度、统计）
+internal/repository/book_*.go        ← 纯持久化
+internal/model/book.go               ← GORM 模型，注册进 model.AllModels()
+```
+
+新增路由注册走 `internal/handler/routes_authenticated_features.go` 的既有范式，新增一个 `registerAuthedBookRoutes(authed, svc)`，在 `registerAuthenticatedRoutes` 链上挂载。`service.Container` 与 `repository.Container` 各追加一个字段。
+
+### 2.2 与现有能力的复用点
+
+| 现有部件 | 复用方式 |
+| --- | --- |
+| `service.StreamService.ServeFile`（`internal/service/stream_file.go`） | 已用 `http.ServeContent` 处理 HEAD / Range / If-Modified-Since，**PDF 与原始文件流直接照搬这条路径** |
+| `cloud.Provider.Resolve(ctx, fileRef) (*DirectLink, error)`（`internal/service/cloud/cloud.go`） | 网盘书源的直链解析入口，`DirectLink.Proxy` 决定 302 还是反代 |
+| `model.StorageConfig`（`internal/model/storage_assistant.go`） | 直接复用为网盘书源的账号凭据载体，**不新建凭据表** |
+| `service.ImageProxy`（`internal/service/image_proxy*.go`） | 漫画页与封面的磁盘缓存 + 远程拉取 + 缩放，复用其缓存目录与命名思路 |
+| `service.PruneImageCache`（`internal/service/cache_cleanup.go`） | 现成的「按总大小做 LRU 淘汰」助手，书籍缓存淘汰直接复用它 |
+| `service/scheduler_local_jobs.go` | 本地定时任务的挂载点，书籍缓存清理与每日统计汇总都注册在这里 |
+| `config.CacheConfig`（`internal/config/types.go`） | 已有 `CacheDir` / `MaxDiskUsageMB` / `TTLHours` / `AutoCleanup` / `CleanupIntervalMin`，书籍缓存容量配置直接挂进去 |
+| `service.FileManager`（`internal/service/filemanager.go`） | 本地书源目录浏览，前端复用 `LocalDirBrowserDialog.tsx` |
+| `service.Scheduler` | 书库定时扫描（默认关闭，管理员可开） |
+| `model.UserPermission` | 新增阅读权限位，见第 7 节 |
+| `helper.Go` / `Container.stopCtx` | 后台扫描任务的生命周期管理 |
+
+---
+
+## 3. 数据模型
+
+新增文件 `internal/model/book.go`，并在 `internal/model/model.go` 的 `AllModels()` 中追加。所有表继承 `model.Base`（UUID 主键 + 时间戳 + 软删除）。
+
+**表名约定**：`internal/model` 全包**没有任何 `TableName()` 覆盖**，一律使用 GORM 默认复数化（例如 `PlaybackHistory` → `playback_histories`，可从 `internal/database/schema_migration.go` 的裸 SQL 印证）。新表沿用该约定，不引入例外。因此模型命名要保证复数化结果干净：
+
+| 模型 | 表名 |
+| --- | --- |
+| `Book` | `books` |
+| `BookLibrary` | `book_libraries` |
+| `BookSource` | `book_sources` |
+| `BookChapter` | `book_chapters` |
+| `BookProgress` | `book_progresses` |
+| `BookAnnotation` | `book_annotations` |
+| `BookFavorite` | `book_favorites` |
+| `BookReadingSession` | `book_reading_sessions` |
+| `BookDailyStat` | `book_daily_stats` |
+
+（刻意用 `BookDailyStat` 而不是 `BookStatDaily`——后者复数化会得到 `book_stat_dailies`。）
+
+### 3.1 书库与书源
+
+```go
+// BookLibrary 是独立于影视媒体库的书库。
+type BookLibrary struct {
+    Base
+    Name        string `gorm:"size:128;not null" json:"name"`
+    Kind        string `gorm:"size:16;not null;default:mixed" json:"kind"` // ebook / comic / mixed
+    CoverURL    string `gorm:"size:1024" json:"cover_url,omitempty"`
+    Enabled     bool   `gorm:"default:true" json:"enabled"`
+    SortOrder   int    `gorm:"index;default:0" json:"sort_order"`
+    LastScanAt  *time.Time `json:"last_scan_at,omitempty"`
+    ScanStatus  string `gorm:"size:16;default:idle" json:"scan_status"` // idle / scanning / error
+    ScanMessage string `gorm:"size:512" json:"scan_message,omitempty"`
+}
+
+// BookSource 是书库下的一条挂载来源：本地目录或网盘路径。
+type BookSource struct {
+    Base
+    LibraryID       string `gorm:"index;size:36;not null" json:"library_id"`
+    Name            string `gorm:"size:128" json:"name,omitempty"`
+    StorageKind     string `gorm:"size:16;not null;default:local" json:"storage_kind"` // local / cloud
+    Path            string `gorm:"size:1024;not null" json:"path"`                     // 本地绝对路径 / 网盘内路径
+    StorageConfigID string `gorm:"index;size:36" json:"storage_config_id,omitempty"`   // 复用 model.StorageConfig
+    Depth           int    `gorm:"default:3" json:"depth"`                             // 扫描递归深度上限
+    Enabled         bool   `gorm:"default:true" json:"enabled"`
+    SortOrder       int    `gorm:"default:0" json:"sort_order"`
+}
+```
+
+`StorageKind = cloud` 时，`StorageConfigID` 指向一条 `StorageConfig`（`Type` ∈ `cloud115 / clouddrive2 / openlist / emby_remote`）。凭据解密沿用 `service.CryptoService`。
+
+### 3.2 书籍与章节
+
+```go
+type Book struct {
+    Base
+    LibraryID   string `gorm:"index;size:36;not null" json:"library_id"`
+    SourceID    string `gorm:"uniqueIndex:uniq_book_source_path,priority:1;index;size:36;not null" json:"source_id"`
+    // SourcePath 在本地源是绝对路径，在网盘源是「网盘内路径」，两者都用
+    // (source_id, source_path) 做唯一键，天然隔离两个 ID 空间。
+    SourcePath  string `gorm:"uniqueIndex:uniq_book_source_path,priority:2;size:1024;not null" json:"source_path"`
+    SourceRef   string `gorm:"size:256" json:"source_ref,omitempty"` // 网盘 file id / pickcode
+    Title       string `gorm:"size:512;not null" json:"title"`
+    Author      string `gorm:"size:256;index" json:"author,omitempty"`
+    SeriesName  string `gorm:"size:256;index" json:"series_name,omitempty"`
+    Volume      int    `json:"volume"`
+    Format      string `gorm:"size:16;not null" json:"format"` // epub/txt/pdf/mobi/cbz/cbr/folder
+    MediaKind   string `gorm:"size:16;not null;default:ebook" json:"media_kind"` // ebook / comic
+    SizeBytes   int64  `json:"size_bytes"`
+    FileHash    string `gorm:"index;size:64" json:"file_hash,omitempty"` // 大小+首尾采样，去重
+    CoverURL    string `gorm:"size:1024" json:"cover_url,omitempty"`
+    Description string `gorm:"type:text" json:"description,omitempty"`
+    Language    string `gorm:"size:32" json:"language,omitempty"`
+    Tags        string `gorm:"type:text" json:"tags,omitempty"` // 逗号分隔
+    ChapterCount int   `json:"chapter_count"`
+    WordCount    int64 `json:"word_count"`
+    PageCount    int   `json:"page_count"` // 漫画总页数 / PDF 页数
+    ParseStatus  string `gorm:"size:16;default:pending" json:"parse_status"` // pending/ok/failed
+    ParseMessage string `gorm:"size:512" json:"parse_message,omitempty"`
+    NSFW         bool  `gorm:"default:false" json:"nsfw"`
+    AddedAt      time.Time `json:"added_at"`
+}
+```
+
+**唯一键说明**：`SourcePath` 上的 `uniqueIndex` 需与 `SourceID` 组成复合键（`uniq_book_source_path`，priority 1 = `source_id`）。同一本书被两个书源包含时允许重复入库，这是符合预期的（用户可能故意如此）。
+
+```go
+// BookChapter 只存索引，不存正文（见 3.4 的取舍）。
+type BookChapter struct {
+    Base
+    BookID       string `gorm:"index:idx_book_chapter,priority:1;size:36;not null" json:"book_id"`
+    Index        int    `gorm:"index:idx_book_chapter,priority:2" json:"index"`
+    Title        string `gorm:"size:512" json:"title"`
+    Level        int    `gorm:"default:1" json:"level"` // 目录嵌套层级，1 = 顶级
+    // 电子书定位：二选一
+    Href         string `gorm:"size:1024" json:"href,omitempty"`      // EPUB zip 内条目路径
+    StartOffset  int64  `json:"start_offset"`                          // TXT 字节区间
+    EndOffset    int64  `json:"end_offset"`
+    // 漫画/PDF 定位
+    PageStart    int    `json:"page_start"`
+    PageEnd      int    `json:"page_end"`
+    CharCount    int    `json:"char_count"`
+}
+```
+
+### 3.3 进度、批注、收藏、统计
+
+```go
+// BookProgress 每个用户每本书一行（复合唯一键，仿 model.PlaybackHistory 的 uniq_user_history 模式）。
+type BookProgress struct {
+    Base
+    UserID       string `gorm:"uniqueIndex:uniq_user_book,priority:1;size:36;not null" json:"user_id"`
+    BookID       string `gorm:"uniqueIndex:uniq_user_book,priority:2;size:36;not null" json:"book_id"`
+    ChapterIndex int    `gorm:"default:0" json:"chapter_index"`
+    ChapterTitle string `gorm:"size:512" json:"chapter_title,omitempty"`
+    CharOffset   int    `json:"char_offset"`  // 章内字符偏移（电子书）
+    PageIndex    int    `json:"page_index"`   // 页码（漫画 / PDF）
+    Percent      float64 `json:"percent"`      // 全书百分比，书架进度条展示用
+    ScrollRatio  float64 `json:"scroll_ratio"` // 章内滚动比例，跨端还原更精确
+    ReaderMode   string `gorm:"size:16;default:scroll" json:"reader_mode"` // scroll / paged
+    Finished     bool   `gorm:"default:false" json:"finished"`
+    TotalSeconds int64  `json:"total_seconds"`
+    LastReadAt   time.Time `gorm:"index" json:"last_read_at"`
+}
+
+type BookAnnotation struct {
+    Base
+    UserID       string `gorm:"index:idx_book_anno,priority:1;size:36;not null" json:"user_id"`
+    BookID       string `gorm:"index:idx_book_anno,priority:2;size:36;not null" json:"book_id"`
+    ChapterIndex int    `json:"chapter_index"`
+    Type         string `gorm:"size:16;not null" json:"type"` // bookmark / highlight / note
+    StartOffset  int    `json:"start_offset"`
+    EndOffset    int    `json:"end_offset"`
+    SelectedText string `gorm:"size:2048" json:"selected_text,omitempty"`
+    Note         string `gorm:"type:text" json:"note,omitempty"`
+    Color        string `gorm:"size:16" json:"color,omitempty"`
+}
+
+type BookFavorite struct {
+    Base
+    UserID string `gorm:"uniqueIndex:uniq_user_book_fav,priority:1;size:36;not null" json:"user_id"`
+    BookID string `gorm:"uniqueIndex:uniq_user_book_fav,priority:2;size:36;not null" json:"book_id"`
+}
+
+// BookReadingSession 由前端心跳驱动，服务端按小时聚合，避免行数爆炸。
+type BookReadingSession struct {
+    Base
+    UserID      string    `gorm:"index:idx_book_stat,priority:1;size:36;not null" json:"user_id"`
+    BookID      string    `gorm:"index;size:36;not null" json:"book_id"`
+    BucketStart time.Time `gorm:"index:idx_book_stat,priority:2" json:"bucket_start"` // 截断到小时
+    Seconds     int64     `json:"seconds"`
+    CharsRead   int64     `json:"chars_read"`
+    PagesRead   int       `json:"pages_read"`
+}
+
+// BookDailyStat 每日汇总，供热力图与「年度阅读报告」查询，避免实时扫 session 表。
+type BookDailyStat struct {
+    Base
+    UserID  string `gorm:"uniqueIndex:uniq_user_book_daily,priority:1;size:36;not null" json:"user_id"`
+    Day     string `gorm:"uniqueIndex:uniq_user_book_daily,priority:2;size:10;not null" json:"day"` // YYYY-MM-DD
+    Seconds int64  `json:"seconds"`
+    Chars   int64  `json:"chars"`
+    Pages   int    `json:"pages"`
+    Books   int    `json:"books"` // 当日有阅读记录的书数
+}
+```
+
+### 3.4 关键取舍：正文不入库
+
+**决策：DB 只存章节索引（偏移量 / zip 内路径 / 页码区间），正文按需从源文件读取。**
+
+理由：
+1. 网文 TXT 常见 5–50MB，漫画单册 100–800MB。入库会让 SQLite 单文件膨胀到数十 GB，直接冲击 `docker-compose.simple.yml` 的「单文件数据库好备份」定位，也会拖慢全库 VACUUM / 备份 / 数据库迁移（`internal/service/database_admin.go`）。
+2. 源文件本来就是权威副本，重复存储没有收益。
+3. EPUB 与 CBZ 本质上都是 zip，**随机读取 zip 内单个条目成本极低**（读中央目录 + 解压目标条目），不需要把整本解压落盘。
+
+代价是每次打开章节都要读源文件。缓解手段：
+- 本地源：`os.Open` + `io.SectionReader`，代价可忽略。
+- 网盘源：见 4.3 的本地缓存策略，且对已缓存的章节走本地。
+
+### 3.5 用户级字段（挂在 `model.User` 上）
+
+沿用 `AllowedLibraryIDs` 的 JSON-in-text 模式（见 `internal/model/user.go`），**不复用影视库字段**，避免两个 ID 空间交叉：
+
+```go
+// 追加到 model.User
+ReaderSettings        string `gorm:"type:text" json:"-"`               // 阅读器偏好 JSON
+AllowedBookLibraryIDs string `gorm:"type:text" json:"-"`               // 空 = 不限制
+AllowedBookLibraryList []string `gorm:"-" json:"allowed_book_library_ids,omitempty"`
+```
+
+`ReaderSettings` 结构（前端读写，服务端仅透传与长度校验）：
+
+```json
+{
+  "mode": "scroll|paged",
+  "fontSize": 18,
+  "lineHeight": 1.8,
+  "fontFamily": "serif|sans|custom",
+  "contentWidth": 720,
+  "theme": "light|sepia|dark|black",
+  "pageAnimation": "slide|fade|none",
+  "comicLayout": "single|double|auto",
+  "comicDirection": "ltr|rtl",
+  "hideScrollbar": true
+}
+```
+
+放在 `User` 行内（而非新表）的理由：与 `PlayerVolume` / `DanmakuFontSize` 等既有播放器偏好一致，读取时随用户信息一并返回，无需额外查询。
+
+---
+
+## 4. 书源与内容读取管线
+
+### 4.1 扫描流程
+
+```
+POST /api/books/libraries/:id/scan
+  → BookScannerService.ScanLibrary(ctx, libraryID)
+      1. 置 ScanStatus=scanning，通过 SSEHub 广播进度（复用 service.SSEHub）
+      2. 遍历启用的 BookSource
+         - local: filepath.WalkDir，按扩展名白名单过滤，超过 Depth 停止递归
+         - cloud: cloud.New(cfg.Type, cfg, client).List(ctx, dirID) 递归列目录
+      3. 对每个候选文件调 BookParser.ParseMeta(reader) 拿元信息 + 目录
+      4. Upsert 到 books / book_chapters（source_id + source_path 为幂等键）
+      5. 源上已消失的书标记软删除（与影视库扫描语义保持一致）
+      6. 置 ScanStatus=idle，记录 LastScanAt
+```
+
+扩展名白名单：`.epub .txt .pdf .mobi .azw3 .cbz .cbr .zip .rar`（`.zip/.rar` 仅当目录内全是图片时按漫画处理，否则跳过，防止误吞压缩包）。
+
+并发：复用 `internal/service` 现有的 worker 池写法，默认 2–4 并发解析（解析要读文件，IO 密集）。
+
+### 4.2 各格式解析策略
+
+| 格式 | 元信息 | 章节 / 页 | 正文读取 |
+| --- | --- | --- | --- |
+| **EPUB** | zip → `META-INF/container.xml` → OPF → `dc:title/dc:creator/dc:language/dc:description`；封面取 OPF `meta[name=cover]` 指向项，退化到 `guide` | 按 spine 顺序，标题取每个 XHTML 的 `<title>` 或首个 `h1..h3`；`Level` 由 nav/ncx 的嵌套深度推断 | `archive/zip` 定位 `Href` 条目，读出 XHTML → 服务端清洗后返回 |
+| **TXT** | 文件名（`书名 - 作者.txt` 模式）+ 编码探测 | 正则切分：`第[一二三四五六七八九十百千零两0-9]+[章节卷回篇]`、`Chapter\s+\d+`、`^\s*\d+\s*$`；命中不足 3 个则按固定字节窗口切片 | `io.SectionReader` 读 `[StartOffset, EndOffset)` → 按探测到的编码转 UTF-8 |
+| **PDF** | 首页/元数据（页数、标题）；封面渲染首屏，失败则留空 | 单章「正文」，`PageStart/PageEnd` = 全书页 | 原始文件流（Range），前端 pdf.js 自己解析 |
+| **CBZ / CBR** | zip/rar 条目自然排序，第一张图做封面 | 单章，页区间 = 图片条目序号 | 按页解压单条目，走图片响应路径 |
+| **图片文件夹** | 目录名 | 单章，页区间 = 排序后图片序号 | 直接读本地文件 |
+| **MOBI / AZW3** | PalmDOC / KF8 头 | 首版**只入库展示、不支持在线阅读**，详情页给出「下载原文件」入口 | — |
+
+实现细节提示：
+- 编码探测用 `golang.org/x/text`（已是 `go.mod` 间接依赖）。GBK/Big5/UTF-16LE 都要覆盖，中文网文 TXT 大量是 GBK。
+- CBR 需要 RAR 解压。建议引入纯 Go 的 `github.com/nwaples/rardecode`；若不接受新依赖，首版把 CBR 归入「只入库、不可读」。
+- EPUB XHTML 清洗**必须在服务端做**：剔除 `<script>`、`on*` 事件属性、`<iframe>`、外部 `http(s)` 资源引用，把 `src/href` 重写为 `/api/books/:id/res/*`。前端再叠一层 DOMPurify 作为纵深防御。
+
+### 4.3 网盘书籍的读取策略
+
+网盘直链的核心约束：**EPUB / CBZ 的解析必须能读到文件尾部**（zip 中央目录在末尾），但 `cloud.Provider.Resolve` 返回的是短时效 URL，且 115 直链依赖 UA/Cookie（`DirectLink.Headers`），浏览器无法直接携带。
+
+因此分两条路径：
+
+**A. 解析阶段 —— 完整拉取到缓存目录**
+
+```
+<CacheDir>/books/<sourceID>/<hash>.<ext>
+```
+
+`BookParser` 通过 `DirectLink` 拉全量文件到缓存后再解析。缓存目录复用 `config.CacheConfig.CacheDir`（默认 `<DataDir>/cache`，容器里是 `/cache`），容量上限新加一项 `CacheConfig.BooksMaxSizeMB`（默认 2GB），走 LRU 淘汰。缓存命中的书后续正文读取也直接走本地，不再回网盘。
+
+**B. 阅读阶段 —— 优先本地缓存，未命中走代理流**
+
+未缓存时由服务端反代目标 URL（`DirectLink.Proxy=true` 时同样反代），并把 `Content-Type: image/*` 或 `application/pdf` 透传给前端。反代实现直接参照 `internal/service/cloud115_hls_proxy.go` 的响应头透传白名单（`Content-Type/Content-Length/Content-Range/Accept-Ranges/ETag/Last-Modified`）。
+
+**C. 阅读进度与文件解耦** —— 代码里区分「源」「位置」：
+
+```go
+type BookLocator struct {
+    Kind        string `json:"kind"` // local / cloud
+    LocalPath   string `json:"local_path,omitempty"`
+    CloudConfig string `json:"cloud_config,omitempty"`
+    CloudRef    string `json:"cloud_ref,omitempty"`
+    Href        string `json:"href,omitempty"` // zip 内条目
+    StartOffset int64  `json:"start_offset,omitempty"`
+    EndOffset   int64  `json:"end_offset,omitempty"`
+}
+```
+
+被缓存的书 `Kind` 仍报 `cloud`（进度不绑物理位置），这样缓存被淘汰后进度依然有效。这是不把 `Book.Path` 直接存成本地缓存路径的原因。
+
+### 4.4 磁盘与容器
+
+书籍目录需要在 compose 里挂载，并在 README 的部署档位表补充说明。新缓存目录复用现有 `MEBOX_CACHE_CACHE_DIR`（`docker-compose.simple.yml` 中为 `/cache`），无需新增环境变量。
+
+---
+
+## 5. HTTP API 设计
+
+全部挂在 `/api/books/*`，注册在 `registerAuthedBookRoutes`。响应统一走 `internal/handler/response.go` 的既有助手。
+
+### 5.1 书库与扫描（管理端）
+
+| 方法 | 路径 | 权限 | 说明 |
+| --- | --- | --- | --- |
+| GET | `/api/books/libraries` | `can_read_books` | 列表，按 `AllowedBookLibraryIDs` 过滤可见性 |
+| POST | `/api/books/libraries` | `can_manage_book_library` | 新建/更新书库 |
+| DELETE | `/api/books/libraries/:id` | `can_manage_book_library` | 删除（含级联软删 books） |
+| GET | `/api/books/libraries/:id/sources` | `can_manage_book_library` | 书源列表 |
+| POST | `/api/books/libraries/:id/sources` | `can_manage_book_library` | 新增书源（本地目录 / 网盘路径） |
+| POST | `/api/books/libraries/:id/scan` | `can_manage_book_library` | 触发扫描，返回 task id |
+| GET | `/api/books/scan/status` | `can_manage_book_library` | 扫描进度轮询 |
+| GET | `/api/books/browse` | `can_manage_book_library` | 网盘路径浏览（复用 cloud Provider.List） |
+
+### 5.2 书架与详情
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| GET | `/api/books` | 书架列表。参数：`library_id`、`keyword`、`media_kind`、`format`、`tag`、`sort`（`title/added_at/last_read/progress`）、`page/page_size` |
+| GET | `/api/books/continue-reading` | 最近在读，首页「继续阅读」区块用 |
+| GET | `/api/books/:id` | 详情（元信息 + 目录树 + 当前用户进度 + 收藏态） |
+| GET | `/api/books/:id/cover` | 封面。走 `ImageProxy` 的缓存与缩放，参数 `w` |
+| GET | `/api/books/:id/chapters/:index` | 章节正文。电子书返回 `text/html`（已清洗）或 `application/json` 结构化段落 |
+| GET | `/api/books/:id/res/*path` | EPUB 内部资源（图片/字体/CSS），路径参数为 zip 内条目 |
+| GET | `/api/books/:id/pages/:index` | 漫画单页图片，`Content-Type: image/*` + 长效缓存头 |
+| GET | `/api/books/:id/file` | 原始文件流（Range），pdf.js 与「下载原文件」共用 |
+| POST | `/api/books/:id/favorite` | 收藏 / 取消收藏 |
+| DELETE | `/api/books/:id` | 删除（`can_manage_books`） |
+
+**章节响应格式（推荐 JSON 而非裸 HTML）**：
+
+```json
+{
+  "index": 12,
+  "title": "第十二章 雨夜",
+  "char_count": 3820,
+  "blocks": [
+    { "type": "p", "text": "……" },
+    { "type": "img", "src": "/api/books/xxx/res/images/1.png" }
+  ],
+  "next_index": 13,
+  "prev_index": 11
+}
+```
+
+用结构化 blocks 而非 HTML 的理由：
+1. 前端可安全渲染，不必 `dangerouslySetInnerHTML`，彻底绕开 XSS 面。
+2. 分页模式需要按节点测量高度做分栏，结构化的段落数组比操作 DOM 简单得多。
+3. 字号/行距/主题切换只需重渲染，不碰 HTML 字符串。
+
+保底方案：`?format=html` 仍返回清洗后的 HTML，供 EPUB 中复杂排版（表格、脚注、双向文字）回退。
+
+### 5.3 进度、批注、统计
+
+| 方法 | 路径 | 说明 |
+| --- | --- | --- |
+| GET | `/api/books/:id/progress` | 当前用户进度 |
+| PUT | `/api/books/:id/progress` | 保存进度。前端**节流 5s + 页面卸载时 `sendBeacon`** |
+| GET | `/api/books/:id/annotations` | 批注列表 |
+| POST | `/api/books/:id/annotations` | 新建 |
+| PATCH | `/api/books/:id/annotations/:aid` | 修改 note / color |
+| DELETE | `/api/books/:id/annotations/:aid` | 删除 |
+| POST | `/api/books/:id/heartbeat` | 阅读心跳，body 为 `{seconds, chars, pages}`，落 `book_reading_sessions` 小时桶 |
+| GET | `/api/books/reader-settings` | 读取当前用户的阅读器偏好（`model.User.ReaderSettings`） |
+| PUT | `/api/books/reader-settings` | 保存阅读器偏好（服务端只做长度与枚举校验后原样存储） |
+| GET | `/api/books/stats` | 个人统计：累计时长、已读书数、在读、近 30 天热力图 |
+| GET | `/api/books/stats/overview` | 管理员视角：全站阅读统计（`can_access_settings`） |
+
+进度写入的并发安全：`uniq_user_book` 复合唯一键 + 先 `Updates` 再 `Create` 的 upsert 模式。**参照 `internal/database/schema_migration.go` 里 `dedupePlaybackHistories` 的前车之鉴**——`PlaybackHistory` 曾因 read-then-write 产生重复行导致唯一索引进不去，新表直接写 upsert，不要复制那个 bug。
+
+---
+
+## 6. 前端设计
+
+### 6.1 路由与导航
+
+`web/src/appRoutes.tsx` 新增懒加载路由：
+
+```tsx
+const BookshelfPage = lazy(() => import('./pages/BookshelfPage').then(m => ({ default: m.BookshelfPage })))
+const BookDetailPage = lazy(() => import('./pages/BookDetailPage').then(m => ({ default: m.BookDetailPage })))
+const BookReaderPage = lazy(() => import('./pages/BookReaderPage').then(m => ({ default: m.BookReaderPage })))
+const BookStatsPage  = lazy(() => import('./pages/BookStatsPage').then(m => ({ default: m.BookStatsPage })))
+const BookLibraryPage = lazy(() => import('./pages/BookLibraryPage').then(m => ({ default: m.BookLibraryPage })))
+```
+
+```
+/books                书架
+/books/:id            书籍详情（目录、元信息、开始阅读）
+/books/:id/read       阅读器（全屏，隐藏底栏）
+/books/stats          阅读统计
+/books/library        书库管理（adminOnly）
+```
+
+`web/src/components/layoutNavigation.ts` 的改动：
+
+- `MEDIA_NAV_ITEMS` 与 `MOBILE_BOTTOM_NAV_ITEMS` 加「阅读」项（`BookOpen` 图标），普通用户可见。
+- 新增 `isBookReaderRoute(pathname)`，并在 `shouldShowMobileBottomNav` 中排除 `/books/:id/read`，与 `isPlayerRoute` 的处理一致。
+- `resolveHeaderBack` 补 `/books/...` 的返回链。
+- `LAYOUT_NAV_ITEMS` 加「书库管理」条目，`adminOnly: true`。
+
+### 6.2 页面组成
+
+```
+web/src/pages/
+  BookshelfPage.tsx            书架：筛选栏 + 网格/列表双视图 + 继续阅读横滑
+  BookDetailPage.tsx           详情：封面、元信息、目录树、进度、开始/继续阅读
+  BookReaderPage.tsx           阅读器外壳：顶栏 + 内容区 + 底部工具条 + 设置抽屉
+  BookStatsPage.tsx            统计：热力图 + 概览卡片
+  BookLibraryPage.tsx          书库管理：书库 CRUD + 书源 CRUD + 扫描触发与进度
+web/src/components/
+  book/ReaderCore.tsx          渲染内核分发（按 media_kind + format）
+  book/ScrollReader.tsx        滚动流式
+  book/PagedReader.tsx         分页翻页
+  book/ComicReader.tsx         漫画（单页/双页/右开本/预加载）
+  book/PdfReader.tsx           PDF（pdf.js）
+  book/ReaderToolbar.tsx       顶栏 + 底栏（章节、进度、目录、批注、设置）
+  book/ReaderSettingsPanel.tsx 阅读设置
+  book/ChapterTocDrawer.tsx    目录抽屉
+  book/AnnotationList.tsx      书签笔记列表
+  book/ReaderProgressBar.tsx   进度条（可拖拽跳章）
+web/src/api/books.ts           接口封装
+```
+
+对于 4 类内容，`ReaderCore` 的分发是第一层决策：
+
+| `media_kind` | `format` | 内核 |
+| --- | --- | --- |
+| ebook | epub / txt | `ScrollReader` 或 `PagedReader`（按 `settings.mode`） |
+| ebook | pdf | `PdfReader` |
+| comic | cbz / cbr / folder | `ComicReader` |
+| ebook | mobi / azw3 | 不提供阅读，仅详情页 |
+
+### 6.3 渲染内核选型（关键决策）
+
+**结论：自研内核，不引入 epub.js / foliate-js。**
+
+对比：
+
+| 方案 | 优点 | 缺点 |
+| --- | --- | --- |
+| `epub.js` | 成熟、CFI 精确定位、多列分页开箱即用 | 维护停滞；CFI 定位难以与自研进度模型（`charOffset` / `percent`）对齐；PDF/漫画仍需另做两个内核 |
+| `foliate-js` | 一套 API 覆盖 EPUB/MOBI/CBZ/PDF，排版质量高 | 生态小、文档薄、非稳定 API，需要 vendored 一份并自行承担升级风险 |
+| **自研（推荐）** | 进度模型完全可控、跨端一致；零新增重依赖；与既有 Tailwind 主题体系天然统一 | 需要自己实现分页测量、脏 HTML 清洗、资源重写 |
+
+自研方案的可行性依据：分页的本质是「CSS multi-column 布局 + `transform: translateX` 平移」，foliate-js 也是这么做的，核心约 200 行；滚动模式的虚拟化可以直接复用已有的 `react-virtuoso`（已在 `web/package.json`，用于 `VirtualMediaGrid`）。
+
+自研必须做好的三件事：
+
+1. **HTML 清洗**：服务端为主（见 4.2），前端用 `dompurify` 兜底。这是新增的唯一运行时依赖。
+2. **资源重写**：EPUB 内部图片/字体/CSS 的 `src`、`href`、`url()` 全部重写到 `/api/books/:id/res/`，否则相对路径会 404。
+3. **分页测量与重排**：容器尺寸变化（窗口 resize、字号切换、横竖屏）后必须重新分页，并把「当前段落 + 段内比例」作为锚点恢复位置，不能让用户跳回章首。
+
+### 6.4 双模式实现
+
+**滚动模式（`ScrollReader`）**
+- 章内虚拟化：单章文本通常 2k–10k 字，直接整章渲染即可；跨章用「当前章 + 前后各一章」的窗口，滚动到边界时无缝追加。
+- 进度：`IntersectionObserver` 观测可视段落，映射为 `charOffset`；`scroll_ratio` 同时上报。
+- 优势：移动端体验好，实现简单，长段落无分页误差。
+
+**分页模式（`PagedReader`）**
+- 章内：容器设为多列（`column-width: <contentWidth>`），`overflow: hidden`，通过 `translateX` 翻页；总页数由 `scrollWidth / containerWidth` 得出。
+- 跨章：翻到本章末尾自动加载下一章首页；反向同理。章首/章尾需处理「残页合并」，避免出现半屏空白页。
+- 输入：左右方向键、空格、点击左右热区、滑动手势（移动端）。`comicDirection`/`pageAnimation` 控制方向与动画。
+- 进度：`chapter_index` + `page_index` 映射回 `charOffset`。
+
+两种模式共享 `BookProgress`，切换模式时用「章 + 比率」换算，不丢位置。
+
+### 6.5 状态与持久化
+
+- 阅读器设置来自 `authStore` 的用户信息（`ReaderSettings` 反序列化），改动后 `PUT /api/books/reader-settings` 持久化 + 本地 `localStorage` 兜底（首屏渲染不等接口）。
+- 进度本地先写 `localStorage`（key `mebook:book:<id>:pos`），再节流同步服务端；页面隐藏/卸载用 `navigator.sendBeacon` 保证不丢。
+- 新增 `web/src/stores/readerSettings.ts`（zustand），与既有 `playProfile.ts` 组织方式一致。
+
+---
+
+## 7. 权限与多用户
+
+`model.UserPermission` 新增 4 位（当前 18 个字段，加后 22 位）：
+
+| 权限位 | 默认 | 含义 |
+| --- | --- | --- |
+| `can_read_books` | `true` | 书架、阅读、进度、批注 |
+| `can_manage_book_library` | `false` | 书库 / 书源 CRUD、触发扫描、网盘浏览 |
+| `can_manage_books` | `false` | 编辑书籍元信息、删除书、手动重新解析 |
+| `can_view_book_stats` | `false` | 查看全站阅读统计 |
+
+同步改动清单（**漏一处就会出现「后端有权限、前端不显示开关」的静默 bug**）：
+
+1. `internal/model/permission.go` — 字段、`NewDefaultPermission()`、`PermissionMap()`，并更新文件头注释里的数量描述（注释目前写「19项」，实际 18 个字段，顺手修正）。
+2. `web/src/types/auth.ts` — `PermissionFlags` 接口加 4 个字段。
+3. `web/src/stores/permissions.ts` — 默认值对象、中文标签映射、权限分组数组。
+4. `web/src/hooks/usePermission.ts` — 若其中有分组注释需同步。
+5. `internal/handler/permissions.go` — 权限矩阵响应（若有枚举）。
+6. `web/src/pages/AdminUsersForm.tsx` / 权限勾选 UI — 若按分组硬编码了列表。
+
+书库可见性：
+
+- 管理员在用户管理页勾选该用户可访问的书库，写入 `User.AllowedBookLibraryIDs`。
+- 空值 = 不限制（与影视库语义一致）。
+- 过滤集中在一个 `bookVisibility` 助手，与现有的 `internal/handler/visibility.go` 并列（该文件就是影视库可见性的集中判定点，并且会与 `PlayProfile.AllowedLibraryIDs` 求交集）。**阅读模块首版不接播放配置档**——`PlayProfile` 是影视播放器概念（音量、转码参数、PIN），与阅读无关；但判定入口要与它放在同一层，将来若要按配置档限制书库才不用重构。
+- **服务端强制**：`GET /api/books/:id`、章节、页面、资源（`/res/*`）、封面、原始文件流，**所有**按 ID 取内容的接口都要校验 `book.LibraryID ∈ 用户可见书库`，不能只靠书架列表过滤。这是最容易漏的越权点：`/api/books/:id/res/*path` 会直接吐出书籍内部的原始资源，漏校验等于开放全库文件读取。
+- 用户被取消书库授权后，其 `BookProgress` / `BookAnnotation` 保留不删（授权恢复即恢复），但接口一律按当前可见性判定，不因历史数据放行。
+
+---
+
+## 8. 阅读统计
+
+- **采集**：阅读器每 30s 发一次 `heartbeat`，卸载时补发一次；服务端按 `(user_id, book_id, 小时桶)` 累加，行数上限 = 用户数 × 书数 × 阅读小时数，可控。
+- **汇总**：`Scheduler` 每日 03:00 把昨天之前的 session 滚进 `BookDailyStat`（复用 `service.Scheduler` 的既有定时任务注册方式）。
+- **展示**：
+  - 个人页「阅读统计」：累计时长、读完本数、在读本数、近 30 天热力图（仿 GitHub 贡献图）、阅读类型分布（电子书 / 漫画）。
+  - 首页新增「继续阅读」横滑区块（参照 `HomePageSections.tsx` 里既有区块的写法）。
+  - 管理员视图：全站活跃度、热门书籍 Top 20（需 `can_view_book_stats`）。
+
+隐私：统计仅对本人与管理员可见；管理员视图只出聚合数据，不暴露单个用户的阅读内容。
+
+---
+
+## 9. 分期实施计划
+
+### P0 — 端到端可用（本地书库 / EPUB + TXT 电子书）
+
+目标：能扫库、能在网页上把一本书读完、关掉浏览器再打开能续读。
+
+| # | 交付物 |
+| --- | --- |
+| 1 | `internal/model/book.go` 九张表 + `AllModels()` 注册 + 迁移验证（SQLite 与 PostgreSQL 各跑一次升级） |
+| 2 | `BookLibrary` / `BookSource` / `Book` / `BookChapter` / `BookProgress` 的 repository |
+| 3 | `BookParser`：EPUB 与 TXT 解析（含 GBK 编码探测、章节正则切分、封面提取） |
+| 4 | `BookScannerService`：本地目录扫描 + upsert + 进度广播 |
+| 5 | API：书库 CRUD、书源 CRUD、扫描、书架列表、详情、章节正文、封面、进度读写、阅读器偏好读写 |
+| 6 | 前端：`BookshelfPage`、`BookDetailPage`、`BookReaderPage`（仅滚动模式）、目录抽屉、阅读设置面板 |
+| 7 | 权限：4 个权限位 + `AllowedBookLibraryIDs` 全链路（含服务端越权校验） |
+
+**验收标准**
+- 一个含 50 本 EPUB 与 20 本 GBK 编码 TXT 的目录，扫描后书架正确列出，标题/作者/封面/章节目录无误。
+- 任意一本书可连续阅读 3 章以上，刷新页面后回到原位置（误差 < 1 段）。
+- 权限为 `can_read_books=false` 的账号访问 `/api/books` 返回 403；直接请求他人书库的 `/api/books/:id/chapters/0`、`/api/books/:id/res/*`、`/api/books/:id/file` 同样被拒。
+- SQLite 单文件档与 PostgreSQL 档都能从旧版本升级启动，无迁移报错。
+
+### P1 — 漫画 + 分页模式 + 网盘直链
+
+| # | 交付物 |
+| --- | --- |
+| 1 | `ComicReader`：CBZ 解析、单页/双页、右开本、相邻页预加载 |
+| 2 | `PagedReader`：分页测量、resize 重排、跨章衔接、键鼠与手势输入 |
+| 3 | 网盘书源：`StorageKind=cloud` 的书源配置、`cloud.Provider` 接入、本地缓存目录 + LRU 淘汰 |
+| 4 | 网盘书籍的索引拉取与阅读反代（含 `Content-Range` 透传） |
+| 5 | PDF：`PdfReader`（pdf.js）+ Range 文件流接口 |
+| 6 | 图片文件夹型漫画 |
+
+**验收标准**
+- CBZ 单册 300 页可流畅翻阅，双页模式断页处理正确（避免跨章错配）。
+- 分页模式下切换字号、resize 窗口、手机横竖屏切换后，位置不跳、不出现空白页。
+- 挂在 OpenList 与 115 上的 EPUB 能正常入库并在线阅读，缓存目录达到上限后按 LRU 淘汰且不影响已有进度。
+- 20MB 以上 PDF 可跳页、可缩放。
+
+### P2 — 批注、统计与体验打磨
+
+| # | 交付物 |
+| --- | --- |
+| 1 | 划线 / 书签 / 笔记：`BookAnnotation` 接口与 UI，批注列表与跳转 |
+| 2 | 阅读统计：心跳采集、每日汇总任务、个人统计页、首页「继续阅读」区块 |
+| 3 | 管理员统计视图 + 热门书籍排行 |
+| 4 | 书库定时扫描（`Scheduler` 接入，默认关闭） |
+| 5 | 书架高级筛选与排序、合集（系列）聚合视图 |
+| 6 | MOBI/AZW3 元信息解析（仍不做在线阅读，仅提供下载） |
+| 7 | 部署文档与 compose 注释更新（书籍目录挂载说明） |
+
+### P3 — 可选增强
+听书 TTS、跨设备批注冲突合并、书源自动整理（仿 `OrganizerService`）、EPUB 阅读器内注释锚点高亮。
+
+---
+
+## 10. 风险与待拍板项
+
+### 10.1 需要你拍板的两点
+
+**① 网盘书籍的缓存策略**
+- 选项 A（本方案）：索引时完整下载到缓存目录，阅读时优先本地。省流量、体验好，但全新书首次打开有等待，且占用磁盘（默认 2GB 上限）。
+- 选项 B：完全不落盘，每次按 Range/整文件从网盘拉。省磁盘，但每次打开都要重新下载，网盘限速时体验很差。
+- 选项 C：折中——只对 EPUB/CBZ 缓存（解析必须读全文），漫画原图与 PDF 走流式。
+
+我的建议是 **C**，因为它把「必须落盘」和「可以不落盘」分开了。
+
+**② 章节正文的返回格式**
+- JSON blocks（本方案推荐）：安全、便于分页测量，但复杂 EPUB 排版（表格、脚注、竖排）会降级。
+- 清洗后 HTML：保真度高，但前端要 `dangerouslySetInnerHTML`，XSS 面更大。
+- 我的建议是 **JSON blocks 为主 + `?format=html` 回退**，两者都实现，前端在遇到 `type: "html-block"` 时回退渲染。
+
+### 10.2 技术风险
+
+| 风险 | 影响 | 缓解 |
+| --- | --- | --- |
+| 自研分页内核的边界情况多（残页、跨章、RTL、竖排） | P1 可能超期 | P0 先只做滚动模式；分页单独立项，配套 `playerPageModel.test.ts` 那样的单测 |
+| TXT 章节正则对网文变体覆盖不足 | 目录错乱 | 提供「手动重新切分」入口，规则可配（仿 `RecognitionWordsPanel` 的可配置词表模式） |
+| 网盘直链失效 / 限速 / 防盗链 | 阅读中断 | 复用现有 115 换链与 `url_cache.go` 的缓存机制；失败时前端降级为「下载原文件」 |
+| 大 TXT（>50MB）章节表行数过多 | SQLite 写入慢 | 章节超过阈值（如 5000 章）时按固定窗口粗切，或改为「按需切分 + 缓存到章节表」的惰性策略 |
+| 缓存目录膨胀 | 磁盘打满 | 容量上限 + 复用 `service.PruneImageCache` 的 LRU 清理 + 系统设置页可见 |
+| 数据库迁移对老库不兼容 | 升级失败 | 新表全部是纯新增，无列变更；不触碰 `ensurePostgresColumnCompatibility` 的既有语句 |
+
+### 10.3 不引入的新依赖清单
+
+| 依赖 | 用途 | 取舍 |
+| --- | --- | --- |
+| `dompurify` | 前端 HTML 清洗兜底 | **建议引入**（前端必需） |
+| `pdfjs-dist` | PDF 渲染 | **建议引入**（P1） |
+| `github.com/nwaples/rardecode` | CBR 解压 | 可选；不接受则 CBR 首版只入库 |
+| `epub.js` / `foliate-js` | EPUB 渲染 | **不引入**，见 6.3 |
+
+---
+
+## 11. 测试策略
+
+与项目现有测试密度对齐（`internal/service` 下大量 `_test.go`，前端有 `*.test.ts`）：
+
+**后端**
+- `book_parser_test.go`：EPUB / TXT 各准备 fixture（`testdata/` 下小体积样本），断言元信息、章节数、章节边界字节偏移、GBK 转码正确性。
+- `book_scanner_test.go`：临时目录扫描 + 重复扫描幂等 + 源文件删除后软删。
+- `book_progress_test.go`：并发 upsert 不产生重复行（直接复现 `dedupePlaybackHistories` 防的那类 bug）。
+- `book_permission_test.go`：越权矩阵，逐接口断言非可见书库返回 403/404。
+- Handler 层：仿 `internal/handler/media_test.go` 起的 `httptest` + 真实内存 SQLite。
+
+**前端**
+- `readerModel.test.ts`：模式切换时的位置换算（`scroll ↔ paged`、`charOffset ↔ pageIndex`）、百分比计算、跨章边界。
+- 分页计算的纯函数抽出单测（不含 DOM），参照 `web/src/pages/playerPageModel.test.ts` 的做法——把逻辑从组件里拔出来测，是项目已有的好传统。
+
+---
+
+## 12. 附：改动文件清单
+
+**后端新增**
+```
+internal/model/book.go
+internal/repository/book_repository.go
+internal/service/book_parser.go            EPUB / TXT / CBZ 解析
+internal/service/book_parser_epub.go
+internal/service/book_parser_txt.go
+internal/service/book_parser_comic.go
+internal/service/book_scanner.go
+internal/service/book_reader.go            章节 / 页面 / 资源的读取与清洗
+internal/service/book_progress.go
+internal/service/book_stats.go
+internal/service/book_cache.go             网盘缓存与 LRU
+internal/handler/books.go
+internal/handler/books_library.go
+internal/handler/books_reader.go
+internal/handler/routes_books.go
+```
+
+**后端修改**
+```
+internal/model/model.go                    AllModels() 追加 9 张表
+internal/model/permission.go               4 个权限位
+internal/model/user.go                     ReaderSettings / AllowedBookLibraryIDs
+internal/repository/repository.go          Container 加字段
+internal/service/service.go                Container 加字段 + Boot() 启动扫描
+internal/handler/routes_authenticated.go   挂载 registerAuthedBookRoutes
+internal/service/scheduler_local_jobs.go   书籍缓存清理 + 每日阅读统计汇总
+internal/config/types.go                   CacheConfig 加 BooksMaxSizeMB；新增 BookConfig（扫描并发等）
+docker-compose*.yml                        书籍目录挂载注释
+README.md / README_EN.md                   能力表新增「阅读」
+```
+
+**前端新增**
+```
+web/src/api/books.ts
+web/src/stores/readerSettings.ts
+web/src/pages/BookshelfPage.tsx
+web/src/pages/BookDetailPage.tsx
+web/src/pages/BookReaderPage.tsx
+web/src/pages/BookStatsPage.tsx
+web/src/pages/BookLibraryPage.tsx
+web/src/components/book/*.tsx
+```
+**前端修改**
+```
+web/src/appRoutes.tsx                       4 条路由
+web/src/components/layoutNavigation.ts      导航项、阅读器路由判定、返回链
+web/src/types/auth.ts                       权限位
+web/src/stores/permissions.ts               权限位默认值 / 标签 / 分组
+web/src/pages/HomePageSections.tsx          「继续阅读」区块
+web/src/pages/settingsGroupBooks.ts         （新增）阅读设置分组
+web/src/pages/settingsGroups.ts             把 settingsGroupBooks 加入 GROUPS 数组
+```

go.mod

@@ -3,6 +3,7 @@ module github.com/truewhile/MeBox
 go 1.25.0
 
 require (
+	fyne.io/systray v1.12.2
 	github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/gin-contrib/gzip v1.2.6
@@ -12,16 +13,16 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/metatube-community/metatube-sdk-go v1.4.0
-	github.com/redis/go-redis/v9 v9.7.0
+	github.com/redis/go-redis/v9 v9.7.3
 	github.com/shirou/gopsutil/v3 v3.24.5
 	github.com/spf13/viper v1.18.2
 	github.com/stretchr/testify v1.11.1
-	github.com/ulikunitz/xz v0.5.12
+	github.com/ulikunitz/xz v0.5.15
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.49.0
-	golang.org/x/image v0.37.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0
+	golang.org/x/image v0.45.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
 	golang.org/x/time v0.15.0
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/postgres v1.6.0
@@ -48,10 +49,11 @@ require (
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.8.0 // indirect
+	github.com/jackc/pgx/v5 v5.9.2 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -69,7 +71,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/quic-go/quic-go v0.59.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
@@ -89,7 +91,7 @@ require (
 	golang.org/x/arch v0.25.0 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	modernc.org/libc v1.70.0 // indirect

go.sum

@@ -1,3 +1,5 @@
+fyne.io/systray v1.12.2 h1:Y8DZxgLHsVQt6rY9Zrkkg+j67S7vv/1F2viOWKPpVeA=
+fyne.io/systray v1.12.2/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs=
 github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2 h1:40yUSXwdkWN851BHCq6uiDhleh7A4+0yIBS+IUAqZVY=
 github.com/aliyun/alibabacloud-oss-go-sdk-v2 v1.5.2/go.mod h1:FTzydeQVmR24FI0D6XWUOMKckjXehM/jgMn1xC+DA9M=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -56,6 +58,8 @@ github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
 github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -77,8 +81,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -121,10 +125,10 @@ github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
-github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
-github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
+github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
+github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
+github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
@@ -171,8 +175,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
-github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
+github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
@@ -192,28 +196,28 @@ golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtC
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.37.0 h1:ZiRjArKI8GwxZOoEtUfhrBtaCN+4b/7709dlT6SSnQA=
-golang.org/x/image v0.37.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
 golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

internal/brand/brand.go

@@ -0,0 +1,10 @@
+// Package brand contains the embedded MeBox application artwork.
+package brand
+
+import _ "embed"
+
+// Icon is the Windows ICO used by both the executable resource and the
+// notification-area icon.
+//
+//go:embed logo.ico
+var Icon []byte

internal/database/database.go

@@ -127,5 +127,10 @@ func (z zapStdLogger) Printf(format string, args ...interface{}) {
 	if z.log == nil {
 		return
 	}
-	z.log.Sugar().Infof(format, args...)
+	message := fmt.Sprintf(format, args...)
+	if strings.Contains(strings.ToLower(message), "context canceled") {
+		z.log.Debug(message)
+		return
+	}
+	z.log.Info(message)
 }

internal/database/schema_migration.go

@@ -99,6 +99,11 @@ func ensurePerformanceIndexes(db *gorm.DB) error {
 		`CREATE INDEX IF NOT EXISTS idx_media_library_episode_active ON media(library_id, season_num, episode_num, created_at DESC) WHERE deleted_at IS NULL`,
 		`CREATE INDEX IF NOT EXISTS idx_media_library_root_active ON media(library_id, library_root_id) WHERE deleted_at IS NULL`,
 		`CREATE INDEX IF NOT EXISTS idx_media_series_active ON media(series_id, season_num, episode_num) WHERE deleted_at IS NULL`,
+		`CREATE INDEX IF NOT EXISTS idx_media_library_series_active ON media(library_id, series_id, season_num, episode_num) WHERE deleted_at IS NULL`,
+		`CREATE INDEX IF NOT EXISTS idx_media_library_tmdb_active ON media(library_id, tm_db_id) WHERE deleted_at IS NULL`,
+		`CREATE INDEX IF NOT EXISTS idx_media_library_bangumi_active ON media(library_id, bangumi_id) WHERE deleted_at IS NULL`,
+		`CREATE INDEX IF NOT EXISTS idx_media_library_douban_active ON media(library_id, douban_id) WHERE deleted_at IS NULL`,
+		`CREATE INDEX IF NOT EXISTS idx_media_library_thetvdb_active ON media(library_id, thetvdb_id) WHERE deleted_at IS NULL`,
 		`CREATE INDEX IF NOT EXISTS idx_favorites_user_media_active ON favorites(user_id, media_id) WHERE deleted_at IS NULL`,
 		`CREATE INDEX IF NOT EXISTS idx_playback_histories_user_media_active ON playback_histories(user_id, media_id, watched_at DESC) WHERE deleted_at IS NULL`,
 		`CREATE INDEX IF NOT EXISTS idx_playback_histories_resume_active ON playback_histories(user_id, completed, watched_at DESC) WHERE deleted_at IS NULL`,

internal/handler/cloud115_playback.go

@@ -0,0 +1,148 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+func mediaPlaybackInfoHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if svc == nil || svc.Cloud115 == nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": "cloud115 playback unavailable"})
+			return
+		}
+		m, err := svc.Media.GetMedia(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil || !mediaVisibleForRequest(c, svc, m) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+			return
+		}
+		if !enforceScopedPlaybackToken(c, m.ID) {
+			return
+		}
+		quality, _ := strconv.Atoi(c.Query("quality"))
+		info, err := svc.Cloud115.PlaybackInfo(c.Request.Context(), m.ID, quality)
+		if err != nil {
+			if errors.Is(err, service.ErrMediaNotFound) {
+				c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+				return
+			}
+			c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, info)
+	}
+}
+
+func mediaTranscodeHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if svc == nil || svc.Cloud115 == nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": "cloud115 playback unavailable"})
+			return
+		}
+		m, err := svc.Media.GetMedia(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil || !mediaVisibleForRequest(c, svc, m) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+			return
+		}
+		if !enforceScopedPlaybackToken(c, m.ID) {
+			return
+		}
+		var req struct {
+			Definition int `json:"definition"`
+		}
+		_ = c.ShouldBindJSON(&req)
+		info, err := svc.Cloud115.StartTranscode(c.Request.Context(), m.ID, req.Definition)
+		if err != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, info)
+	}
+}
+
+func cloud115HLSMasterHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if svc == nil || svc.Cloud115 == nil || svc.Cloud115.HLSProxy() == nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": "cloud115 playback unavailable"})
+			return
+		}
+		m, err := svc.Media.GetMedia(c.Request.Context(), c.Param("id"))
+		if err != nil || m == nil || !mediaVisibleForRequest(c, svc, m) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+			return
+		}
+		if !enforceScopedPlaybackToken(c, m.ID) {
+			return
+		}
+		definition, _ := strconv.Atoi(c.Query("definition"))
+		err = svc.Cloud115.HLSProxy().ServeMaster(c.Request.Context(), c.Writer, c.Request, m.ID, definition)
+		if err == nil {
+			return
+		}
+		if c.Writer.Written() {
+			return
+		}
+		if errors.Is(err, service.ErrCloud115TranscodePending) {
+			retryAfter := 5
+			message := "115 正在转码，请稍候"
+			var info *service.PlaybackInfo
+			if latest, infoErr := svc.Cloud115.PlaybackInfo(c.Request.Context(), m.ID, definition); infoErr == nil && latest != nil {
+				info = latest
+				if latest.Transcode.Message != "" {
+					message = latest.Transcode.Message
+				}
+				if latest.Transcode.RetryAfterSec > 0 {
+					retryAfter = latest.Transcode.RetryAfterSec
+				}
+			}
+			c.JSON(http.StatusConflict, gin.H{
+				"code":            "transcode_pending",
+				"message":         message,
+				"retry_after_sec": retryAfter,
+				"playback":        info,
+			})
+			return
+		}
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+	}
+}
+
+func cloud115HLSSessionHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if svc == nil || svc.Cloud115 == nil || svc.Cloud115.HLSProxy() == nil {
+			c.JSON(http.StatusServiceUnavailable, gin.H{"error": "cloud115 playback unavailable"})
+			return
+		}
+		mediaID := c.Query("media_id")
+		if mediaID == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "missing media_id"})
+			return
+		}
+		if !enforceScopedPlaybackToken(c, mediaID) {
+			return
+		}
+		err := svc.Cloud115.HLSProxy().ServeChild(
+			c.Request.Context(),
+			c.Writer,
+			c.Request,
+			c.Param("session"),
+			c.Param("key"),
+		)
+		if err == nil || c.Writer.Written() {
+			return
+		}
+		switch {
+		case errors.Is(err, service.ErrCloud115HLSSessionNotFound):
+			c.JSON(http.StatusNotFound, gin.H{"error": "hls session not found"})
+		case errors.Is(err, service.ErrCloud115HLSUpstreamExpired):
+			c.JSON(http.StatusGone, gin.H{"error": "hls upstream expired"})
+		default:
+			c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		}
+	}
+}

internal/handler/danmaku.go

@@ -2,6 +2,7 @@
 package handler
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 
@@ -16,10 +17,8 @@ import (
 func getDanmakuHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid := currentUserID(c)
-		// 弹幕合并偏好按用户存储：这里读取后作为本次抓取的选项传入。
-		opts := service.DanmakuFetchOptions{
-			MergeSources: svc.Danmaku.MergeSourcesEnabled(c.Request.Context(), uid),
-		}
+		// 按用户读取弹幕源、凭据、合并偏好和渲染参数。
+		opts := service.DanmakuFetchOptions{UserID: uid}
 		res, err := svc.Danmaku.FetchWithOptions(
 			c.Request.Context(), c.Param("id"), c.Query("kw"), c.Query("episodeId"), opts)
 		if err != nil {
@@ -30,17 +29,15 @@ func getDanmakuHandler(svc *service.Container) gin.HandlerFunc {
 	}
 }
 
-// getDanmakuConfigHandler exposes the danmaku renderer knobs (opacity, font
-// size, area, enabled) so the player can initialize its control panel without
-// admin privileges.
+// getDanmakuConfigHandler exposes the current user's player volume and danmaku
+// preferences so the player can initialize without admin privileges.
 func getDanmakuConfigHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.JSON(http.StatusOK, svc.Danmaku.ConfigForUser(c.Request.Context(), currentUserID(c)))
 	}
 }
 
-// updateDanmakuSettingsHandler 持久化当前用户的弹幕偏好。目前只有合并开关，
-// 落在 user 表上（与字幕简繁偏好同样按用户存储）。
+// updateDanmakuSettingsHandler 持久化当前用户的播放器音量与弹幕偏好。
 func updateDanmakuSettingsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid := currentUserID(c)
@@ -48,21 +45,20 @@ func updateDanmakuSettingsHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
 			return
 		}
-		var req struct {
-			MergeSources *bool `json:"merge_sources"`
-		}
+		var req service.DanmakuSettingsPatch
 		if err := c.ShouldBindJSON(&req); err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid body"})
 			return
 		}
-		if req.MergeSources == nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "merge_sources is required"})
+		cfg, err := svc.Danmaku.UpdateUserSettings(c.Request.Context(), uid, req)
+		if errors.Is(err, service.ErrNoDanmakuSettings) || errors.Is(err, service.ErrInvalidDanmakuSettings) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
-		if err := svc.Danmaku.SetMergeSources(c.Request.Context(), uid, *req.MergeSources); err != nil {
+		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
-		c.JSON(http.StatusOK, gin.H{"merge_sources": *req.MergeSources})
+		c.JSON(http.StatusOK, cfg)
 	}
 }

internal/handler/danmaku_settings_test.go

@@ -112,7 +112,8 @@ func TestGetDanmakuConfigIncludesPerUserMergePreference(t *testing.T) {
 		t.Fatalf("status = %d, want 200", w.Code)
 	}
 	var cfg struct {
-		MergeSources bool `json:"merge_sources"`
+		MergeSources bool    `json:"merge_sources"`
+		PlaybackRate float64 `json:"playback_rate"`
 	}
 	if err := json.Unmarshal(w.Body.Bytes(), &cfg); err != nil {
 		t.Fatalf("decode: %v", err)
@@ -120,6 +121,9 @@ func TestGetDanmakuConfigIncludesPerUserMergePreference(t *testing.T) {
 	if cfg.MergeSources {
 		t.Fatal("default merge preference should be false")
 	}
+	if cfg.PlaybackRate != 1 {
+		t.Fatalf("default playback rate = %v, want 1", cfg.PlaybackRate)
+	}
 
 	if err := svc.Danmaku.SetMergeSources(t.Context(), "user-1", true); err != nil {
 		t.Fatalf("set: %v", err)
@@ -133,3 +137,110 @@ func TestGetDanmakuConfigIncludesPerUserMergePreference(t *testing.T) {
 		t.Fatal("config should reflect the persisted merge preference")
 	}
 }
+
+func TestUpdateDanmakuSettingsPersistsAllPlayerPreferences(t *testing.T) {
+	svc := newDanmakuSettingsService(t)
+
+	body := "{\"enabled\":false,\"opacity\":0.6,\"font_size\":32,\"area\":0.7,\"merge_sources\":true,\"volume\":0.35,\"playback_rate\":1.5,\"source\":\"https://dm.example/base/\",\"app_id\":\"my-app-id\",\"app_key\":\"my-app-secret\"}"
+	c, w := newDanmakuSettingsContext(t, svc, http.MethodPut, "/danmaku/settings", body, "user-1")
+	updateDanmakuSettingsHandler(svc)(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (body=%s)", w.Code, w.Body.String())
+	}
+	if bytes.Contains(w.Body.Bytes(), []byte("my-app-secret")) {
+		t.Fatal("response must never expose the application secret")
+	}
+	var cfg service.DanmakuRenderConfig
+	if err := json.Unmarshal(w.Body.Bytes(), &cfg); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if cfg.Enabled || cfg.Opacity != "0.6" || cfg.FontSize != "32" || cfg.Area != "0.7" {
+		t.Fatalf("unexpected render config: %+v", cfg)
+	}
+	if !cfg.MergeSources || cfg.Volume != 0.35 || cfg.PlaybackRate != 1.5 {
+		t.Fatalf("unexpected user preferences: %+v", cfg)
+	}
+	if cfg.Source != "https://dm.example/base" || cfg.AppID != "my-app-id" || !cfg.AppKeyConfigured {
+		t.Fatalf("unexpected service config: %+v", cfg)
+	}
+
+	user, err := svc.Repo.User.FindByID(t.Context(), "user-1")
+	if err != nil || user == nil {
+		t.Fatalf("read persisted user: %v", err)
+	}
+	if user.DanmakuAppKey != "my-app-secret" || user.PlayerVolume != 0.35 || user.PlayerPlaybackRate != 1.5 || user.DanmakuSource != "https://dm.example/base" {
+		t.Fatalf("preferences not persisted: %+v", user)
+	}
+}
+
+func TestUpdateDanmakuSettingsPersistsVr360GuideSeen(t *testing.T) {
+	svc := newDanmakuSettingsService(t)
+
+	// 默认未看过：配置接口必须先如实告知前端，否则首次操作说明会被跳过。
+	initial := svc.Danmaku.ConfigForUser(t.Context(), "user-1")
+	if initial.Vr360GuideSeen {
+		t.Fatal("vr360 guide should be unread for a fresh user")
+	}
+
+	c, w := newDanmakuSettingsContext(t, svc, http.MethodPut, "/danmaku/settings",
+		`{"vr360_guide_seen":true}`, "user-1")
+	updateDanmakuSettingsHandler(svc)(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (body=%s)", w.Code, w.Body.String())
+	}
+	var cfg service.DanmakuRenderConfig
+	if err := json.Unmarshal(w.Body.Bytes(), &cfg); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !cfg.Vr360GuideSeen {
+		t.Fatalf("config should reflect the persisted guide flag: %+v", cfg)
+	}
+
+	user, err := svc.Repo.User.FindByID(t.Context(), "user-1")
+	if err != nil || user == nil {
+		t.Fatalf("read persisted user: %v", err)
+	}
+	if !user.PlayerVr360GuideSeen {
+		t.Fatalf("guide flag not persisted on the user: %+v", user)
+	}
+}
+
+func TestUpdateDanmakuSettingsRejectsInvalidPlaybackRate(t *testing.T) {
+	svc := newDanmakuSettingsService(t)
+
+	c, w := newDanmakuSettingsContext(t, svc, http.MethodPut, "/danmaku/settings",
+		`{"playback_rate":4}`, "user-1")
+	updateDanmakuSettingsHandler(svc)(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (body=%s)", w.Code, w.Body.String())
+	}
+	user, err := svc.Repo.User.FindByID(t.Context(), "user-1")
+	if err != nil || user == nil {
+		t.Fatalf("read user: %v", err)
+	}
+	if user.PlayerPlaybackRate != 1 {
+		t.Fatalf("invalid playback rate was persisted: %v", user.PlayerPlaybackRate)
+	}
+}
+
+func TestUpdateDanmakuSettingsRejectsInvalidSource(t *testing.T) {
+	svc := newDanmakuSettingsService(t)
+
+	c, w := newDanmakuSettingsContext(t, svc, http.MethodPut, "/danmaku/settings",
+		`{"source":"ftp://dm.example.com"}`, "user-1")
+	updateDanmakuSettingsHandler(svc)(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (body=%s)", w.Code, w.Body.String())
+	}
+	user, err := svc.Repo.User.FindByID(t.Context(), "user-1")
+	if err != nil || user == nil {
+		t.Fatalf("read user: %v", err)
+	}
+	if user.DanmakuSource != "" {
+		t.Fatalf("invalid source was persisted: %q", user.DanmakuSource)
+	}
+}

internal/handler/emby_auth.go

@@ -26,6 +26,13 @@ func embyUserID(c *gin.Context) string {
 	return ""
 }
 
+// embyEffectiveUserID 返回当前鉴权用户。收藏、续播、播放进度等用户态数据必须
+// 绑定到登录身份；路径/Query 里的 UserId 只是 Emby URL 形态兼容，不能覆盖鉴权结果，
+// 否则多用户会串到同一个 UserId 上。
+func embyEffectiveUserID(c *gin.Context) string {
+	return embyUserID(c)
+}
+
 const embyCompatSessionTTL = 30 * time.Minute
 
 type embyCompatSession struct {

internal/handler/emby_items_handlers.go

@@ -13,13 +13,7 @@ import (
 func parseEmbyItemsParams(c *gin.Context) service.ItemsParams {
 	limit, _ := strconv.Atoi(embyFirstNonEmptyString(firstQueryValue(c, "Limit", "limit"), "50"))
 	offset, _ := strconv.Atoi(embyFirstNonEmptyString(firstQueryValue(c, "StartIndex", "startIndex", "startindex"), "0"))
-	uid := c.Param("userId")
-	if uid == "" {
-		uid = firstQueryValue(c, "UserId", "userId", "userid")
-	}
-	if uid == "" {
-		uid = embyUserID(c)
-	}
+	uid := embyEffectiveUserID(c)
 	splitOpt := func(s string) []string {
 		if s == "" {
 			return nil
@@ -46,9 +40,28 @@ func parseEmbyItemsParams(c *gin.Context) service.ItemsParams {
 		SortOrder:        firstQueryValue(c, "SortOrder", "sortOrder", "sortorder"),
 		Limit:            limit,
 		StartIndex:       offset,
+		SeasonIndex:      parseEmbySeasonIndexQuery(c),
 	}
 }
 
+// parseEmbySeasonIndexQuery 读取客户端请求的季序号。
+//
+// Emby 客户端有两种表达方式：SeasonId（虚拟季 ID）与 Season / SeasonIndex
+// （季序号，特别篇为 0）。两者都是合法入参，SeasonId 更精确。这里只解析季序号，
+// 返回 nil 表示客户端没有按季过滤（区别于 Season=0 的特别篇）。
+func parseEmbySeasonIndexQuery(c *gin.Context) *int {
+	raw := firstQueryValue(c, "Season", "season", "SeasonIndex", "seasonIndex", "seasonindex")
+	if raw == "" {
+		return nil
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil {
+		// 客户端偶尔传入季名称之类的非数字值；按「未过滤」处理，避免整季空结果。
+		return nil
+	}
+	return &value
+}
+
 func embyFirstNonEmptyString(values ...string) string {
 	for _, value := range values {
 		if strings.TrimSpace(value) != "" {
@@ -73,10 +86,7 @@ func embyItemsHandler(svc *service.Container) gin.HandlerFunc {
 func embyItemByIDHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		id := c.Param("id")
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		out, err := svc.Emby.Item(c.Request.Context(), id, uid)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -106,13 +116,7 @@ func embyUserItemByIDHandler(svc *service.Container) gin.HandlerFunc {
 
 func embyLatestItemsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = firstQueryValue(c, "UserId", "userId", "userid")
-		}
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		limit, _ := strconv.Atoi(embyFirstNonEmptyString(firstQueryValue(c, "Limit", "limit"), "20"))
 		out, err := svc.Emby.LatestItems(c.Request.Context(), uid, firstQueryValue(c, "ParentId", "parentId", "parentid"), limit)
 		if err != nil {
@@ -126,13 +130,7 @@ func embyLatestItemsHandler(svc *service.Container) gin.HandlerFunc {
 
 func embyResumeItemsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = firstQueryValue(c, "UserId", "userId", "userid")
-		}
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		limit, _ := strconv.Atoi(embyFirstNonEmptyString(firstQueryValue(c, "Limit", "limit"), "20"))
 		out, err := svc.Emby.ResumeItems(c.Request.Context(), uid, limit)
 		if err != nil {
@@ -147,13 +145,7 @@ func embyResumeItemsHandler(svc *service.Container) gin.HandlerFunc {
 func embyItemsCountsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		if svc != nil && svc.Emby != nil {
-			uid := firstQueryValue(c, "UserId", "userId")
-			if uid == "" {
-				uid = c.Param("userId")
-			}
-			if uid == "" {
-				uid = embyUserID(c)
-			}
+			uid := embyEffectiveUserID(c)
 			out, err := svc.Emby.ItemCounts(c.Request.Context(), uid)
 			if err != nil {
 				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -209,7 +201,7 @@ func embySaveDisplayPreferencesHandler(_ *service.Container) gin.HandlerFunc {
 func embyShowSeasonsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		params := service.ItemsParams{
-			UserID:   firstQueryValue(c, "UserId", "userId"),
+			UserID:   embyEffectiveUserID(c),
 			ParentID: c.Param("id"),
 			Limit:    500,
 		}
@@ -226,15 +218,23 @@ func embyShowSeasonsHandler(svc *service.Container) gin.HandlerFunc {
 func embyShowEpisodesHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		parentID := firstQueryValue(c, "SeasonId", "seasonId")
+		// 客户端常用季序号而不是虚拟季 ID 请求剧集。缺了这层过滤，
+		// /Shows/{id}/Episodes?Season=2 会把整部剧的所有季都返回。
+		seasonIndex := parseEmbySeasonIndexQuery(c)
 		if parentID == "" {
 			parentID = c.Param("id")
+		} else {
+			// SeasonId 已经限定了具体季，忽略同时传来的季序号，避免两者
+			// 不一致时把结果过滤成空集。
+			seasonIndex = nil
 		}
 		params := service.ItemsParams{
-			UserID:           firstQueryValue(c, "UserId", "userId"),
+			UserID:           embyEffectiveUserID(c),
 			ParentID:         parentID,
 			IncludeItemTypes: []string{"Episode"},
 			Recursive:        true,
 			Limit:            500,
+			SeasonIndex:      seasonIndex,
 		}
 		out, err := svc.Emby.Items(c.Request.Context(), params)
 		if err != nil {

internal/handler/emby_playback.go

@@ -13,10 +13,7 @@ import (
 
 func embyPlaybackInfoHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		out, err := svc.Emby.PlaybackInfo(c.Request.Context(), c.Param("id"), uid)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -47,10 +44,7 @@ func embySubtitleStreamHandler(svc *service.Container) gin.HandlerFunc {
 			}
 			return
 		}
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		ctx := c.Request.Context()
 		// The official-format route carries a :format suffix (Stream.ass /
 		// Stream.vtt); prefer it for the Content-Type when present, otherwise

internal/handler/emby_playstate_handlers.go

@@ -92,10 +92,7 @@ func embyPlayingProgressHandler(svc *service.Container) gin.HandlerFunc {
 
 func embyFavoriteHandler(svc *service.Container, fav bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		mid := c.Param("itemId")
 		if uid == "" || mid == "" {
 			c.Status(http.StatusBadRequest)
@@ -116,10 +113,7 @@ func embyFavoriteHandler(svc *service.Container, fav bool) gin.HandlerFunc {
 
 func embyMarkPlayedHandler(svc *service.Container, played bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		mid := c.Param("itemId")
 		if uid == "" || mid == "" {
 			c.Status(http.StatusBadRequest)

internal/handler/emby_show_episodes_season_test.go

@@ -0,0 +1,211 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/truewhile/MeBox/internal/config"
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+// embySeasonEpisodesRouter builds an Emby-compatible router over one series with
+// two seasons, so /Shows/{id}/Episodes can be exercised with the query forms
+// real clients send.
+func embySeasonEpisodesRouter(t *testing.T) (*gin.Engine, string, string) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(&model.User{}, &model.Library{}, &model.Series{}, &model.Media{}, &model.Favorite{}, &model.PlaybackHistory{}, &model.Setting{}); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	if sqlDB, err := db.DB(); err == nil {
+		sqlDB.SetMaxOpenConns(1)
+	}
+	repos := repository.New(db)
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "剧集", Path: "D:\\media\\tv", Type: "tv", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	for _, m := range []model.Media{
+		{
+			Base:       model.Base{ID: "s1e1"},
+			LibraryID:  lib.ID,
+			Title:      "Test Show",
+			Path:       "D:\\media\\tv\\Test Show\\Season 01\\Test Show - S01E01.mkv",
+			SeasonNum:  1,
+			EpisodeNum: 1,
+			Container:  "mkv",
+		},
+		{
+			Base:       model.Base{ID: "s2e1"},
+			LibraryID:  lib.ID,
+			Title:      "Test Show",
+			Path:       "D:\\media\\tv\\Test Show\\Season 02\\Test Show - S02E01.mkv",
+			SeasonNum:  2,
+			EpisodeNum: 1,
+			Container:  "mkv",
+		},
+	} {
+		if err := db.Create(&m).Error; err != nil {
+			t.Fatalf("create media: %v", err)
+		}
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo: repos,
+		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+	})
+
+	// Resolve the virtual series id the way a client would.
+	seriesReq := httptest.NewRequest(http.MethodGet, "/Items?ParentId="+lib.ID+"&IncludeItemTypes=Series", nil)
+	seriesReq.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	seriesRec := httptest.NewRecorder()
+	router.ServeHTTP(seriesRec, seriesReq)
+	if seriesRec.Code != http.StatusOK {
+		t.Fatalf("series lookup status=%d body=%s", seriesRec.Code, seriesRec.Body.String())
+	}
+	var seriesPayload struct {
+		Items []map[string]any `json:"Items"`
+	}
+	if err := json.Unmarshal(seriesRec.Body.Bytes(), &seriesPayload); err != nil {
+		t.Fatalf("decode series: %v", err)
+	}
+	if len(seriesPayload.Items) != 1 {
+		t.Fatalf("want one series, got %#v", seriesPayload.Items)
+	}
+	seriesID, _ := seriesPayload.Items[0]["Id"].(string)
+	if seriesID == "" {
+		t.Fatalf("series payload has no Id: %#v", seriesPayload.Items[0])
+	}
+	return router, secret, seriesID
+}
+
+func fetchEpisodeIDs(t *testing.T, router *gin.Engine, secret, path string) ([]string, int) {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("%s status=%d body=%s", path, rec.Code, rec.Body.String())
+	}
+	var payload struct {
+		Items            []map[string]any `json:"Items"`
+		TotalRecordCount float64          `json:"TotalRecordCount"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("decode %s: %v", path, err)
+	}
+	ids := make([]string, 0, len(payload.Items))
+	for _, item := range payload.Items {
+		id, _ := item["Id"].(string)
+		ids = append(ids, id)
+	}
+	return ids, int(payload.TotalRecordCount)
+}
+
+// TestEmbyShowEpisodesHonoursSeasonQueryParam is the client-facing regression
+// test: Emby clients scope episodes with ?Season=<index> (not only SeasonId), and
+// the endpoint used to ignore it and return every season of the series.
+func TestEmbyShowEpisodesHonoursSeasonQueryParam(t *testing.T) {
+	router, secret, seriesID := embySeasonEpisodesRouter(t)
+
+	cases := []struct {
+		name    string
+		query   string
+		wantIDs []string
+	}{
+		{name: "season 1", query: "Season=1", wantIDs: []string{"s1e1"}},
+		{name: "season 2", query: "Season=2", wantIDs: []string{"s2e1"}},
+		{name: "season index alias", query: "SeasonIndex=2", wantIDs: []string{"s2e1"}},
+		{name: "no season returns all", query: "", wantIDs: []string{"s1e1", "s2e1"}},
+		{name: "unknown season is empty", query: "Season=9", wantIDs: []string{}},
+		{name: "non numeric season falls back to all", query: "Season=Specials", wantIDs: []string{"s1e1", "s2e1"}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			path := "/Shows/" + seriesID + "/Episodes"
+			if tc.query != "" {
+				path += "?" + tc.query
+			}
+			ids, total := fetchEpisodeIDs(t, router, secret, path)
+			if len(ids) != len(tc.wantIDs) {
+				t.Fatalf("episode ids = %#v (total=%d), want %#v", ids, total, tc.wantIDs)
+			}
+			for i := range tc.wantIDs {
+				if ids[i] != tc.wantIDs[i] {
+					t.Fatalf("episode ids = %#v, want %#v", ids, tc.wantIDs)
+				}
+			}
+			if total != len(tc.wantIDs) {
+				t.Fatalf("TotalRecordCount = %d, want %d", total, len(tc.wantIDs))
+			}
+		})
+	}
+}
+
+// TestEmbyShowEpisodesSeasonIdStillWins pins that the virtual SeasonId form keeps
+// working, and that a conflicting Season query cannot empty it out.
+func TestEmbyShowEpisodesSeasonIdStillWins(t *testing.T) {
+	router, secret, seriesID := embySeasonEpisodesRouter(t)
+
+	seasonsPath := "/Shows/" + seriesID + "/Seasons"
+	req := httptest.NewRequest(http.MethodGet, seasonsPath, nil)
+	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("seasons status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var seasons struct {
+		Items []map[string]any `json:"Items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &seasons); err != nil {
+		t.Fatalf("decode seasons: %v", err)
+	}
+	var season1ID string
+	for _, s := range seasons.Items {
+		if index, ok := s["IndexNumber"].(float64); ok && int(index) == 1 {
+			season1ID, _ = s["Id"].(string)
+		}
+	}
+	if season1ID == "" {
+		t.Fatalf("season 1 not found in %#v", seasons.Items)
+	}
+
+	ids, _ := fetchEpisodeIDs(t, router, secret, "/Shows/"+seriesID+"/Episodes?SeasonId="+season1ID)
+	if len(ids) != 1 || ids[0] != "s1e1" {
+		t.Fatalf("SeasonId episodes = %#v, want [s1e1]", ids)
+	}
+
+	// A stale/conflicting season number must not override the explicit season id.
+	ids, _ = fetchEpisodeIDs(t, router, secret, "/Shows/"+seriesID+"/Episodes?SeasonId="+season1ID+"&Season=2")
+	if len(ids) != 1 || ids[0] != "s1e1" {
+		t.Fatalf("SeasonId+Season episodes = %#v, want [s1e1]", ids)
+	}
+}

internal/handler/emby_views_handlers.go

@@ -10,10 +10,7 @@ import (
 
 func embyViewsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		uid := c.Param("userId")
-		if uid == "" {
-			uid = embyUserID(c)
-		}
+		uid := embyEffectiveUserID(c)
 		out, err := svc.Emby.Views(c.Request.Context(), uid)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})

internal/handler/handler.go

@@ -19,6 +19,7 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 	api.Use(middleware.GzipAPI())
 	{
 		api.GET("/health", healthCheck)
+		api.HEAD("/health", healthCheck)
 		api.GET("/version", versionInfo)
 		api.GET("/public/ui-config", publicUIConfigHandler(svc))
 

internal/handler/media.go

@@ -8,6 +8,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
@@ -32,10 +33,10 @@ type createLibraryReq struct {
 // 统一结构（远程库附加 is_remote_emby / remote_source 只读标记）。
 type webLibraryPayload struct {
 	model.Library
-	IsRemoteEmby bool                 `json:"is_remote_emby,omitempty"`
-	RemoteSource string               `json:"remote_source,omitempty"`
-	Total        int64                `json:"total,omitempty"`
-	Cards        []service.SeriesCard `json:"cards,omitempty"`
+	IsRemoteEmby bool                     `json:"is_remote_emby,omitempty"`
+	RemoteSource string                   `json:"remote_source,omitempty"`
+	Total        int64                    `json:"total,omitempty"`
+	Cards        []service.SeriesCardView `json:"cards,omitempty"`
 }
 
 // remoteLibraryItemTypes 远程库内容拉取时按 CollectionType 过滤直属条目，
@@ -60,37 +61,37 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 		}
 		role, _ := c.Get(middleware.CtxUserRole)
 		includeHidden := role == "admin" && (c.Query("include_hidden") == "1" || c.Query("include_hidden") == "true" || c.Query("all") == "1")
-			if !includeHidden {
-				libs = service.FilterDisplayCloudLibraries(ctx, svc.Repo, libs)
-				visibility := mediaVisibilityForRequest(c, svc)
-				filtered := libs[:0]
-				for _, lib := range libs {
-					if service.LibraryVisibleForUser(ctx, svc.Repo, lib, visibility) {
-						filtered = append(filtered, lib)
-					}
-				}
-				libs = filtered
-			}
-			rawIDs := strings.TrimSpace(c.Query("ids"))
-			var targetSet map[string]struct{}
-			if rawIDs != "" {
-				targetSet = make(map[string]struct{})
-				for _, id := range strings.Split(rawIDs, ",") {
-					id = strings.TrimSpace(id)
-					if id != "" {
-						targetSet[id] = struct{}{}
-					}
+		if !includeHidden {
+			libs = service.FilterDisplayCloudLibraries(ctx, svc.Repo, libs)
+			visibility := mediaVisibilityForRequest(c, svc)
+			filtered := libs[:0]
+			for _, lib := range libs {
+				if service.LibraryVisibleForUser(ctx, svc.Repo, lib, visibility) {
+					filtered = append(filtered, lib)
 				}
 			}
-			if len(targetSet) > 0 {
-				filtered := libs[:0]
-				for _, lib := range libs {
-					if _, ok := targetSet[lib.ID]; ok {
-						filtered = append(filtered, lib)
-					}
+			libs = filtered
+		}
+		rawIDs := strings.TrimSpace(c.Query("ids"))
+		var targetSet map[string]struct{}
+		if rawIDs != "" {
+			targetSet = make(map[string]struct{})
+			for _, id := range strings.Split(rawIDs, ",") {
+				id = strings.TrimSpace(id)
+				if id != "" {
+					targetSet[id] = struct{}{}
 				}
-				libs = filtered
 			}
+		}
+		if len(targetSet) > 0 {
+			filtered := libs[:0]
+			for _, lib := range libs {
+				if _, ok := targetSet[lib.ID]; ok {
+					filtered = append(filtered, lib)
+				}
+			}
+			libs = filtered
+		}
 		withPreview := c.Query("with_preview") == "1" || c.Query("with_preview") == "true"
 		limit := 10
 		if withPreview {
@@ -103,49 +104,72 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 		}
 		out := make([]webLibraryPayload, 0, len(libs)+8)
 		if withPreview {
-			previews, err := svc.Media.ListLibrariesWithPreview(ctx, libs, mediaVisibilityForRequest(c, svc), limit)
+			var previews []service.LibraryPreviewItem
+			if c.Query("include_total") == "0" {
+				previews, err = svc.Media.ListLibraryPreviews(ctx, libs, mediaVisibilityForRequest(c, svc), limit)
+			} else {
+				previews, err = svc.Media.ListLibrariesWithPreview(ctx, libs, mediaVisibilityForRequest(c, svc), limit)
+			}
 			if err != nil {
 				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 				return
 			}
 			for _, p := range previews {
-				out = append(out, webLibraryPayload{Library: p.Library, Total: p.Total, Cards: p.Cards})
-			}
-			} else {
-				visibility := mediaVisibilityForRequest(c, svc)
-				libIDs := make([]string, len(libs))
-				for i, l := range libs {
-					libIDs[i] = l.ID
-				}
-				counts, _ := svc.Repo.Media.CountByLibraries(ctx, libIDs, repository.MediaQueryFilter{
-					IncludeNSFW:       visibility.IncludeNSFW,
-					AllowedLibraryIDs: visibility.AllowedLibraryIDs,
-					HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
+				out = append(out, webLibraryPayload{
+					Library: p.Library,
+					Total:   p.Total,
+					Cards:   service.NewSeriesCardViews(p.Cards),
 				})
-				for _, l := range libs {
-					var total int64
-					if counts != nil {
-						total = counts[l.ID]
-					}
-					out = append(out, webLibraryPayload{Library: l, Total: total})
+			}
+		} else {
+			visibility := mediaVisibilityForRequest(c, svc)
+			libIDs := make([]string, len(libs))
+			for i, l := range libs {
+				libIDs[i] = l.ID
+			}
+			counts, _ := svc.Media.CountLibrariesCached(ctx, libIDs, repository.MediaQueryFilter{
+				IncludeNSFW:       visibility.IncludeNSFW,
+				AllowedLibraryIDs: visibility.AllowedLibraryIDs,
+				HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
+			})
+			for _, l := range libs {
+				var total int64
+				if counts != nil {
+					total = counts[l.ID]
+				}
+				out = append(out, webLibraryPayload{Library: l, Total: total})
+			}
+		}
+		// 精确指定目标库时，如果目标全是本地库，就不必枚举远程挂载。
+		// 首页预览会拆成多个小批次请求，跳过无关远程调用可以明显缩短
+		// 每批次的尾延迟；未指定 ids 的完整库列表仍保持原行为。
+		includeRemote := true
+		if len(targetSet) > 0 {
+			includeRemote = false
+			for id := range targetSet {
+				if service.IsEmbyRemoteID(id) {
+					includeRemote = true
+					break
 				}
 			}
+		}
+
 		// 远程 Emby 挂载库追加在本地库之后（非管理员视图仍受 allowed_library_ids 约束）。
-		if svc.EmbyRemote != nil {
+		if includeRemote && svc.EmbyRemote != nil {
 			if views, err := svc.EmbyRemote.RemoteLibraries(ctx); err == nil {
-					visibility := mediaVisibilityForRequest(c, svc)
-					allowedViews := make([]service.RemoteLibraryView, 0, len(views))
-					for _, v := range views {
-						if !includeHidden && !service.LibraryVisibleForUser(ctx, svc.Repo, v.Library, visibility) {
+				visibility := mediaVisibilityForRequest(c, svc)
+				allowedViews := make([]service.RemoteLibraryView, 0, len(views))
+				for _, v := range views {
+					if !includeHidden && !service.LibraryVisibleForUser(ctx, svc.Repo, v.Library, visibility) {
+						continue
+					}
+					if len(targetSet) > 0 {
+						if _, ok := targetSet[v.Library.ID]; !ok {
 							continue
 						}
-						if len(targetSet) > 0 {
-							if _, ok := targetSet[v.Library.ID]; !ok {
-								continue
-							}
-						}
-						allowedViews = append(allowedViews, v)
 					}
+					allowedViews = append(allowedViews, v)
+				}
 				remotePayloads := make([]webLibraryPayload, len(allowedViews))
 				for i, v := range allowedViews {
 					remotePayloads[i] = webLibraryPayload{Library: v.Library, IsRemoteEmby: true, RemoteSource: v.AccountName}
@@ -170,19 +194,19 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 								if acct == nil {
 									return
 								}
-									tmpMount := &model.EmbyMount{
-										Base:           model.Base{ID: v.MountID},
-										AccountID:      v.AccountID,
-										RemoteViewID:   v.RemoteID,
-										CollectionType: v.CollectionType,
-										Name:           v.Library.Name,
-									}
+								tmpMount := &model.EmbyMount{
+									Base:           model.Base{ID: v.MountID},
+									AccountID:      v.AccountID,
+									RemoteViewID:   v.RemoteID,
+									CollectionType: v.CollectionType,
+									Name:           v.Library.Name,
+								}
 								itemTypes := remoteLibraryItemTypes(v.CollectionType)
 								if _, total, err := svc.EmbyRemote.RemoteLibraryMedia(ctx, tmpMount, acct, v.RemoteID, itemTypes, 0, 1); err == nil {
 									remotePayloads[i].Total = total
 								}
 								if cards, err := svc.EmbyRemote.RemoteLatestCards(ctx, tmpMount, acct, v.RemoteID, limit); err == nil {
-									remotePayloads[i].Cards = cards
+									remotePayloads[i].Cards = service.NewSeriesCardViews(cards)
 								}
 							})
 						}()
@@ -421,9 +445,14 @@ func listMediaHandler(svc *service.Container) gin.HandlerFunc {
 			})
 			return
 		}
+		sortSpec := parseMediaSort(c)
+		var history map[string]time.Time
+		if sortSpec.Field == "last_played" {
+			history = mediaHistoryMap(c, svc)
+		}
 		groupVersions := c.DefaultQuery("group_versions", "1") != "0"
 		if !groupVersions {
-			items, total, err := svc.Media.ListMediaVisible(c.Request.Context(), id, page, size, mediaVisibilityForRequest(c, svc))
+			items, total, err := svc.Media.ListMediaVisible(ctx, id, page, size, mediaVisibilityForRequest(c, svc))
 			if err != nil {
 				writeInternalOrCanceled(c, err)
 				return
@@ -439,17 +468,19 @@ func listMediaHandler(svc *service.Container) gin.HandlerFunc {
 			})
 			return
 		}
-		items, total, err := svc.Media.ListMediaVisibleGrouped(c.Request.Context(), id, page, size, mediaVisibilityForRequest(c, svc))
+		grouped, err := svc.Media.GroupedMediaVisible(ctx, id, mediaVisibilityForRequest(c, svc))
 		if err != nil {
 			writeInternalOrCanceled(c, err)
 			return
 		}
+		grouped = service.SortMediaItems(grouped, sortSpec.Field, sortSpec.Order, history)
+		items := service.PaginateMediaItems(grouped, page, size)
 		if items == nil {
 			items = []service.MediaItem{}
 		}
 		c.JSON(http.StatusOK, gin.H{
 			"items":     items,
-			"total":     total,
+			"total":     len(grouped),
 			"page":      page,
 			"page_size": size,
 		})
@@ -691,7 +722,9 @@ func streamHandler(svc *service.Container) gin.HandlerFunc {
 				c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 				return
 			}
-			if mount.ProxyPlay {
+			// 远程 Emby 条目的同源转发：VR 全景需要浏览器读帧（见 stream_proxy.go），
+			// 与挂载账号的 proxy_play 开关等价。
+			if mount.ProxyPlay || wantSameOriginProxy(c) {
 				if err := svc.Emby.ProxyRemoteVideoStream(ctx, c.Writer, c.Request, mountID, remoteID); err != nil {
 					if !c.Writer.Written() {
 						c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
@@ -699,25 +732,25 @@ func streamHandler(svc *service.Container) gin.HandlerFunc {
 				}
 				return
 			}
-				target, err := svc.EmbyRemote.WebStreamURL(ctx, acct, remoteID)
-				if err != nil {
-					c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-					return
-				}
-				// 现代浏览器在 HTTPS 页面中请求不安全源（HTTP 视频流）会直接报 Mixed Content 拦截导致播放失败。
-				// 仅当当前前端请求为 HTTPS 且远程直连目标为 HTTP 时，自动降级通过本机反向代理传输流，避免播放被浏览器阻断；
-				// 其它场景（HTTP 页面访问 HTTP/HTTPS，或 HTTPS 访问 HTTPS）继续 302 直连，最大化节省服务器带宽与流量。
-				if requestIsHTTPS(c) && strings.HasPrefix(strings.ToLower(target), "http://") {
-					if err := svc.Emby.ProxyRemoteVideoStream(ctx, c.Writer, c.Request, mountID, remoteID); err != nil {
-						if !c.Writer.Written() {
-							c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
-						}
-					}
-					return
-				}
-				setRedirectNoStoreHeaders(c)
-				c.Redirect(http.StatusFound, target)
+			target, err := svc.EmbyRemote.WebStreamURL(ctx, acct, remoteID)
+			if err != nil {
+				c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 				return
+			}
+			// 现代浏览器在 HTTPS 页面中请求不安全源（HTTP 视频流）会直接报 Mixed Content 拦截导致播放失败。
+			// 仅当当前前端请求为 HTTPS 且远程直连目标为 HTTP 时，自动降级通过本机反向代理传输流，避免播放被浏览器阻断；
+			// 其它场景（HTTP 页面访问 HTTP/HTTPS，或 HTTPS 访问 HTTPS）继续 302 直连，最大化节省服务器带宽与流量。
+			if requestIsHTTPS(c) && strings.HasPrefix(strings.ToLower(target), "http://") {
+				if err := svc.Emby.ProxyRemoteVideoStream(ctx, c.Writer, c.Request, mountID, remoteID); err != nil {
+					if !c.Writer.Written() {
+						c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+					}
+				}
+				return
+			}
+			setRedirectNoStoreHeaders(c)
+			c.Redirect(http.StatusFound, target)
+			return
 		}
 		m, err := svc.Media.GetMedia(ctx, id)
 		if err != nil || m == nil || !mediaVisibleForRequest(c, svc, m) {
@@ -727,6 +760,15 @@ func streamHandler(svc *service.Container) gin.HandlerFunc {
 		if !enforceScopedPlaybackToken(c, m.ID) {
 			return
 		}
+		// ?proxy=1：把网盘/STRM 直链改为服务端同源转发（网页端读帧、VR 全景用），
+		// 画质与原文件一致，不触发转码。
+		if wantSameOriginProxy(c) {
+			handled, proxyErr := proxySTRMStream(c, svc, m)
+			if handled {
+				writeProxyError(c, proxyErr)
+				return
+			}
+		}
 		err = svc.Stream.ServeFile(c.Writer, c.Request, c.Param("id"))
 		if errors.Is(err, service.ErrMediaNotFound) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})

internal/handler/media_sort.go

@@ -0,0 +1,50 @@
+package handler
+
+import (
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/truewhile/MeBox/internal/middleware"
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+func parseMediaSort(c *gin.Context) service.MediaSortSpec {
+	if c == nil {
+		return service.NormalizeMediaSort("", "")
+	}
+	return service.NormalizeMediaSort(c.Query("sort"), c.Query("order"))
+}
+
+// mediaHistoryMap loads the current user's latest playback time per media ID.
+// It is only used for the explicit last_played sort so normal pagination keeps
+// its single-query path.
+func mediaHistoryMap(c *gin.Context, svc *service.Container) map[string]time.Time {
+	if c == nil || svc == nil || svc.Repo == nil || svc.Repo.DB == nil {
+		return nil
+	}
+	uid, _ := c.Get(middleware.CtxUserID)
+	userID := strings.TrimSpace(toString(uid))
+	if userID == "" {
+		return nil
+	}
+	var rows []struct {
+		MediaID   string    `gorm:"column:media_id"`
+		WatchedAt time.Time `gorm:"column:watched_at"`
+	}
+	if err := svc.Repo.DB.WithContext(c.Request.Context()).
+		Model(&model.PlaybackHistory{}).
+		Select("media_id, MAX(watched_at) AS watched_at").
+		Where("user_id = ?", userID).
+		Group("media_id").
+		Scan(&rows).Error; err != nil {
+		return nil
+	}
+	out := make(map[string]time.Time, len(rows))
+	for _, row := range rows {
+		out[row.MediaID] = row.WatchedAt
+	}
+	return out
+}

internal/handler/pinned_libraries.go

@@ -6,6 +6,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"github.com/truewhile/MeBox/internal/middleware"
+	"github.com/truewhile/MeBox/internal/model"
 	"github.com/truewhile/MeBox/internal/service"
 )
 
@@ -13,6 +14,45 @@ type pinnedLibrariesReq struct {
 	LibraryIDs []string `json:"library_ids"`
 }
 
+type libraryTagsReq struct {
+	Tags []model.LibraryTagSet `json:"tags"`
+}
+
+func getLibraryTagsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		uid, _ := c.Get(middleware.CtxUserID)
+		tags, err := svc.Profile.GetLibraryTags(c.Request.Context(), uid.(string))
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if tags == nil {
+			tags = []model.LibraryTagSet{}
+		}
+		c.JSON(http.StatusOK, gin.H{"tags": tags})
+	}
+}
+
+func setLibraryTagsHandler(svc *service.Container) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req libraryTagsReq
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		uid, _ := c.Get(middleware.CtxUserID)
+		tags, err := svc.Profile.SetLibraryTags(c.Request.Context(), uid.(string), req.Tags)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if tags == nil {
+			tags = []model.LibraryTagSet{}
+		}
+		c.JSON(http.StatusOK, gin.H{"tags": tags})
+	}
+}
+
 func getPinnedLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid, _ := c.Get(middleware.CtxUserID)

internal/handler/playback.go

@@ -85,6 +85,18 @@ func toggleFavouriteHandler(svc *service.Container) gin.HandlerFunc {
 func listFavouritesHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid, _ := c.Get(middleware.CtxUserID)
+		if c.Query("ids") == "1" {
+			ids, err := svc.Playback.ListFavouriteIDs(c.Request.Context(), uid.(string))
+			if err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+				return
+			}
+			if ids == nil {
+				ids = []string{}
+			}
+			c.JSON(http.StatusOK, gin.H{"ids": ids})
+			return
+		}
 		items, err := svc.Playback.ListFavourites(c.Request.Context(), uid.(string))
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})

internal/handler/routes_authenticated_core.go

@@ -12,6 +12,8 @@ func registerAuthedUserAndLicenseRoutes(authed *gin.RouterGroup, svc *service.Co
 	authed.PATCH("/me", updateProfileHandler(svc))
 	authed.GET("/me/pinned-libraries", getPinnedLibrariesHandler(svc))
 	authed.PUT("/me/pinned-libraries", setPinnedLibrariesHandler(svc))
+	authed.GET("/me/library-tags", getLibraryTagsHandler(svc))
+	authed.PUT("/me/library-tags", setLibraryTagsHandler(svc))
 	authed.POST("/me/password", changePasswordHandler(svc))
 	authed.POST("/me/logout", logoutHandler(svc))
 	authed.GET("/me/temporary-password", temporaryPasswordHandler(svc))
@@ -44,6 +46,8 @@ func registerAuthedLibraryRoutes(authed *gin.RouterGroup, svc *service.Container
 func registerAuthedMediaRoutes(authed *gin.RouterGroup, svc *service.Container) {
 	authed.GET("/media/:id", getMediaHandler(svc))
 	authed.GET("/media/:id/episodes", listMediaEpisodesHandler(svc))
+	authed.GET("/media/:id/playback", mediaPlaybackInfoHandler(svc))
+	authed.POST("/media/:id/transcode", mediaTranscodeHandler(svc))
 	authed.GET("/media", searchMediaHandler(svc))
 	authed.PATCH("/media/:id/metadata", middleware.AdminRequired(), updateMediaMetadataHandler(svc))
 	authed.POST("/media/:id/scrape", middleware.AdminRequired(), scrapeOneHandler(svc))
@@ -65,6 +69,10 @@ func registerAuthedPlaybackAndProxyRoutes(authed *gin.RouterGroup, svc *service.
 	authed.GET("/hls/:id/index.m3u8", hlsPlaylistHandler(svc))
 	authed.GET("/hls/:id/:seg", hlsSegmentHandler(svc))
 	authed.DELETE("/hls/:id", stopTranscodeHandler(svc))
+	authed.GET("/cloud115/media/:id/master.m3u8", cloud115HLSMasterHandler(svc))
+	authed.HEAD("/cloud115/media/:id/master.m3u8", cloud115HLSMasterHandler(svc))
+	authed.GET("/cloud115/hls/:session/:key", cloud115HLSSessionHandler(svc))
+	authed.HEAD("/cloud115/hls/:session/:key", cloud115HLSSessionHandler(svc))
 
 	authed.GET("/img", imageProxyHandler(svc))
 }

internal/handler/routes_authenticated_test.go

@@ -27,6 +27,8 @@ func TestAuthenticatedRouteSurfacesAreRegistered(t *testing.T) {
 		"GET /api/me",
 		"GET /api/me/pinned-libraries",
 		"PUT /api/me/pinned-libraries",
+		"GET /api/me/library-tags",
+		"PUT /api/me/library-tags",
 		"GET /api/auth/permissions",
 		"GET /api/libraries",
 		"GET /api/media",

internal/handler/series.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"sort"
 	"strconv"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -66,6 +67,11 @@ func listLibrarySeriesHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		libID := c.Param("id")
 		ctx := c.Request.Context()
+		sortSpec := parseMediaSort(c)
+		var history map[string]time.Time
+		if sortSpec.Field == "last_played" {
+			history = mediaHistoryMap(c, svc)
+		}
 		// 远程剧集库：远程 Series 映射为系列卡片。
 		if svc.EmbyRemote != nil && service.IsEmbyRemoteID(libID) {
 			mountID, remoteID, _ := service.DecodeEmbyRemoteID(libID)
@@ -83,6 +89,7 @@ func listLibrarySeriesHandler(svc *service.Container) gin.HandlerFunc {
 				writeInternalOrCanceled(c, err)
 				return
 			}
+			cards = sortRemoteSeriesCards(cards, sortSpec, history)
 			page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 			size, _ := strconv.Atoi(c.DefaultQuery("page_size", "500"))
 			if page < 1 {
@@ -122,6 +129,7 @@ func listLibrarySeriesHandler(svc *service.Container) gin.HandlerFunc {
 			writeInternalOrCanceled(c, err)
 			return
 		}
+		items = service.SortSeriesCards(items, sortSpec.Field, sortSpec.Order, history)
 		page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 		size, _ := strconv.Atoi(c.DefaultQuery("page_size", "500"))
 		if page < 1 {

internal/handler/series_sort.go

@@ -0,0 +1,23 @@
+package handler
+
+import (
+	"slices"
+	"time"
+
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+// sortRemoteSeriesCards keeps the DateLastContentAdded order returned by the
+// remote Emby server when LastAddedAt is not exposed in the Series DTO.
+func sortRemoteSeriesCards(cards []service.SeriesCard, spec service.MediaSortSpec, history map[string]time.Time) []service.SeriesCard {
+	if spec.Field != "updated_at" {
+		return service.SortSeriesCards(cards, spec.Field, spec.Order, history)
+	}
+
+	out := append([]service.SeriesCard(nil), cards...)
+	// RemoteSeriesCards always fetches DateLastContentAdded in descending order.
+	if spec.Order == "asc" {
+		slices.Reverse(out)
+	}
+	return service.SortSeriesCards(out, spec.Field, spec.Order, history)
+}

internal/handler/series_sort_test.go

@@ -0,0 +1,21 @@
+package handler
+
+import (
+	"testing"
+
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+func TestSortRemoteSeriesCardsUpdatedAtUsesRemoteOrder(t *testing.T) {
+	cards := []service.SeriesCard{{Key: "newest"}, {Key: "middle"}, {Key: "oldest"}}
+
+	desc := sortRemoteSeriesCards(cards, service.MediaSortSpec{Field: "updated_at", Order: "desc"}, nil)
+	if desc[0].Key != "newest" || desc[1].Key != "middle" || desc[2].Key != "oldest" {
+		t.Fatalf("descending order = %q, %q, %q", desc[0].Key, desc[1].Key, desc[2].Key)
+	}
+
+	asc := sortRemoteSeriesCards(cards, service.MediaSortSpec{Field: "updated_at", Order: "asc"}, nil)
+	if asc[0].Key != "oldest" || asc[1].Key != "middle" || asc[2].Key != "newest" {
+		t.Fatalf("ascending order = %q, %q, %q", asc[0].Key, asc[1].Key, asc[2].Key)
+	}
+}

internal/handler/stream_proxy.go

@@ -0,0 +1,56 @@
+// 直连流的同源转发：网页端需要读取视频帧的场景（VR 全景渲染走 WebGL 纹理）
+// 不能使用会跳到网盘 CDN 的跨域直链，这里把直链改为服务端转发。
+//
+// 只在客户端显式带上 ?proxy=1 时生效，普通播放仍走原来的 302 直连，
+// 避免把网盘流量无谓地压到服务器上。
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+// wantSameOriginProxy 客户端是否要求把直连流改为服务端同源转发。
+func wantSameOriginProxy(c *gin.Context) bool {
+	if c == nil {
+		return false
+	}
+	switch strings.ToLower(strings.TrimSpace(c.Query("proxy"))) {
+	case "1", "true", "yes":
+		return true
+	default:
+		return false
+	}
+}
+
+// proxySTRMStream 处理 STRM/网盘媒体的同源转发请求。返回 handled=false 表示
+// 该媒体不需要（或无法）代理，调用方继续按原有逻辑处理。
+func proxySTRMStream(c *gin.Context, svc *service.Container, m *model.Media) (bool, error) {
+	if c == nil || svc == nil || svc.Strm == nil || m == nil {
+		return false, nil
+	}
+	if !service.IsStrmMediaRow(m) {
+		return false, nil
+	}
+	if err := svc.Strm.ProxyMediaDirect(c.Request.Context(), c.Writer, c.Request, m); err != nil {
+		if errors.Is(err, service.ErrStrmProxyNotApplicable) {
+			return false, nil
+		}
+		return true, err
+	}
+	return true, nil
+}
+
+// writeProxyError 在尚未写入任何响应内容时回一个明确的网关错误。
+func writeProxyError(c *gin.Context, err error) {
+	if c == nil || err == nil || c.Writer.Written() {
+		return
+	}
+	c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+}

internal/handler/strm.go

@@ -138,25 +138,35 @@ func testStrmAccountHandler(svc *service.Container) gin.HandlerFunc {
 			return
 		}
 		now := time.Now()
-		acct.LastTestAt = &now
 		if acct.Provider == model.StrmProviderEmbyRemote && svc.EmbyRemote != nil {
+			result := ""
+			ok := false
 			if err := svc.EmbyRemote.TestConnection(c.Request.Context(), acct); err != nil {
-				acct.LastTestResult = err.Error()
-				acct.LastTestOK = false
+				result = err.Error()
 			} else {
-				acct.LastTestResult = "ok"
-				acct.LastTestOK = true
+				result = "ok"
+				ok = true
 			}
-		} else {
-			acct = svc.Strm.TestStrmAccount(c.Request.Context(), id)
-			if acct == nil {
-				c.JSON(http.StatusNotFound, gin.H{"error": "网盘账号不存在"})
+			acct.LastTestAt = &now
+			acct.LastTestResult = result
+			acct.LastTestOK = ok
+			if err := svc.Repo.StrmAccount.UpdateTestResult(c.Request.Context(), acct.ID, now, result, ok); err != nil {
+				// 写库失败时仍返回本地测试结果；不要回退到整行 Update，
+				// 那会覆盖 TestConnection 期间可能刷新的账号配置。
+				c.JSON(http.StatusOK, strmAccountViews(svc, []model.StrmAccount{*acct})[0])
 				return
 			}
+			if fresh, err := svc.Repo.StrmAccount.FindByID(c.Request.Context(), acct.ID); err == nil && fresh != nil {
+				acct = fresh
+			}
 			c.JSON(http.StatusOK, strmAccountViews(svc, []model.StrmAccount{*acct})[0])
 			return
 		}
-		_ = svc.Repo.StrmAccount.Update(c.Request.Context(), acct)
+		acct = svc.Strm.TestStrmAccount(c.Request.Context(), id)
+		if acct == nil {
+			c.JSON(http.StatusNotFound, gin.H{"error": "网盘账号不存在"})
+			return
+		}
 		c.JSON(http.StatusOK, strmAccountViews(svc, []model.StrmAccount{*acct})[0])
 	}
 }

internal/handler/watch_history.go

@@ -92,13 +92,14 @@ func historyStatsHandler(svc *service.Container) gin.HandlerFunc {
 func historyContinueHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		uid, _ := c.Get(middleware.CtxUserID)
+		userID := toString(uid)
 		limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
 		if limit <= 0 || limit > 50 {
 			limit = 10
 		}
 		var rows []model.PlaybackHistory
 		if err := svc.Repo.DB.
-			Where("user_id = ? AND completed = ?", toString(uid), false).
+			Where("user_id = ? AND completed = ?", userID, false).
 			Order("watched_at desc").
 			Limit(limit).
 			Find(&rows).Error; err != nil {
@@ -116,61 +117,52 @@ func historyContinueHandler(svc *service.Container) gin.HandlerFunc {
 		}
 		mIdx := make(map[string]model.Media, len(media))
 		for _, m := range media {
-			if !mediaVisibleForRequest(c, svc, &m) {
-				continue
-			}
 			mIdx[m.ID] = m
 		}
 		out := make([]gin.H, 0, len(rows))
+		staleIDs := make([]string, 0)
 		for _, r := range rows {
 			m, ok := mIdx[r.MediaID]
-			if !ok {
-				if svc.EmbyRemote != nil && service.IsEmbyRemoteID(r.MediaID) {
-					mountID, remoteID, _ := service.DecodeEmbyRemoteID(r.MediaID)
-					if mount, acct, _ := svc.EmbyRemote.ResolveMount(c.Request.Context(), mountID); mount != nil && acct != nil {
-						if rm, err := svc.EmbyRemote.RemoteMediaDetail(c.Request.Context(), mount, acct, remoteID); err == nil && rm != nil {
-							if mediaVisibleForRequest(c, svc, rm) {
-								out = append(out, gin.H{
-									"history": r,
-									"media":   *rm,
-								})
-							}
-							continue
-						}
-					}
-				}
-				fallback := fallbackHistoryMedia(r.MediaID)
-				if fallback != nil {
+			if ok {
+				if mediaVisibleForRequest(c, svc, &m) {
 					out = append(out, gin.H{
 						"history": r,
-						"media":   *fallback,
+						"media":   m,
 					})
 				}
 				continue
 			}
-			out = append(out, gin.H{
-				"history": r,
-				"media":   m,
-			})
+
+			if svc.EmbyRemote != nil && service.IsEmbyRemoteID(r.MediaID) {
+				mountID, remoteID, _ := service.DecodeEmbyRemoteID(r.MediaID)
+				mount, acct, resolveErr := svc.EmbyRemote.ResolveMount(c.Request.Context(), mountID)
+				if resolveErr == nil && mount != nil && acct != nil {
+					remoteMedia, detailErr := svc.EmbyRemote.RemoteMediaDetail(c.Request.Context(), mount, acct, remoteID)
+					if detailErr == nil && remoteMedia != nil {
+						if mediaVisibleForRequest(c, svc, remoteMedia) {
+							out = append(out, gin.H{
+								"history": r,
+								"media":   *remoteMedia,
+							})
+						}
+						continue
+					}
+				}
+			}
+
+			// 媒体记录已不存在。继续返回占位卡只会让用户点击后遇到 404，
+			// 因此清理这条失效播放记录，不再占用继续观看列表。
+			staleIDs = append(staleIDs, r.MediaID)
+		}
+		if len(staleIDs) > 0 {
+			_ = svc.Repo.DB.WithContext(c.Request.Context()).Unscoped().
+				Where("user_id = ? AND media_id IN ?", userID, staleIDs).
+				Delete(&model.PlaybackHistory{}).Error
 		}
 		c.JSON(http.StatusOK, out)
 	}
 }
 
-func fallbackHistoryMedia(mediaID string) *model.Media {
-	if mediaID == "" {
-		return nil
-	}
-	title := "媒体"
-	if service.IsEmbyRemoteID(mediaID) {
-		title = "远程媒体"
-	}
-	return &model.Media{
-		Base:  model.Base{ID: mediaID},
-		Title: title,
-	}
-}
-
 // historyDeleteHandler removes one or all history rows for the caller.
 //
 //	DELETE /api/watch-history?media_id=xxx  → delete just that media's row

internal/handler/watch_history_test.go

@@ -0,0 +1,105 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/truewhile/MeBox/internal/middleware"
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
+	"github.com/truewhile/MeBox/internal/service"
+)
+
+func TestHistoryContinueRemovesMissingMedia(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.AutoMigrate(&model.PlaybackHistory{}, &model.Media{}); err != nil {
+		t.Fatal(err)
+	}
+
+	valid := model.Media{
+		Base:  model.Base{ID: "media-valid"},
+		Title: "有效影片",
+		Path:  "/media/valid.mkv",
+	}
+	if err := db.Create(&valid).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	now := time.Now()
+	if err := db.Create(&model.PlaybackHistory{
+		Base:       model.Base{ID: "history-valid"},
+		UserID:     "user-1",
+		MediaID:    valid.ID,
+		PositionMs: 30_000,
+		DurationMs: 120_000,
+		WatchedAt:  now.Add(-time.Minute),
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.PlaybackHistory{
+		Base:       model.Base{ID: "history-stale"},
+		UserID:     "user-1",
+		MediaID:    "media-deleted",
+		PositionMs: 60_000,
+		DurationMs: 120_000,
+		WatchedAt:  now,
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	repos := repository.New(db)
+	svc := &service.Container{
+		Log:      zap.NewNop(),
+		Repo:     repos,
+		Playback: service.NewPlaybackService(zap.NewNop(), repos),
+	}
+	router := gin.New()
+	router.Use(func(c *gin.Context) {
+		c.Set(middleware.CtxUserID, "user-1")
+		c.Next()
+	})
+	router.GET("/watch-history/continue", historyContinueHandler(svc))
+
+	req := httptest.NewRequest(http.MethodGet, "/watch-history/continue?limit=10", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	var body []struct {
+		History model.PlaybackHistory `json:"history"`
+		Media   model.Media           `json:"media"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if len(body) != 1 {
+		t.Fatalf("continue watching rows = %d, want 1: %s", len(body), rec.Body.String())
+	}
+	if body[0].Media.ID != valid.ID || body[0].History.ID != "history-valid" {
+		t.Fatalf("unexpected row: %#v", body[0])
+	}
+
+	var staleCount int64
+	if err := db.Unscoped().Model(&model.PlaybackHistory{}).
+		Where("user_id = ? AND media_id = ?", "user-1", "media-deleted").
+		Count(&staleCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if staleCount != 0 {
+		t.Fatalf("stale history rows remaining = %d, want 0", staleCount)
+	}
+}

internal/middleware/auth.go

@@ -125,6 +125,8 @@ func externalPlaybackTokenAllowedPath(c *gin.Context, mediaID string) bool {
 			return len(segments) >= 3 &&
 				strings.EqualFold(segments[2], "play") &&
 				strings.TrimSpace(c.Query("media_id")) == mediaID
+		case "cloud115":
+			return strings.TrimSpace(c.Query("media_id")) == mediaID
 		}
 	}
 	return false

internal/model/library_tag.go

@@ -0,0 +1,118 @@
+package model
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+// MaxLibraryTags 是单个用户可创建的标签数量上限，避免恶意写入过大的 JSON。
+const MaxLibraryTags = 50
+
+// MaxLibraryTagNameLen 是单个标签名的最大字符长度（按 rune 计数）。
+const MaxLibraryTagNameLen = 24
+
+// LibraryTagSet 是用户自定义的媒体库标签分组。
+// LibraryIDs 保存该标签下媒体库的 ID（含远程 Emby 挂载库的 embyremote~ 形式），
+// 顺序即媒体库在该标签内的展示顺序。
+type LibraryTagSet struct {
+	Name       string   `json:"name"`
+	LibraryIDs []string `json:"library_ids"`
+}
+
+// DecodeLibraryTags 解析 LibraryTags 字段，忽略损坏的数据。
+func (u *User) DecodeLibraryTags() []LibraryTagSet {
+	if u == nil || strings.TrimSpace(u.LibraryTags) == "" {
+		return nil
+	}
+	var tags []LibraryTagSet
+	if err := json.Unmarshal([]byte(u.LibraryTags), &tags); err != nil {
+		return nil
+	}
+	out := make([]LibraryTagSet, 0, len(tags))
+	for _, tag := range NormalizeLibraryTags(tags) {
+		out = append(out, tag)
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// EncodeLibraryTags 把标签集合序列化为可写入 LibraryTags 字段的 JSON 字符串。
+// 空集合序列化为空字符串，便于用零值表达"没有标签"。
+func EncodeLibraryTags(tags []LibraryTagSet) (string, error) {
+	if len(tags) == 0 {
+		return "", nil
+	}
+	raw, err := json.Marshal(tags)
+	if err != nil {
+		return "", err
+	}
+	return string(raw), nil
+}
+
+// NormalizeLibraryTags 清洗标签集合：去空白、丢弃空名标签、去掉标签名与
+// 标签内媒体库 ID 的重复项，并把标签名重复的项合并。保持传入顺序。
+func NormalizeLibraryTags(tags []LibraryTagSet) []LibraryTagSet {
+	if len(tags) == 0 {
+		return nil
+	}
+	out := make([]LibraryTagSet, 0, len(tags))
+	indexByName := make(map[string]int, len(tags))
+	for _, tag := range tags {
+		name := TruncateLibraryTagName(tag.Name)
+		if name == "" {
+			continue
+		}
+		if len(out) >= MaxLibraryTags {
+			break
+		}
+		key := strings.ToLower(name)
+		pos, exists := indexByName[key]
+		if !exists {
+			if len(out) >= MaxLibraryTags {
+				break
+			}
+			out = append(out, LibraryTagSet{Name: name, LibraryIDs: []string{}})
+			pos = len(out) - 1
+			indexByName[key] = pos
+		}
+		seen := make(map[string]struct{}, len(out[pos].LibraryIDs))
+		for _, id := range out[pos].LibraryIDs {
+			seen[id] = struct{}{}
+		}
+		for _, id := range tag.LibraryIDs {
+			trimmed := strings.TrimSpace(id)
+			if trimmed == "" {
+				continue
+			}
+			if _, ok := seen[trimmed]; ok {
+				continue
+			}
+			seen[trimmed] = struct{}{}
+			out[pos].LibraryIDs = append(out[pos].LibraryIDs, trimmed)
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	for i := range out {
+		if out[i].LibraryIDs == nil {
+			out[i].LibraryIDs = []string{}
+		}
+	}
+	return out
+}
+
+// TruncateLibraryTagName 去掉首尾空白并按 rune 截断到长度上限。
+func TruncateLibraryTagName(name string) string {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return ""
+	}
+	runes := []rune(name)
+	if len(runes) > MaxLibraryTagNameLen {
+		runes = runes[:MaxLibraryTagNameLen]
+	}
+	return strings.TrimSpace(string(runes))
+}

internal/model/library_tag_test.go

@@ -0,0 +1,79 @@
+package model
+
+import "testing"
+
+func TestNormalizeLibraryTagsMergesDuplicatesAndTrims(t *testing.T) {
+	tags := []LibraryTagSet{
+		{Name: "  动画  ", LibraryIDs: []string{" a ", "", "b", "a"}},
+		{Name: "动画", LibraryIDs: []string{"c", "b"}},
+		{Name: "   ", LibraryIDs: []string{"x"}},
+		{Name: "电影", LibraryIDs: nil},
+	}
+	got := NormalizeLibraryTags(tags)
+	if len(got) != 2 {
+		t.Fatalf("NormalizeLibraryTags len = %d, want 2 (%#v)", len(got), got)
+	}
+	if got[0].Name != "动画" {
+		t.Fatalf("first tag name = %q, want 动画", got[0].Name)
+	}
+	want := []string{"a", "b", "c"}
+	if len(got[0].LibraryIDs) != len(want) {
+		t.Fatalf("first tag ids = %v, want %v", got[0].LibraryIDs, want)
+	}
+	for i := range want {
+		if got[0].LibraryIDs[i] != want[i] {
+			t.Fatalf("first tag ids = %v, want %v", got[0].LibraryIDs, want)
+		}
+	}
+	if got[1].Name != "电影" || got[1].LibraryIDs == nil {
+		t.Fatalf("empty tag should survive with an empty non-nil id list: %#v", got[1])
+	}
+}
+
+func TestNormalizeLibraryTagsCapsCountAndNameLength(t *testing.T) {
+	long := make([]rune, MaxLibraryTagNameLen+10)
+	for i := range long {
+		long[i] = 'x'
+	}
+	got := NormalizeLibraryTags([]LibraryTagSet{{Name: string(long)}})
+	if len(got) != 1 {
+		t.Fatalf("len = %d, want 1", len(got))
+	}
+	if runes := []rune(got[0].Name); len(runes) != MaxLibraryTagNameLen {
+		t.Fatalf("name length = %d, want %d", len(runes), MaxLibraryTagNameLen)
+	}
+
+	many := make([]LibraryTagSet, 0, MaxLibraryTags+5)
+	for i := 0; i < MaxLibraryTags+5; i++ {
+		many = append(many, LibraryTagSet{Name: string(rune('a' + i%26)) + "-" + string(rune('a'+i/26))})
+	}
+	if capped := NormalizeLibraryTags(many); len(capped) > MaxLibraryTags {
+		t.Fatalf("capped len = %d, want <= %d", len(capped), MaxLibraryTags)
+	}
+}
+
+func TestEncodeDecodeLibraryTagsRoundTrip(t *testing.T) {
+	user := &User{}
+	if encoded, err := EncodeLibraryTags(nil); err != nil || encoded != "" {
+		t.Fatalf("EncodeLibraryTags(nil) = %q, %v; want \"\", nil", encoded, err)
+	}
+	raw, err := EncodeLibraryTags([]LibraryTagSet{{Name: "动画", LibraryIDs: []string{"lib-1"}}})
+	if err != nil {
+		t.Fatalf("EncodeLibraryTags: %v", err)
+	}
+	user.LibraryTags = raw
+	decoded := user.DecodeLibraryTags()
+	if len(decoded) != 1 || decoded[0].Name != "动画" || len(decoded[0].LibraryIDs) != 1 || decoded[0].LibraryIDs[0] != "lib-1" {
+		t.Fatalf("DecodeLibraryTags = %#v", decoded)
+	}
+
+	user.LibraryTags = "{not json"
+	if decoded := user.DecodeLibraryTags(); decoded != nil {
+		t.Fatalf("corrupt payload should decode to nil, got %#v", decoded)
+	}
+
+	user.PopulateComputedFields()
+	if user.LibraryTagList != nil {
+		t.Fatalf("PopulateComputedFields should mirror DecodeLibraryTags, got %#v", user.LibraryTagList)
+	}
+}

internal/model/user.go

@@ -28,13 +28,29 @@ type User struct {
 	// PinnedLibraryIDs 存储用户置顶的媒体库 ID 列表（JSON 字符串），顺序即置顶优先级。
 	PinnedLibraryIDs  string   `gorm:"type:text" json:"-"`
 	PinnedLibraryList []string `gorm:"-" json:"pinned_library_ids,omitempty"`
+	// LibraryTags 存储用户自定义的媒体库标签分组（JSON 字符串），
+	// 形如 [{"name":"动画","library_ids":["lib-1","lib-2"]}]。标签属于用户本人，
+	// 用于在媒体库页把同一标签下的媒体库聚合到一起。
+	LibraryTags    string          `gorm:"type:text" json:"-"`
+	LibraryTagList []LibraryTagSet `gorm:"-" json:"library_tags,omitempty"`
 	// SubtitleChineseMode 是网页播放器外挂字幕的简繁转换偏好：
 	// original / simplified / traditional。
 	SubtitleChineseMode string `gorm:"size:16;not null;default:original" json:"subtitle_chinese_mode"`
-	// DanmakuMergeSources 是网页播放器的弹幕偏好：开启后，同一集的多个弹幕
-	// 来源会被合并并按「时间 + 内容」去重后一起展示。按用户存储，避免一个
-	// 用户的开关影响其他人。
-	DanmakuMergeSources bool `gorm:"default:false" json:"danmaku_merge_sources"`
+	// 网页播放器偏好按用户存储，切换媒体对象后继续沿用。
+	PlayerVolume       float64 `gorm:"not null;default:1" json:"player_volume"`
+	PlayerPlaybackRate float64 `gorm:"not null;default:1" json:"player_playback_rate"`
+	// PlayerVr360GuideSeen 记录用户是否已经看过 VR 全景播放的首次操作说明，
+	// 按用户保存：看过一次之后不再弹出。
+	PlayerVr360GuideSeen bool    `gorm:"not null;default:false" json:"player_vr360_guide_seen"`
+	DanmakuEnabled       bool    `gorm:"not null;default:true" json:"danmaku_enabled"`
+	DanmakuOpacity       float64 `gorm:"not null;default:1" json:"danmaku_opacity"`
+	DanmakuFontSize      int     `gorm:"not null;default:24" json:"danmaku_font_size"`
+	DanmakuArea          float64 `gorm:"not null;default:1" json:"danmaku_area"`
+	DanmakuMergeSources  bool    `gorm:"not null;default:false" json:"danmaku_merge_sources"`
+	DanmakuSource        string  `gorm:"size:512" json:"danmaku_source,omitempty"`
+	DanmakuAppID         string  `gorm:"size:128" json:"danmaku_app_id,omitempty"`
+	// DanmakuAppKey 只在服务端读取并用于请求签名，绝不通过用户资料接口下发。
+	DanmakuAppKey string `gorm:"size:256" json:"-"`
 	// ExpiredAt is the account expiry time. Nil means the account never
 	// expires. When set and in the past, the account is treated as expired
 	// (login blocked) until an admin or a redemption code renews it.
@@ -95,4 +111,5 @@ func (u *User) PopulateComputedFields() {
 	}
 	u.AllowedLibraryList = u.DecodeAllowedLibraryIDs()
 	u.PinnedLibraryList = u.DecodePinnedLibraryIDs()
+	u.LibraryTagList = u.DecodeLibraryTags()
 }

internal/repository/media_repository.go

@@ -43,6 +43,7 @@ type MediaQueryFilter struct {
 	IncludeNSFW       bool
 	AllowedLibraryIDs []string
 	HiddenLibraryIDs  []string
+	SeriesID          string
 }
 
 func applyMediaQueryFilter(q *gorm.DB, filter MediaQueryFilter) *gorm.DB {
@@ -55,6 +56,9 @@ func applyMediaQueryFilter(q *gorm.DB, filter MediaQueryFilter) *gorm.DB {
 	if len(filter.AllowedLibraryIDs) > 0 {
 		q = q.Where("library_id IN ?", filter.AllowedLibraryIDs)
 	}
+	if seriesID := strings.TrimSpace(filter.SeriesID); seriesID != "" {
+		q = q.Where("series_id = ?", seriesID)
+	}
 	return q
 }
 
@@ -100,6 +104,67 @@ func (r *MediaRepository) ListByLibrariesFilteredNoCount(ctx context.Context, li
 	return items, err
 }
 
+// ListAllByLibrariesFilteredNoCount loads every matching row without issuing a
+// COUNT query. Full-library consumers such as series grouping must scan the
+// whole library anyway, so calling it once is both cheaper and more consistent
+// than issuing paginated queries with repeated counts.
+func (r *MediaRepository) ListAllByLibrariesFilteredNoCount(ctx context.Context, libraryIDs []string, filter MediaQueryFilter) ([]model.Media, error) {
+	items := make([]model.Media, 0)
+	if len(libraryIDs) == 0 {
+		return items, nil
+	}
+	q := r.db.WithContext(ctx).Model(&model.Media{})
+	if len(libraryIDs) == 1 {
+		q = q.Where("library_id = ?", libraryIDs[0])
+	} else {
+		q = q.Where("library_id IN ?", libraryIDs)
+	}
+	q = applyMediaQueryFilter(q, filter)
+	err := q.Order("release_date DESC, year DESC, updated_at DESC, created_at DESC, id DESC").Find(&items).Error
+	return items, err
+}
+
+// ListVersionCandidates loads a bounded candidate set for version grouping
+// using the strongest identity stored on the row. Returning ok=false keeps the
+// caller's full-library fallback for rows without external IDs or SeriesID.
+func (r *MediaRepository) ListVersionCandidates(ctx context.Context, libraryIDs []string, media model.Media, limit int) ([]model.Media, bool, error) {
+	items := make([]model.Media, 0)
+	if len(libraryIDs) == 0 {
+		return items, false, nil
+	}
+	if limit <= 0 {
+		limit = 5000
+	}
+	q := r.db.WithContext(ctx).Model(&model.Media{})
+	if len(libraryIDs) == 1 {
+		q = q.Where("library_id = ?", libraryIDs[0])
+	} else {
+		q = q.Where("library_id IN ?", libraryIDs)
+	}
+	found := true
+	switch {
+	case strings.TrimSpace(media.SeriesID) != "":
+		q = q.Where("series_id = ?", strings.TrimSpace(media.SeriesID))
+	case media.TMDbID > 0:
+		q = q.Where("tm_db_id = ?", media.TMDbID)
+	case media.BangumiID > 0:
+		q = q.Where("bangumi_id = ?", media.BangumiID)
+	case strings.TrimSpace(media.DoubanID) != "":
+		q = q.Where("douban_id = ?", strings.TrimSpace(media.DoubanID))
+	case strings.TrimSpace(media.TheTVDBID) != "":
+		q = q.Where("thetvdb_id = ?", strings.TrimSpace(media.TheTVDBID))
+	default:
+		found = false
+	}
+	if !found {
+		return items, false, nil
+	}
+	err := q.Order("release_date DESC, year DESC, updated_at DESC, created_at DESC, id DESC").
+		Limit(limit).
+		Find(&items).Error
+	return items, true, err
+}
+
 func (r *MediaRepository) listByLibrariesFiltered(ctx context.Context, libraryIDs []string, offset, limit int, filter MediaQueryFilter, withCount bool) ([]model.Media, int64, error) {
 	var items []model.Media
 	var total int64
@@ -196,6 +261,10 @@ func mediaQueryFilterSQL(filter MediaQueryFilter) (string, []interface{}) {
 		parts = append(parts, "library_id IN ?")
 		args = append(args, filter.AllowedLibraryIDs)
 	}
+	if seriesID := strings.TrimSpace(filter.SeriesID); seriesID != "" {
+		parts = append(parts, "series_id = ?")
+		args = append(args, seriesID)
+	}
 	return strings.Join(parts, " AND "), args
 }
 

internal/repository/media_search_repository.go

@@ -146,6 +146,9 @@ func applyQualifiedMediaQueryFilter(q *gorm.DB, filter MediaQueryFilter) *gorm.D
 	if len(filter.AllowedLibraryIDs) > 0 {
 		q = q.Where("media.library_id IN ?", filter.AllowedLibraryIDs)
 	}
+	if seriesID := strings.TrimSpace(filter.SeriesID); seriesID != "" {
+		q = q.Where("media.series_id = ?", seriesID)
+	}
 	return q
 }
 

internal/repository/strm_repository.go

@@ -57,6 +57,21 @@ func (r *StrmAccountRepository) Update(ctx context.Context, a *model.StrmAccount
 	})
 }
 
+// UpdateTestResult updates only connectivity-test metadata. Callers that touch
+// account credentials must not use Update with a snapshot read before Ping:
+// a 115 token refresh can persist new tokens while Ping is running, and writing
+// the stale snapshot back would revoke the freshly rotated credentials.
+func (r *StrmAccountRepository) UpdateTestResult(ctx context.Context, id string, at time.Time, result string, ok bool) error {
+	return withSQLiteBusyRetry(ctx, func() error {
+		return r.db.WithContext(ctx).Model(&model.StrmAccount{}).Where("id = ?", id).Updates(map[string]any{
+			"last_test_at":     at,
+			"last_test_result": result,
+			"last_test_ok":     ok,
+			"updated_at":       time.Now(),
+		}).Error
+	})
+}
+
 func (r *StrmAccountRepository) Delete(ctx context.Context, id string) error {
 	return withSQLiteBusyRetry(ctx, func() error {
 		return r.db.WithContext(ctx).Unscoped().Where("id = ?", id).Delete(&model.StrmAccount{}).Error

internal/service/cloud115/video.go

@@ -0,0 +1,186 @@
+// 115 开放平台视频播放/转码 API。
+//
+// 播放接口返回的是 115 云端转码后的 HLS（m3u8）地址，不是原文件
+// downurl；未完成转码时接口会返回 state=false，可再调用 video_push
+// 请求加速转码。
+package cloud115
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// FlexString 兼容 115 接口同字段在不同设备端返回字符串或数字的情况。
+type FlexString string
+
+func (s *FlexString) UnmarshalJSON(data []byte) error {
+	raw := bytes.TrimSpace(data)
+	if len(raw) == 0 || bytes.Equal(raw, []byte("null")) {
+		*s = ""
+		return nil
+	}
+	var str string
+	if err := json.Unmarshal(raw, &str); err == nil {
+		*s = FlexString(str)
+		return nil
+	}
+	var num json.Number
+	if err := json.Unmarshal(raw, &num); err == nil {
+		*s = FlexString(num.String())
+		return nil
+	}
+	return fmt.Errorf("115: 无法解析字符串/数字字段 %s", string(raw))
+}
+
+func (s FlexString) String() string {
+	return string(s)
+}
+
+func (s FlexString) Int64() int64 {
+	v, _ := strconv.ParseInt(strings.TrimSpace(string(s)), 10, 64)
+	return v
+}
+
+// MultiTrack 是 115 返回的一条音轨信息。
+type MultiTrack struct {
+	Title      string `json:"title"`
+	IsSelected string `json:"is_selected"`
+	SyncTime   string `json:"sync_time"`
+}
+
+// MultiTrackList 兼容 115 接口把 multitrack_list 返回成对象（键为音轨序号）
+// 或数组的两种形态。
+type MultiTrackList []MultiTrack
+
+func (l *MultiTrackList) UnmarshalJSON(data []byte) error {
+	raw := bytes.TrimSpace(data)
+	if len(raw) == 0 || bytes.Equal(raw, []byte("null")) || bytes.Equal(raw, []byte("{}")) {
+		*l = nil
+		return nil
+	}
+	if raw[0] == '[' {
+		var arr []MultiTrack
+		if err := json.Unmarshal(raw, &arr); err != nil {
+			return err
+		}
+		*l = arr
+		return nil
+	}
+	if raw[0] == '{' {
+		var m map[string]MultiTrack
+		if err := json.Unmarshal(raw, &m); err != nil {
+			return err
+		}
+		keys := make([]int, 0, len(m))
+		for key := range m {
+			idx, err := strconv.Atoi(strings.TrimSpace(key))
+			if err != nil {
+				continue
+			}
+			keys = append(keys, idx)
+		}
+		sort.Ints(keys)
+		out := make([]MultiTrack, 0, len(keys))
+		for _, idx := range keys {
+			out = append(out, m[strconv.Itoa(idx)])
+		}
+		*l = out
+		return nil
+	}
+	return fmt.Errorf("115: multitrack_list 既不是对象也不是数组")
+}
+
+// VideoURLItem 是 115 返回的一条清晰度播放地址。
+type VideoURLItem struct {
+	URL         string `json:"url"`
+	Height      int    `json:"height"`
+	Width       int    `json:"width"`
+	Definition  int    `json:"definition"`
+	Title       string `json:"title"`
+	DefinitionN int    `json:"definition_n"`
+}
+
+// VideoPlayData 是 /open/video/play 的 data 字段。
+type VideoPlayData struct {
+	FileID            string            `json:"file_id"`
+	ParentID          string            `json:"parent_id"`
+	FileName          string            `json:"file_name"`
+	FileSize          FlexString        `json:"file_size"`
+	FileSha1          string            `json:"file_sha1"`
+	FileType          string            `json:"file_type"`
+	IsPrivate         FlexString        `json:"is_private"`
+	PlayLong          FlexString        `json:"play_long"`
+	UserDef           int               `json:"user_def"`
+	UserRotate        int               `json:"user_rotate"`
+	UserTurn          int               `json:"user_turn"`
+	MultitrackList    MultiTrackList    `json:"multitrack_list"`
+	DefinitionList    map[string]string `json:"definition_list"`
+	DefinitionListNew map[string]string `json:"definition_list_new"`
+	VideoURL          []VideoURLItem    `json:"video_url"`
+	VideoPushState    *bool             `json:"video_push_state"`
+}
+
+// GetVideoPlayInfo 调用 115 视频在线播放接口。
+//
+// 注意：state=false（例如视频尚未转码）时 doAuthJSON 会返回 error，但仍会
+// 返回已解析的 RespBase/VideoPlayData。调用方需要同时检查两者：有 data 时
+// 可用于判断需要等待还是触发加速转码。
+func (c *OpenClient) GetVideoPlayInfo(ctx context.Context, pickCode, ua string) (*RespBase, *VideoPlayData, error) {
+	pickCode = strings.TrimSpace(pickCode)
+	if pickCode == "" {
+		return nil, nil, fmt.Errorf("115: pick_code 为空")
+	}
+	resp, err := c.doAuthJSONWithUA(
+		ctx,
+		http.MethodGet,
+		ProAPIBase+"/open/video/play",
+		map[string]string{"pick_code": pickCode},
+		1,
+		ua,
+	)
+	if resp == nil {
+		return nil, nil, err
+	}
+	data := &VideoPlayData{}
+	if len(resp.Data) > 0 {
+		trimmed := bytes.TrimSpace(resp.Data)
+		if !bytes.Equal(trimmed, []byte("null")) {
+			if decodeErr := json.Unmarshal(trimmed, data); decodeErr != nil && err == nil {
+				err = fmt.Errorf("115: 解析视频播放信息失败：%w", decodeErr)
+			}
+		}
+	}
+	return resp, data, err
+}
+
+// SubmitVideoPush 提交 115 加速转码请求。
+//
+// op 支持 vip_push（按 VIP 等级加速）和 pay_push（消耗枫币）。调用方必须
+// 明确选择 op，默认空值按 vip_push 处理，避免误消费枫币。
+func (c *OpenClient) SubmitVideoPush(ctx context.Context, pickCode, op string) error {
+	pickCode = strings.TrimSpace(pickCode)
+	if pickCode == "" {
+		return fmt.Errorf("115: pick_code 为空")
+	}
+	op = strings.TrimSpace(op)
+	if op == "" {
+		op = "vip_push"
+	}
+	_, err := c.doAuthJSON(
+		ctx,
+		http.MethodPost,
+		ProAPIBase+"/open/video/video_push",
+		map[string]string{
+			"pick_code": pickCode,
+			"op":        op,
+		},
+		1,
+	)
+	return err
+}

internal/service/cloud115_hls_proxy.go

@@ -0,0 +1,361 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/truewhile/MeBox/internal/service/cloud115"
+)
+
+var (
+	ErrCloud115HLSSessionNotFound = errors.New("115 hls session not found")
+	ErrCloud115HLSUpstreamExpired = errors.New("115 hls upstream expired")
+)
+
+const (
+	cloud115HLSSessionTTL  = 30 * time.Minute
+	cloud115HLSMaxSessions = 256
+	cloud115HLSMaxManifest = 8 << 20
+)
+
+type cloud115HLSSession struct {
+	ID         string
+	MediaID    string
+	Definition int
+	CreatedAt  time.Time
+	ExpiresAt  time.Time
+
+	mu      sync.Mutex
+	entries map[string]string
+	next    int
+}
+
+// Cloud115HLSProxy 把 115 云端 HLS 转成 MeBox 同源 HLS。
+//
+// 浏览器不能直接请求 115 的 m3u8：master/variant/分片的 CORS 只允许
+// https://115.com，且 master 还是 HTTP。代理在服务端拉取并重写播放列表，
+// 分片按 Range 流式转发。
+type Cloud115HLSProxy struct {
+	service *Cloud115PlaybackService
+	client  *http.Client
+
+	mu       sync.Mutex
+	sessions map[string]*cloud115HLSSession
+}
+
+func newCloud115HLSProxy(service *Cloud115PlaybackService) *Cloud115HLSProxy {
+	return &Cloud115HLSProxy{
+		service: service,
+		client: &http.Client{
+			Timeout: 0,
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if len(via) >= 6 {
+					return errors.New("stopped after 6 redirects")
+				}
+				return nil
+			},
+		},
+		sessions: make(map[string]*cloud115HLSSession),
+	}
+}
+
+// ServeMaster 解析指定清晰度并返回重写后的 master.m3u8。
+func (p *Cloud115HLSProxy) ServeMaster(ctx context.Context, w http.ResponseWriter, r *http.Request, mediaID string, definition int) error {
+	if p == nil || p.service == nil {
+		return ErrCloud115NotApplicable
+	}
+	upstream, _, err := p.service.ResolveCloud115URL(ctx, mediaID, definition)
+	if err != nil {
+		return err
+	}
+	session := p.newSession(mediaID, definition)
+	fetchCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	resp, err := p.fetchUpstream(fetchCtx, upstream, "")
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("115 云端播放列表返回 HTTP %d", resp.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, cloud115HLSMaxManifest))
+	if err != nil {
+		return err
+	}
+	baseURL := upstream
+	if resp.Request != nil && resp.Request.URL != nil {
+		baseURL = resp.Request.URL.String()
+	}
+	rewritten := p.rewriteManifest(session, string(body), baseURL, r.URL.RawQuery)
+	p.storeSession(session)
+
+	w.Header().Set("Content-Type", "application/vnd.apple.mpegurl")
+	w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+	w.Header().Set("Content-Length", strconv.Itoa(len(rewritten)))
+	if r.Method != http.MethodHead {
+		_, err = io.WriteString(w, rewritten)
+	}
+	return err
+}
+
+// ServeChild 代理 variant/分片；variant 播放列表会继续重写为同源地址。
+func (p *Cloud115HLSProxy) ServeChild(ctx context.Context, w http.ResponseWriter, r *http.Request, sessionID, key string) error {
+	session, upstream, ok := p.lookup(sessionID, key)
+	if !ok {
+		return ErrCloud115HLSSessionNotFound
+	}
+	resp, err := p.fetchUpstream(ctx, upstream, r.Header.Get("Range"))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusGone {
+		p.deleteSession(sessionID)
+		return ErrCloud115HLSUpstreamExpired
+	}
+
+	contentType := strings.ToLower(strings.TrimSpace(resp.Header.Get("Content-Type")))
+	isPlaylist := strings.Contains(contentType, "mpegurl") ||
+		strings.Contains(contentType, "application/vnd.apple.mpegurl")
+
+	if !isPlaylist {
+		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		if readErr != nil {
+			return readErr
+		}
+		if strings.HasPrefix(strings.TrimSpace(string(body)), "#EXTM3U") {
+			isPlaylist = true
+			resp.Body = io.NopCloser(io.MultiReader(strings.NewReader(string(body)), resp.Body))
+		} else {
+			resp.Body = io.NopCloser(io.MultiReader(strings.NewReader(string(body)), resp.Body))
+		}
+	}
+
+	copyUpstreamHeaders(w, resp, isPlaylist)
+	if isPlaylist {
+		body, err := io.ReadAll(io.LimitReader(resp.Body, cloud115HLSMaxManifest))
+		if err != nil {
+			return err
+		}
+		baseURL := upstream
+		if resp.Request != nil && resp.Request.URL != nil {
+			baseURL = resp.Request.URL.String()
+		}
+		rewritten := p.rewriteManifest(session, string(body), baseURL, r.URL.RawQuery)
+		w.Header().Set("Content-Type", "application/vnd.apple.mpegurl")
+		w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+		w.Header().Set("Content-Length", strconv.Itoa(len(rewritten)))
+		w.WriteHeader(resp.StatusCode)
+		if r.Method != http.MethodHead {
+			_, err = io.WriteString(w, rewritten)
+		}
+		return err
+	}
+
+	w.WriteHeader(resp.StatusCode)
+	if r.Method != http.MethodHead {
+		_, err = io.Copy(w, resp.Body)
+	}
+	return err
+}
+
+func (p *Cloud115HLSProxy) newSession(mediaID string, definition int) *cloud115HLSSession {
+	now := time.Now()
+	return &cloud115HLSSession{
+		ID:         cloud115.RandomString(24),
+		MediaID:    mediaID,
+		Definition: definition,
+		CreatedAt:  now,
+		ExpiresAt:  now.Add(cloud115HLSSessionTTL),
+		entries:    make(map[string]string),
+	}
+}
+
+func (p *Cloud115HLSProxy) storeSession(session *cloud115HLSSession) {
+	if p == nil || session == nil {
+		return
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	now := time.Now()
+	if len(p.sessions) >= cloud115HLSMaxSessions {
+		for id, existing := range p.sessions {
+			if now.After(existing.ExpiresAt) {
+				delete(p.sessions, id)
+			}
+		}
+	}
+	if len(p.sessions) >= cloud115HLSMaxSessions {
+		for id := range p.sessions {
+			delete(p.sessions, id)
+			break
+		}
+	}
+	session.ExpiresAt = now.Add(cloud115HLSSessionTTL)
+	p.sessions[session.ID] = session
+}
+
+func (p *Cloud115HLSProxy) lookup(sessionID, key string) (*cloud115HLSSession, string, bool) {
+	if p == nil {
+		return nil, "", false
+	}
+	p.mu.Lock()
+	session := p.sessions[sessionID]
+	if session != nil && time.Now().After(session.ExpiresAt) {
+		delete(p.sessions, sessionID)
+		session = nil
+	}
+	p.mu.Unlock()
+	if session == nil {
+		return nil, "", false
+	}
+	session.mu.Lock()
+	upstream, ok := session.entries[key]
+	session.mu.Unlock()
+	return session, upstream, ok
+}
+
+func (p *Cloud115HLSProxy) deleteSession(sessionID string) {
+	if p == nil {
+		return
+	}
+	p.mu.Lock()
+	delete(p.sessions, sessionID)
+	p.mu.Unlock()
+}
+
+func (p *Cloud115HLSProxy) fetchUpstream(ctx context.Context, rawURL, rangeHeader string) (*http.Response, error) {
+	parsed, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil || parsed == nil || !isAllowed115UpstreamHost(parsed.Hostname()) {
+		return nil, fmt.Errorf("115 hls upstream host not allowed: %s", rawURL)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("User-Agent", cloud115.DefaultUA)
+	if strings.TrimSpace(rangeHeader) != "" {
+		req.Header.Set("Range", rangeHeader)
+	}
+	return p.client.Do(req)
+}
+
+func isAllowed115UpstreamHost(host string) bool {
+	host = strings.ToLower(strings.TrimSpace(host))
+	if host == "" {
+		return false
+	}
+	for _, suffix := range []string{".115.com", ".115cdn.com", ".115cdn.net"} {
+		if strings.HasSuffix(host, suffix) {
+			return true
+		}
+	}
+	return host == "115.com" || host == "115cdn.com" || host == "115cdn.net"
+}
+
+func (p *Cloud115HLSProxy) rewriteManifest(session *cloud115HLSSession, text, baseURL, rawQuery string) string {
+	if session == nil {
+		return text
+	}
+	lines := strings.SplitAfter(text, "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+		if strings.HasPrefix(trimmed, "#") {
+			if strings.HasPrefix(trimmed, "#EXT-X-MEDIA:") ||
+				strings.HasPrefix(trimmed, "#EXT-X-KEY:") ||
+				strings.HasPrefix(trimmed, "#EXT-X-MAP:") {
+				lines[i] = replaceManifestURI(line, func(uri string) string {
+					return p.proxyURL(session, resolveManifestURL(baseURL, uri), rawQuery)
+				})
+			}
+			continue
+		}
+		lines[i] = p.proxyURL(session, resolveManifestURL(baseURL, trimmed), rawQuery) + lineEnding(line)
+	}
+	return strings.Join(lines, "")
+}
+
+func (p *Cloud115HLSProxy) proxyURL(session *cloud115HLSSession, upstream, rawQuery string) string {
+	session.mu.Lock()
+	session.next++
+	key := "e" + strconv.Itoa(session.next)
+	session.entries[key] = upstream
+	mediaID := session.MediaID
+	session.mu.Unlock()
+
+	query := childProxyQuery(rawQuery, mediaID)
+	return "/api/cloud115/hls/" + url.PathEscape(session.ID) + "/" + url.PathEscape(key) + "?" + query
+}
+
+func childProxyQuery(rawQuery, mediaID string) string {
+	values, _ := url.ParseQuery(rawQuery)
+	keep := url.Values{}
+	for _, key := range []string{"token", "api_key", "apiKey", "ApiKey", "profile_id", "profile_pin_token"} {
+		if value := strings.TrimSpace(values.Get(key)); value != "" {
+			keep.Set(key, value)
+		}
+	}
+	if strings.TrimSpace(mediaID) != "" {
+		keep.Set("media_id", mediaID)
+	}
+	return keep.Encode()
+}
+
+func replaceManifestURI(line string, replace func(string) string) string {
+	const marker = `URI="`
+	idx := strings.Index(line, marker)
+	if idx < 0 {
+		return line
+	}
+	start := idx + len(marker)
+	end := strings.Index(line[start:], `"`)
+	if end < 0 {
+		return line
+	}
+	end += start
+	return line[:start] + replace(line[start:end]) + line[end:]
+}
+
+func resolveManifestURL(baseURL, raw string) string {
+	base, baseErr := url.Parse(strings.TrimSpace(baseURL))
+	ref, refErr := url.Parse(strings.TrimSpace(raw))
+	if baseErr != nil || refErr != nil || base == nil || ref == nil {
+		return raw
+	}
+	return base.ResolveReference(ref).String()
+}
+
+func lineEnding(line string) string {
+	if strings.HasSuffix(line, "\r\n") {
+		return "\r\n"
+	}
+	if strings.HasSuffix(line, "\n") {
+		return "\n"
+	}
+	return ""
+}
+
+func copyUpstreamHeaders(w http.ResponseWriter, resp *http.Response, playlist bool) {
+	for _, key := range []string{"Content-Type", "Content-Length", "Content-Range", "Accept-Ranges", "ETag", "Last-Modified"} {
+		if value := resp.Header.Get(key); value != "" {
+			w.Header().Set(key, value)
+		}
+	}
+	if playlist {
+		w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+	} else if w.Header().Get("Cache-Control") == "" {
+		w.Header().Set("Cache-Control", "public, max-age=3600")
+	}
+}

internal/service/cloud115_hls_proxy_test.go

@@ -0,0 +1,151 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCloud115HLSProxyRewriteManifest(t *testing.T) {
+	proxy := &Cloud115HLSProxy{sessions: map[string]*cloud115HLSSession{}}
+	session := &cloud115HLSSession{
+		ID:      "sess",
+		MediaID: "media-1",
+		entries: map[string]string{},
+	}
+	manifest := "#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=1800000,RESOLUTION=1280x720\nhttps://cpats01.115.com/a.m3u8?u=1&se=2\n"
+	rewritten := proxy.rewriteManifest(session, manifest, "http://videoplay.115.com/m3u8/pc", "token=t&media_id=media-1")
+	if strings.Contains(rewritten, "cpats01.115.com") {
+		t.Fatalf("upstream URL leaked into rewritten manifest: %s", rewritten)
+	}
+	if !strings.Contains(rewritten, "/api/cloud115/hls/sess/e1?") {
+		t.Fatalf("proxy URL missing: %s", rewritten)
+	}
+	if !strings.Contains(rewritten, "media_id=media-1") || !strings.Contains(rewritten, "token=t") {
+		t.Fatalf("auth/media query missing: %s", rewritten)
+	}
+	if len(session.entries) != 1 {
+		t.Fatalf("session entries = %d, want 1", len(session.entries))
+	}
+}
+
+func TestCloud115HLSProxyRewriteKeyURI(t *testing.T) {
+	proxy := &Cloud115HLSProxy{sessions: map[string]*cloud115HLSSession{}}
+	session := &cloud115HLSSession{
+		ID:      "sess",
+		MediaID: "media-1",
+		entries: map[string]string{},
+	}
+	manifest := `#EXTM3U
+#EXT-X-KEY:METHOD=AES-128,URI="https://cpats01.115.com/key?k=1"
+#EXTINF:10.0,
+https://cpats01.115.com/seg.ts?x=1
+`
+	rewritten := proxy.rewriteManifest(session, manifest, "https://cpats01.115.com/v.m3u8", "token=t&media_id=media-1")
+	if strings.Contains(rewritten, "cpats01.115.com") {
+		t.Fatalf("upstream URL leaked into rewritten key manifest: %s", rewritten)
+	}
+	if len(session.entries) != 2 {
+		t.Fatalf("session entries = %d, want 2", len(session.entries))
+	}
+}
+
+func TestIsAllowed115UpstreamHost(t *testing.T) {
+	for _, host := range []string{"videoplay.115.com", "cpats01.115.com", "cdn.115cdn.net"} {
+		if !isAllowed115UpstreamHost(host) {
+			t.Fatalf("host %q should be allowed", host)
+		}
+	}
+	for _, host := range []string{"", "evil.example.com", "115.com.evil.example.com"} {
+		if isAllowed115UpstreamHost(host) {
+			t.Fatalf("host %q should be rejected", host)
+		}
+	}
+}
+
+func TestCloud115HLSProxyServeChildRewritesVariant(t *testing.T) {
+	proxy := &Cloud115HLSProxy{
+		sessions: map[string]*cloud115HLSSession{},
+	}
+	proxy.client = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		body := "#EXTM3U\n#EXT-X-TARGETDURATION:10\nhttps://cpats01.115.com/seg.ts?x=1\n"
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header: http.Header{
+				"Content-Type": []string{"application/vnd.apple.mpegurl"},
+			},
+			Body:    io.NopCloser(strings.NewReader(body)),
+			Request: req,
+		}, nil
+	})}
+	session := &cloud115HLSSession{
+		ID:        "sess",
+		MediaID:   "media-1",
+		ExpiresAt: time.Now().Add(time.Hour),
+		entries:   map[string]string{"e1": "https://cpats01.115.com/v.m3u8"},
+		next:      1,
+	}
+	proxy.sessions[session.ID] = session
+	req := httptest.NewRequest(http.MethodGet, "/api/cloud115/hls/sess/e1?media_id=media-1&token=t", nil)
+	rec := httptest.NewRecorder()
+	if err := proxy.ServeChild(context.Background(), rec, req, session.ID, "e1"); err != nil {
+		t.Fatalf("ServeChild: %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "/api/cloud115/hls/sess/e2?") {
+		t.Fatalf("rewritten variant missing proxy segment: %s", rec.Body.String())
+	}
+	if strings.Contains(rec.Body.String(), "cpats01.115.com") {
+		t.Fatalf("upstream URL leaked in variant: %s", rec.Body.String())
+	}
+}
+
+func TestCloud115HLSProxyServeChildStreamsRange(t *testing.T) {
+	payload := []byte("segment-bytes")
+	proxy := &Cloud115HLSProxy{
+		sessions: map[string]*cloud115HLSSession{},
+	}
+	proxy.client = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return &http.Response{
+			StatusCode: http.StatusPartialContent,
+			Header: http.Header{
+				"Content-Type":   []string{"video/mp2t"},
+				"Content-Range":  []string{"bytes 0-12/100"},
+				"Content-Length": []string{strconv.Itoa(len(payload))},
+			},
+			Body:    io.NopCloser(bytes.NewReader(payload)),
+			Request: req,
+		}, nil
+	})}
+	session := &cloud115HLSSession{
+		ID:        "sess",
+		MediaID:   "media-1",
+		ExpiresAt: time.Now().Add(time.Hour),
+		entries:   map[string]string{"e1": "https://cpats01.115.com/seg.ts?x=1"},
+		next:      1,
+	}
+	proxy.sessions[session.ID] = session
+	req := httptest.NewRequest(http.MethodGet, "/api/cloud115/hls/sess/e1?media_id=media-1&token=t", nil)
+	req.Header.Set("Range", "bytes=0-12")
+	rec := httptest.NewRecorder()
+	if err := proxy.ServeChild(context.Background(), rec, req, session.ID, "e1"); err != nil {
+		t.Fatalf("ServeChild: %v", err)
+	}
+	if rec.Code != http.StatusPartialContent {
+		t.Fatalf("status = %d, want 206", rec.Code)
+	}
+	if rec.Header().Get("Content-Range") != "bytes 0-12/100" {
+		t.Fatalf("content-range = %q", rec.Header().Get("Content-Range"))
+	}
+	if !bytes.Equal(rec.Body.Bytes(), payload) {
+		t.Fatalf("payload = %q, want %q", rec.Body.Bytes(), payload)
+	}
+}

internal/service/cloud115_playback.go

@@ -0,0 +1,431 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/truewhile/MeBox/internal/config"
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
+	"github.com/truewhile/MeBox/internal/service/cloud"
+	"github.com/truewhile/MeBox/internal/service/cloud115"
+)
+
+var (
+	ErrCloud115TranscodePending = errors.New("115 cloud transcode pending")
+	ErrCloud115NotApplicable    = errors.New("115 cloud playback not applicable")
+)
+
+// Cloud115TranscodeState 描述当前请求清晰度的云端转码状态。
+type Cloud115TranscodeState struct {
+	State         string `json:"state"` // idle / ready / transcoding / unavailable
+	Definition    string `json:"definition,omitempty"`
+	Message       string `json:"message,omitempty"`
+	RetryAfterSec int    `json:"retry_after_sec,omitempty"`
+	StartedAt     int64  `json:"started_at,omitempty"`
+}
+
+// PlaybackInfo 是播放器加载时获取的统一播放能力描述。
+type PlaybackInfo struct {
+	MediaID        string                 `json:"media_id"`
+	Provider       string                 `json:"provider"`
+	Fallback       []string               `json:"fallback"`
+	DefaultQuality string                 `json:"default_quality"`
+	CloudQualities []PlaybackQuality      `json:"cloud_qualities,omitempty"`
+	LocalQualities []PlaybackQuality      `json:"local_qualities"`
+	Transcode      Cloud115TranscodeState `json:"transcode"`
+}
+
+type cloud115PushAttempt struct {
+	at      time.Time
+	success bool
+	message string
+}
+
+// Cloud115PlaybackService 负责 115 云端播放、清晰度列表和云端转码触发。
+// 实际的 HLS 代理在 Cloud115HLSProxy 中。
+type Cloud115PlaybackService struct {
+	cfg  *config.Config
+	log  *zap.Logger
+	repo *repository.Container
+	strm *StrmService
+
+	// transcoder 用于判断本地 HLS 档位此刻是否真的可用；未注入时按"不可用"处理，
+	// 避免向播放器推荐必然 500 的转码档位。
+	transcoder *TranscoderService
+
+	mu        sync.Mutex
+	pushState map[string]cloud115PushAttempt
+
+	proxy *Cloud115HLSProxy
+}
+
+// SetTranscoder 注入转码服务，用于标注本地 HLS 档位的可用性。
+func (s *Cloud115PlaybackService) SetTranscoder(transcoder *TranscoderService) *Cloud115PlaybackService {
+	if s != nil {
+		s.transcoder = transcoder
+	}
+	return s
+}
+
+// localTranscodeAvailable 报告本地 HLS 此刻是否可用。
+func (s *Cloud115PlaybackService) localTranscodeAvailable() bool {
+	if s == nil || s.transcoder == nil {
+		return false
+	}
+	return s.transcoder.Available()
+}
+
+func NewCloud115PlaybackService(cfg *config.Config, log *zap.Logger, repo *repository.Container, strm *StrmService) *Cloud115PlaybackService {
+	svc := &Cloud115PlaybackService{
+		cfg:       cfg,
+		log:       log,
+		repo:      repo,
+		strm:      strm,
+		pushState: make(map[string]cloud115PushAttempt),
+	}
+	svc.proxy = newCloud115HLSProxy(svc)
+	return svc
+}
+
+// HLSProxy 返回 115 云 HLS 反向代理。
+func (s *Cloud115PlaybackService) HLSProxy() *Cloud115HLSProxy {
+	if s == nil {
+		return nil
+	}
+	return s.proxy
+}
+
+// PlaybackInfo 返回媒体在 direct/115-cloud/local 三种模式下的能力描述。
+//
+// requestedDefinition 为空或 0 时默认选择 1080P；该档位不可用时返回
+// transcoding 状态（并只触发一次加速转码，避免轮询风暴）。
+func (s *Cloud115PlaybackService) PlaybackInfo(ctx context.Context, mediaID string, requestedDefinition int) (*PlaybackInfo, error) {
+	if s == nil || s.repo == nil || s.repo.Media == nil {
+		return nil, ErrMediaNotFound
+	}
+	m, err := s.repo.Media.FindByID(ctx, mediaID)
+	if err != nil {
+		return nil, err
+	}
+	if m == nil {
+		return nil, ErrMediaNotFound
+	}
+
+	provider := MediaPlaybackProvider(m)
+	localQualities := LocalQualityOptions(m, s.localTranscodeAvailable())
+	localDefault := DefaultLocalHLSQualityID(m)
+	info := &PlaybackInfo{
+		MediaID:        m.ID,
+		Provider:       provider,
+		DefaultQuality: localDefault,
+		LocalQualities: localQualities,
+		Transcode:      Cloud115TranscodeState{State: "idle"},
+	}
+	if provider != model.StrmProvider115 {
+		info.Fallback = []string{"direct", "local_hls"}
+		return info, nil
+	}
+
+	account, pickCode, client, err := s.resolve115Target(ctx, m)
+	if err != nil {
+		info.Fallback = []string{"direct", "local_hls"}
+		info.Transcode = Cloud115TranscodeState{State: "unavailable", Message: err.Error()}
+		return info, nil
+	}
+
+	resp, data, playErr := client.GetVideoPlayInfo(ctx, pickCode, cloud115.DefaultUA)
+	if cloud115PlayInfoFatal(resp, playErr) {
+		info.Fallback = []string{"direct", "local_hls"}
+		info.Transcode = Cloud115TranscodeState{
+			State:   "unavailable",
+			Message: cloud115PlayErrorMessage(playErr, resp),
+		}
+		return info, nil
+	}
+
+	cloudQualities := Cloud115QualityOptions(m, data)
+	info.CloudQualities = cloudQualities
+	info.Fallback = []string{"direct", "cloud_hls", "local_hls"}
+	info.DefaultQuality = DefaultCloud115Quality(cloudQualities)
+
+	requested := strings.TrimSpace(strconv.Itoa(requestedDefinition))
+	if requestedDefinition <= 0 || requested == "0" {
+		requested = info.DefaultQuality
+	}
+	selected, ok := findPlaybackQuality(cloudQualities, requested)
+	if !ok {
+		info.Transcode = Cloud115TranscodeState{
+			State:      "unavailable",
+			Definition: requested,
+			Message:    "115 不支持该清晰度",
+		}
+		return info, nil
+	}
+	if selected.Source == "original" {
+		info.Transcode = Cloud115TranscodeState{State: "ready", Definition: selected.ID}
+		return info, nil
+	}
+	if selected.Available {
+		info.Transcode = Cloud115TranscodeState{State: "ready", Definition: selected.ID}
+		return info, nil
+	}
+
+	info.Transcode = s.ensureCloudTranscode(ctx, account.ID, pickCode, selected, client)
+	return info, nil
+}
+
+// StartTranscode 显式触发某个清晰度的云端转码，返回最新状态。
+func (s *Cloud115PlaybackService) StartTranscode(ctx context.Context, mediaID string, definition int) (*PlaybackInfo, error) {
+	return s.PlaybackInfo(ctx, mediaID, definition)
+}
+
+// ResolveCloud115URL 返回指定清晰度的 115 云端 m3u8 地址。
+// 档位尚未转码完成时返回 ErrCloud115TranscodePending。
+func (s *Cloud115PlaybackService) ResolveCloud115URL(ctx context.Context, mediaID string, definition int) (string, *cloud115.VideoPlayData, error) {
+	m, err := s.repo.Media.FindByID(ctx, mediaID)
+	if err != nil {
+		return "", nil, err
+	}
+	if m == nil {
+		return "", nil, ErrMediaNotFound
+	}
+	if MediaPlaybackProvider(m) != model.StrmProvider115 {
+		return "", nil, ErrCloud115NotApplicable
+	}
+	_, pickCode, client, err := s.resolve115Target(ctx, m)
+	if err != nil {
+		return "", nil, err
+	}
+	resp, data, playErr := client.GetVideoPlayInfo(ctx, pickCode, cloud115.DefaultUA)
+	if cloud115PlayInfoFatal(resp, playErr) {
+		return "", data, fmt.Errorf("115 云端播放不可用：%s", cloud115PlayErrorMessage(playErr, resp))
+	}
+	requested := definition
+	if requested <= 0 {
+		requested = 4
+	}
+	item := findVideoURL(data, requested)
+	if item == nil || strings.TrimSpace(item.URL) == "" {
+		return "", data, ErrCloud115TranscodePending
+	}
+	return strings.TrimSpace(item.URL), data, nil
+}
+
+func (s *Cloud115PlaybackService) ensureCloudTranscode(
+	ctx context.Context,
+	accountID, pickCode string,
+	quality PlaybackQuality,
+	client *cloud115.OpenClient,
+) Cloud115TranscodeState {
+	key := accountID + ":" + pickCode
+	now := time.Now()
+
+	s.mu.Lock()
+	if last, ok := s.pushState[key]; ok {
+		ttl := 2 * time.Minute
+		if last.success {
+			ttl = 3 * time.Hour
+		}
+		if now.Sub(last.at) < ttl {
+			s.mu.Unlock()
+			return Cloud115TranscodeState{
+				State:         "transcoding",
+				Definition:    quality.ID,
+				Message:       last.message,
+				RetryAfterSec: 5,
+				StartedAt:     last.at.Unix(),
+			}
+		}
+	}
+	s.mu.Unlock()
+
+	err := client.SubmitVideoPush(ctx, pickCode, "vip_push")
+	attempt := cloud115PushAttempt{at: now, success: err == nil}
+	if err != nil {
+		attempt.message = fmt.Sprintf("115 云端转码排队中（加速请求未成功：%s）", cloud115PlayErrorMessage(err, nil))
+	} else {
+		attempt.message = fmt.Sprintf("已触发 115 云端转码，正在等待 %s…", quality.Label)
+	}
+
+	s.mu.Lock()
+	s.pushState[key] = attempt
+	s.mu.Unlock()
+
+	return Cloud115TranscodeState{
+		State:         "transcoding",
+		Definition:    quality.ID,
+		Message:       attempt.message,
+		RetryAfterSec: 5,
+		StartedAt:     now.Unix(),
+	}
+}
+
+func (s *Cloud115PlaybackService) resolve115Target(ctx context.Context, m *model.Media) (*model.StrmAccount, string, *cloud115.OpenClient, error) {
+	if s == nil || s.strm == nil || s.repo == nil || s.repo.StrmAccount == nil {
+		return nil, "", nil, ErrCloud115NotApplicable
+	}
+	raw := strings.TrimSpace(m.STRMURL)
+	if raw == "" && strings.HasSuffix(strings.ToLower(strings.TrimSpace(m.Path)), ".strm") {
+		parsed, err := readLocalSTRMTarget(m.Path)
+		if err != nil {
+			return nil, "", nil, err
+		}
+		raw = strings.TrimSpace(parsed)
+	}
+	if raw == "" {
+		return nil, "", nil, fmt.Errorf("缺少 STRM 播放目标")
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return nil, "", nil, err
+	}
+	if !strings.Contains(strings.ToLower(u.Path), "/api/strm/play/cloud115/") &&
+		!strings.Contains(strings.ToLower(u.Path), "/api/cloud/play/cloud115") {
+		return nil, "", nil, ErrCloud115NotApplicable
+	}
+	accountID := strings.TrimSpace(u.Query().Get("acct"))
+	if accountID == "" {
+		return nil, "", nil, fmt.Errorf("缺少 115 账号 ID")
+	}
+	pickCode := strings.TrimSpace(u.Query().Get("pickcode"))
+	if pickCode == "" {
+		return nil, "", nil, fmt.Errorf("缺少 115 pickcode")
+	}
+	account, err := s.repo.StrmAccount.FindByID(ctx, accountID)
+	if err != nil {
+		return nil, "", nil, err
+	}
+	if account == nil || !account.Enabled {
+		return nil, "", nil, fmt.Errorf("115 账号不存在或已禁用")
+	}
+	if account.Provider != model.StrmProvider115 {
+		return nil, "", nil, ErrCloud115NotApplicable
+	}
+	provider, err := s.strm.providerFor(ctx, account)
+	if err != nil {
+		return nil, "", nil, err
+	}
+	openProvider, ok := provider.(cloud.OpenAPI115Provider)
+	if !ok || openProvider.OpenClient() == nil {
+		return nil, "", nil, ErrCloud115NotApplicable
+	}
+	return account, pickCode, openProvider.OpenClient(), nil
+}
+
+// MediaPlaybackProvider 返回媒体行的播放提供方（用于前端降级顺序）。
+func MediaPlaybackProvider(m *model.Media) string {
+	if m == nil {
+		return model.StrmProviderLocal
+	}
+	raw := strings.TrimSpace(m.STRMURL)
+	if raw == "" && strings.HasSuffix(strings.ToLower(strings.TrimSpace(m.Path)), ".strm") {
+		if target, err := readLocalSTRMTarget(m.Path); err == nil {
+			raw = strings.TrimSpace(target)
+		}
+	}
+	if raw != "" {
+		if u, err := url.Parse(raw); err == nil {
+			path := strings.ToLower(u.Path)
+			if idx := strings.Index(path, "/api/strm/play/"); idx >= 0 {
+				rest := strings.Trim(path[idx+len("/api/strm/play/"):], "/")
+				if provider, _, ok := strings.Cut(rest, "/"); ok && provider != "" {
+					return provider
+				}
+			}
+			if idx := strings.Index(path, "/api/cloud/play/"); idx >= 0 {
+				provider := strings.Trim(path[idx+len("/api/cloud/play/"):], "/")
+				if provider != "" {
+					return provider
+				}
+			}
+		}
+	}
+	if IsStrmMediaRow(m) {
+		return "strm"
+	}
+	return model.StrmProviderLocal
+}
+
+func findPlaybackQuality(options []PlaybackQuality, id string) (PlaybackQuality, bool) {
+	id = strings.TrimSpace(id)
+	for _, option := range options {
+		if option.ID == id {
+			return option, true
+		}
+	}
+	return PlaybackQuality{}, false
+}
+
+func findVideoURL(data *cloud115.VideoPlayData, definition int) *cloud115.VideoURLItem {
+	if data == nil || definition <= 0 {
+		return nil
+	}
+	for i := range data.VideoURL {
+		item := &data.VideoURL[i]
+		if item.DefinitionN == definition || item.Definition == definition {
+			return item
+		}
+	}
+	return nil
+}
+
+func cloud115PlayInfoFatal(resp *cloud115.RespBase, err error) bool {
+	if resp == nil {
+		return true
+	}
+	if bool(resp.State) {
+		return false
+	}
+	switch resp.Code {
+	case cloud115.AccessTokenAuthFail,
+		cloud115.AccessTokenExpiryCode,
+		cloud115.AccessAuthInvalid,
+		cloud115.AccessTokenFormatInvalid,
+		cloud115.RefreshTokenInvalid,
+		cloud115.TokenRefreshFail,
+		cloud115.RequestMaxLimitCode,
+		cloud115.RequestRateLimitCode:
+		return true
+	}
+	// 非鉴权/限流错误一律当作“尚未转码完成”处理，继续轮询。
+	_ = err
+	return false
+}
+
+func cloud115PlayErrorMessage(err error, resp *cloud115.RespBase) string {
+	if err != nil {
+		var apiErr *cloud115.OpenAPIError
+		if errors.As(err, &apiErr) {
+			switch apiErr.Code {
+			case cloud115.AccessTokenAuthFail,
+				cloud115.AccessTokenExpiryCode,
+				cloud115.AccessAuthInvalid,
+				cloud115.AccessTokenFormatInvalid,
+				cloud115.RefreshTokenInvalid:
+				return "115 授权已过期，请重新授权账号"
+			}
+			if strings.TrimSpace(apiErr.Message) != "" {
+				return apiErr.Message
+			}
+		}
+		return err.Error()
+	}
+	if resp != nil {
+		if msg := strings.TrimSpace(resp.Message); msg != "" {
+			return msg
+		}
+		if msg := strings.TrimSpace(resp.Error); msg != "" {
+			return msg
+		}
+	}
+	return "115 云端播放不可用"
+}

internal/service/cloud115_playback_test.go

@@ -0,0 +1,203 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"go.uber.org/zap"
+
+	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
+	"github.com/truewhile/MeBox/internal/service/cloud115"
+)
+
+func TestCloud115PlaybackInfoTriggersTranscodeOnce(t *testing.T) {
+	var playCalls int32
+	var pushCalls int32
+	var ready int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/open/video/play":
+			atomic.AddInt32(&playCalls, 1)
+			if atomic.LoadInt32(&ready) == 0 {
+				_ = json.NewEncoder(w).Encode(map[string]any{
+					"state":   false,
+					"code":    0,
+					"message": "转码中",
+					"data":    map[string]any{},
+				})
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"state":   true,
+				"code":    0,
+				"message": "",
+				"data": map[string]any{
+					"file_name": "test.mkv",
+					"definition_list_new": map[string]string{
+						"4": "1080P",
+					},
+					"video_url": []map[string]any{
+						{
+							"url":          "http://cdn.example/master.m3u8",
+							"definition":   4,
+							"definition_n": 4,
+							"width":        1920,
+							"height":       1080,
+							"title":        "1080P",
+						},
+					},
+				},
+			})
+		case "/open/video/video_push":
+			atomic.AddInt32(&pushCalls, 1)
+			_ = json.NewEncoder(w).Encode(map[string]any{"state": true, "code": 0, "data": []any{}})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	oldBase := cloud115.ProAPIBase
+	cloud115.ProAPIBase = server.URL
+	defer func() { cloud115.ProAPIBase = oldBase }()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.Media{})
+	repos := repository.New(db)
+	strm := NewStrmService(nil, zap.NewNop(), repos, NewCryptoService("test-secret", zap.NewNop()))
+	ctx := context.Background()
+	account, err := strm.CreateStrmAccount(ctx, "115", model.StrmProvider115, map[string]string{
+		"app_id":        "100195129",
+		"access_token":  "at",
+		"refresh_token": "rt",
+	})
+	if err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	media := &model.Media{
+		Base:      model.Base{ID: "media-1"},
+		Title:     "test",
+		Path:      "/media/test.strm",
+		Container: "strm",
+		Height:    1080,
+		STRMURL:   "/api/strm/play/cloud115/video.mkv?acct=" + account.ID + "&pickcode=pc",
+	}
+	if err := db.Create(media).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+	svc := NewCloud115PlaybackService(nil, zap.NewNop(), repos, strm)
+
+	info, err := svc.PlaybackInfo(ctx, media.ID, 0)
+	if err != nil {
+		t.Fatalf("first playback info: %v", err)
+	}
+	if info.Provider != model.StrmProvider115 || info.DefaultQuality != "4" {
+		t.Fatalf("unexpected playback info: %#v", info)
+	}
+	if info.Transcode.State != "transcoding" {
+		t.Fatalf("transcode state = %q, want transcoding", info.Transcode.State)
+	}
+	if got := atomic.LoadInt32(&pushCalls); got != 1 {
+		t.Fatalf("push calls = %d, want 1", got)
+	}
+
+	if _, err := svc.PlaybackInfo(ctx, media.ID, 0); err != nil {
+		t.Fatalf("second playback info: %v", err)
+	}
+	if got := atomic.LoadInt32(&pushCalls); got != 1 {
+		t.Fatalf("push calls after polling = %d, want 1", got)
+	}
+
+	atomic.StoreInt32(&ready, 1)
+	info, err = svc.PlaybackInfo(ctx, media.ID, 0)
+	if err != nil {
+		t.Fatalf("ready playback info: %v", err)
+	}
+	if info.Transcode.State != "ready" {
+		t.Fatalf("transcode state = %q, want ready", info.Transcode.State)
+	}
+	url, _, err := svc.ResolveCloud115URL(ctx, media.ID, 4)
+	if err != nil {
+		t.Fatalf("resolve cloud url: %v", err)
+	}
+	if url != "http://cdn.example/master.m3u8" {
+		t.Fatalf("url = %q", url)
+	}
+	if got := atomic.LoadInt32(&playCalls); got < 3 {
+		t.Fatalf("play calls = %d, want >= 3", got)
+	}
+}
+
+func TestCloud115PlaybackInfoTranscodePendingBeforeReady(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/open/video/play":
+			_ = json.NewEncoder(w).Encode(map[string]any{"state": false, "code": 0, "message": "转码中", "data": map[string]any{}})
+		case "/open/video/video_push":
+			_ = json.NewEncoder(w).Encode(map[string]any{"state": true, "code": 0, "data": []any{}})
+		}
+	}))
+	defer server.Close()
+	oldBase := cloud115.ProAPIBase
+	cloud115.ProAPIBase = server.URL
+	defer func() { cloud115.ProAPIBase = oldBase }()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.Media{})
+	repos := repository.New(db)
+	strm := NewStrmService(nil, zap.NewNop(), repos, NewCryptoService("test-secret", zap.NewNop()))
+	ctx := context.Background()
+	account, err := strm.CreateStrmAccount(ctx, "115", model.StrmProvider115, map[string]string{
+		"app_id":        "100195129",
+		"access_token":  "at",
+		"refresh_token": "rt",
+	})
+	if err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	media := &model.Media{
+		Base:      model.Base{ID: "media-2"},
+		Title:     "test",
+		Path:      "/media/test2.strm",
+		Container: "strm",
+		Height:    1080,
+		STRMURL:   "/api/strm/play/cloud115/video.mkv?acct=" + account.ID + "&pickcode=pc2",
+	}
+	if err := db.Create(media).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+	svc := NewCloud115PlaybackService(nil, zap.NewNop(), repos, strm)
+	if _, _, err := svc.ResolveCloud115URL(ctx, media.ID, 4); !errors.Is(err, ErrCloud115TranscodePending) {
+		t.Fatalf("resolve pending err = %v, want ErrCloud115TranscodePending", err)
+	}
+}
+
+func TestMediaPlaybackProvider(t *testing.T) {
+	cases := []struct {
+		name string
+		raw  string
+		want string
+	}{
+		{"115", "/api/strm/play/cloud115/video.mkv?acct=1&pickcode=pc", model.StrmProvider115},
+		{"openlist", "/api/strm/play/openlist/video.mkv?acct=1&ref=/a.mkv", model.StrmProviderOpenList},
+		{"local", "/media/local.mkv", model.StrmProviderLocal},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			media := &model.Media{Path: tc.raw}
+			if tc.name != "local" {
+				media.STRMURL = tc.raw
+			}
+			got := MediaPlaybackProvider(media)
+			if got != tc.want {
+				t.Fatalf("provider = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

internal/service/danmaku_service.go

@@ -28,9 +28,9 @@ import (
 	"github.com/truewhile/MeBox/internal/repository"
 )
 
-// Danmaku setting keys, managed through the admin settings UI (PUT
-// /admin/settings). They are stored in the Setting table so the playback
-// page can pull them without admin privileges.
+// Legacy instance-level danmaku settings. Playback preferences now live on
+// model.User; these keys remain only as a fallback for unauthenticated/legacy
+// service paths and tests.
 const (
 	DanmakuEnabledKey  = "danmaku.enabled"
 	DanmakuSourceKey   = "danmaku.source"
@@ -49,6 +49,12 @@ const (
 // dandanplay protocol (search/episodes + comment/{episodeId}) may be used.
 const DanmakuDefaultSource = "https://api.dandanplay.net"
 
+const (
+	minPlayerPlaybackRate     = 0.5
+	maxPlayerPlaybackRate     = 3.0
+	defaultPlayerPlaybackRate = 1.0
+)
+
 // danmakuOfficialBase is where identification (/api/v2/match) and the
 // comment/search fallback always go, regardless of the configured source.
 // A package var (not a const) so tests can point it at a local server.
@@ -56,21 +62,62 @@ var danmakuOfficialBase = DanmakuDefaultSource
 
 // DanmakuRenderConfig carries the renderer knobs to the web player.
 type DanmakuRenderConfig struct {
-	Enabled  bool   `json:"enabled"`
-	Source   string `json:"source,omitempty"`
-	Opacity  string `json:"opacity"`
-	FontSize string `json:"font_size"`
-	Area     string `json:"area"`
+	Enabled  bool    `json:"enabled"`
+	Source   string  `json:"source,omitempty"`
+	AppID    string  `json:"app_id,omitempty"`
+	Opacity  string  `json:"opacity"`
+	FontSize string  `json:"font_size"`
+	Area     string  `json:"area"`
+	Volume   float64 `json:"volume"`
+	// PlaybackRate 是当前用户的播放倍速偏好（按用户存储）。
+	PlaybackRate float64 `json:"playback_rate"`
+	// Vr360GuideSeen 表示当前用户是否已经看过 VR 全景播放的首次操作说明。
+	Vr360GuideSeen bool `json:"vr360_guide_seen"`
 	// MergeSources 是当前用户的弹幕合并偏好（按用户存储）。
 	MergeSources bool `json:"merge_sources"`
+	// AppKeyConfigured 只表明用户是否保存了应用密钥，不回传密钥明文。
+	AppKeyConfigured bool `json:"app_key_configured"`
 }
 
 // DanmakuFetchOptions 承载单次抓取的调用方偏好。
 type DanmakuFetchOptions struct {
 	// MergeSources 为真时，同一集的多个来源会被合并去重后一起返回。
 	MergeSources bool
+	// UserID 非空时使用该用户的弹幕源、凭据与渲染偏好。
+	UserID string
 }
 
+// DanmakuSettingsPatch 是播放器弹幕设置的局部更新。nil 字段保持不变。
+type DanmakuSettingsPatch struct {
+	Enabled      *bool    `json:"enabled"`
+	Source       *string  `json:"source"`
+	AppID        *string  `json:"app_id"`
+	AppKey       *string  `json:"app_key"`
+	ClearAppKey  bool     `json:"clear_app_key"`
+	Opacity      *float64 `json:"opacity"`
+	FontSize     *int     `json:"font_size"`
+	Area         *float64 `json:"area"`
+	MergeSources *bool    `json:"merge_sources"`
+	Volume       *float64 `json:"volume"`
+	PlaybackRate *float64 `json:"playback_rate"`
+	// Vr360GuideSeen 标记 VR 全景播放的首次操作说明是否已经看过。
+	Vr360GuideSeen *bool `json:"vr360_guide_seen"`
+}
+
+type danmakuUserContextKey struct{}
+
+type danmakuUserContext struct {
+	source string
+	appID  string
+	appKey string
+}
+
+// ErrNoDanmakuSettings 表示更新请求没有包含任何可写字段。
+var ErrNoDanmakuSettings = errors.New("no settings to update")
+
+// ErrInvalidDanmakuSettings 表示更新请求包含非法值。
+var ErrInvalidDanmakuSettings = errors.New("invalid player settings")
+
 // DanmakuFetchResult is what /api/danmaku/:id returns. Raw holds the upstream
 // comment payload; parsing happens client-side. The dandanplay protocol has
 // two payload shapes in the wild — the classic Bilibili-style XML and the
@@ -197,9 +244,11 @@ type danmakuResultCacheEntry struct {
 	storedAt  time.Time
 }
 
-func danmakuResultCacheKey(source, mediaID, keyword, episodeID string, merge bool) string {
+func danmakuResultCacheKey(userID, source, credentialFingerprint, mediaID, keyword, episodeID string, merge bool) string {
 	return strings.Join([]string{
+		strings.TrimSpace(userID),
 		strings.TrimSpace(source),
+		strings.TrimSpace(credentialFingerprint),
 		mediaID,
 		strings.TrimSpace(keyword),
 		strings.TrimSpace(episodeID),
@@ -207,6 +256,18 @@ func danmakuResultCacheKey(source, mediaID, keyword, episodeID string, merge boo
 	}, "\x00")
 }
 
+// danmakuCredentialFingerprint keeps credential changes in the result cache
+// key without persisting the AppSecret in plain text.
+func danmakuCredentialFingerprint(appID, appKey string) string {
+	appID = strings.TrimSpace(appID)
+	appKey = strings.TrimSpace(appKey)
+	if appID == "" && appKey == "" {
+		return ""
+	}
+	sum := md5.Sum([]byte(appID + "\x00" + appKey))
+	return hex.EncodeToString(sum[:])
+}
+
 func (s *DanmakuService) resultCacheGet(key string) (*DanmakuFetchResult, bool) {
 	if s == nil || key == "" {
 		return nil, false
@@ -297,9 +358,11 @@ func cloneDanmakuAnimeList(in []DanmakuAnime) []DanmakuAnime {
 // Config reads danmaku settings from the runtime settings table.
 func (s *DanmakuService) Config(ctx context.Context) DanmakuRenderConfig {
 	cfg := DanmakuRenderConfig{
-		Opacity:  "1",
-		FontSize: "24",
-		Area:     "1",
+		Opacity:      "1",
+		FontSize:     "24",
+		Area:         "1",
+		Volume:       1,
+		PlaybackRate: defaultPlayerPlaybackRate,
 	}
 	if s == nil || s.repo == nil || s.repo.Setting == nil {
 		return cfg
@@ -319,39 +382,191 @@ func (s *DanmakuService) Config(ctx context.Context) DanmakuRenderConfig {
 	return cfg
 }
 
-// ConfigForUser 在全局渲染设置之外附加当前用户的个性化偏好。
+// ConfigForUser 返回当前用户的播放器与弹幕偏好。用户不存在时回退到旧版
+// 全局配置，便于旧客户端和迁移期平滑工作。
 func (s *DanmakuService) ConfigForUser(ctx context.Context, userID string) DanmakuRenderConfig {
-	cfg := s.Config(ctx)
-	cfg.MergeSources = s.MergeSourcesEnabled(ctx, userID)
-	return cfg
+	if user, ok := s.findUser(ctx, userID); ok {
+		return danmakuConfigFromUser(user)
+	}
+	return s.Config(ctx)
 }
 
 // MergeSourcesEnabled 返回该用户的弹幕合并偏好，读取失败时回退为关闭。
 func (s *DanmakuService) MergeSourcesEnabled(ctx context.Context, userID string) bool {
-	if s == nil || s.repo == nil || s.repo.User == nil {
-		return false
+	if user, ok := s.findUser(ctx, userID); ok {
+		return user.DanmakuMergeSources
 	}
-	userID = strings.TrimSpace(userID)
-	if userID == "" {
-		return false
-	}
-	user, err := s.repo.User.FindByID(ctx, userID)
-	if err != nil || user == nil {
-		return false
-	}
-	return user.DanmakuMergeSources
+	return false
 }
 
-// SetMergeSources 持久化该用户的弹幕合并偏好。
-func (s *DanmakuService) SetMergeSources(ctx context.Context, userID string, enabled bool) error {
+func (s *DanmakuService) findUser(ctx context.Context, userID string) (*model.User, bool) {
 	if s == nil || s.repo == nil || s.repo.User == nil {
-		return errors.New("danmaku settings unavailable")
+		return nil, false
 	}
 	userID = strings.TrimSpace(userID)
 	if userID == "" {
-		return errors.New("missing user")
+		return nil, false
 	}
-	return s.repo.User.UpdateFields(ctx, userID, map[string]any{"danmaku_merge_sources": enabled})
+	user, err := s.repo.User.FindByID(ctx, userID)
+	return user, err == nil && user != nil
+}
+
+func danmakuConfigFromUser(user *model.User) DanmakuRenderConfig {
+	if user == nil {
+		return DanmakuRenderConfig{
+			Enabled:      true,
+			Opacity:      "1",
+			FontSize:     "24",
+			Area:         "1",
+			Volume:       1,
+			PlaybackRate: defaultPlayerPlaybackRate,
+		}
+	}
+	opacity := user.DanmakuOpacity
+	if opacity < 0.1 || opacity > 1 {
+		opacity = 1
+	}
+	fontSize := user.DanmakuFontSize
+	if fontSize < 10 || fontSize > 96 {
+		fontSize = 24
+	}
+	area := user.DanmakuArea
+	if area < 0.1 || area > 1 {
+		area = 1
+	}
+	volume := user.PlayerVolume
+	if volume < 0 || volume > 1 {
+		volume = 1
+	}
+	playbackRate := user.PlayerPlaybackRate
+	if playbackRate < minPlayerPlaybackRate || playbackRate > maxPlayerPlaybackRate {
+		playbackRate = defaultPlayerPlaybackRate
+	}
+	return DanmakuRenderConfig{
+		Enabled:          user.DanmakuEnabled,
+		Source:           strings.TrimSpace(user.DanmakuSource),
+		AppID:            strings.TrimSpace(user.DanmakuAppID),
+		Opacity:          strconv.FormatFloat(opacity, 'f', -1, 64),
+		FontSize:         strconv.Itoa(fontSize),
+		Area:             strconv.FormatFloat(area, 'f', -1, 64),
+		Volume:           volume,
+		PlaybackRate:     playbackRate,
+		Vr360GuideSeen:   user.PlayerVr360GuideSeen,
+		MergeSources:     user.DanmakuMergeSources,
+		AppKeyConfigured: strings.TrimSpace(user.DanmakuAppKey) != "",
+	}
+}
+
+// UpdateUserSettings 持久化当前用户的播放器与弹幕设置，并返回脱敏后的完整配置。
+func (s *DanmakuService) UpdateUserSettings(ctx context.Context, userID string, patch DanmakuSettingsPatch) (DanmakuRenderConfig, error) {
+	if s == nil || s.repo == nil || s.repo.User == nil {
+		return DanmakuRenderConfig{}, errors.New("player settings unavailable")
+	}
+	userID = strings.TrimSpace(userID)
+	if userID == "" {
+		return DanmakuRenderConfig{}, errors.New("missing user")
+	}
+
+	updates := map[string]any{}
+	if patch.Enabled != nil {
+		updates["danmaku_enabled"] = *patch.Enabled
+	}
+	if patch.Source != nil {
+		source, err := normalizeDanmakuSource(*patch.Source)
+		if err != nil {
+			return DanmakuRenderConfig{}, err
+		}
+		updates["danmaku_source"] = source
+	}
+	if patch.AppID != nil {
+		appID := strings.TrimSpace(*patch.AppID)
+		if len(appID) > 128 {
+			return DanmakuRenderConfig{}, fmt.Errorf("%w: app_id is too long", ErrInvalidDanmakuSettings)
+		}
+		updates["danmaku_app_id"] = appID
+	}
+	if patch.ClearAppKey {
+		updates["danmaku_app_key"] = ""
+	} else if patch.AppKey != nil {
+		if key := strings.TrimSpace(*patch.AppKey); key != "" {
+			if len(key) > 256 {
+				return DanmakuRenderConfig{}, fmt.Errorf("%w: app_key is too long", ErrInvalidDanmakuSettings)
+			}
+			updates["danmaku_app_key"] = key
+		}
+	}
+	if patch.Opacity != nil {
+		if *patch.Opacity < 0.1 || *patch.Opacity > 1 {
+			return DanmakuRenderConfig{}, fmt.Errorf("%w: opacity must be between 0.1 and 1", ErrInvalidDanmakuSettings)
+		}
+		updates["danmaku_opacity"] = *patch.Opacity
+	}
+	if patch.FontSize != nil {
+		if *patch.FontSize < 10 || *patch.FontSize > 96 {
+			return DanmakuRenderConfig{}, fmt.Errorf("%w: font_size must be between 10 and 96", ErrInvalidDanmakuSettings)
+		}
+		updates["danmaku_font_size"] = *patch.FontSize
+	}
+	if patch.Area != nil {
+		if *patch.Area < 0.1 || *patch.Area > 1 {
+			return DanmakuRenderConfig{}, fmt.Errorf("%w: area must be between 0.1 and 1", ErrInvalidDanmakuSettings)
+		}
+		updates["danmaku_area"] = *patch.Area
+	}
+	if patch.MergeSources != nil {
+		updates["danmaku_merge_sources"] = *patch.MergeSources
+	}
+	if patch.Volume != nil {
+		if *patch.Volume < 0 || *patch.Volume > 1 {
+			return DanmakuRenderConfig{}, fmt.Errorf("%w: volume must be between 0 and 1", ErrInvalidDanmakuSettings)
+		}
+		updates["player_volume"] = *patch.Volume
+	}
+	if patch.PlaybackRate != nil {
+		if *patch.PlaybackRate < minPlayerPlaybackRate || *patch.PlaybackRate > maxPlayerPlaybackRate {
+			return DanmakuRenderConfig{}, fmt.Errorf(
+				"%w: playback_rate must be between %.2f and %.2f",
+				ErrInvalidDanmakuSettings,
+				minPlayerPlaybackRate,
+				maxPlayerPlaybackRate,
+			)
+		}
+		updates["player_playback_rate"] = *patch.PlaybackRate
+	}
+	if patch.Vr360GuideSeen != nil {
+		updates["player_vr360_guide_seen"] = *patch.Vr360GuideSeen
+	}
+	if len(updates) == 0 {
+		return DanmakuRenderConfig{}, ErrNoDanmakuSettings
+	}
+	if err := s.repo.User.UpdateFields(ctx, userID, updates); err != nil {
+		return DanmakuRenderConfig{}, err
+	}
+	return s.ConfigForUser(ctx, userID), nil
+}
+
+// normalizeDanmakuSource validates a user-configured dandanplay endpoint. An
+// empty value means the official endpoint; only explicit HTTP(S) origins are
+// accepted so malformed values never reach the outbound request layer.
+func normalizeDanmakuSource(raw string) (string, error) {
+	source := strings.TrimRight(strings.TrimSpace(raw), "/")
+	if source == "" {
+		return "", nil
+	}
+	if len(source) > 512 {
+		return "", fmt.Errorf("%w: source is too long", ErrInvalidDanmakuSettings)
+	}
+	u, err := url.Parse(source)
+	if err != nil || u.Host == "" || (!strings.EqualFold(u.Scheme, "http") && !strings.EqualFold(u.Scheme, "https")) || u.User != nil {
+		return "", fmt.Errorf("%w: source must be an http(s) URL", ErrInvalidDanmakuSettings)
+	}
+	return source, nil
+}
+
+// SetMergeSources 持久化该用户的弹幕合并偏好，保留旧调用点兼容性。
+func (s *DanmakuService) SetMergeSources(ctx context.Context, userID string, enabled bool) error {
+	_, err := s.UpdateUserSettings(ctx, userID, DanmakuSettingsPatch{MergeSources: &enabled})
+	return err
 }
 
 // Fetch retrieves danmaku for the given media. keyword overrides the
@@ -388,11 +603,23 @@ func (s *DanmakuService) FetchWithOptions(ctx context.Context, mediaID, keyword,
 		return nil, errors.New("danmaku service unavailable")
 	}
 	cfg := s.Config(ctx)
+	credentialFingerprint := ""
+	if user, ok := s.findUser(ctx, opts.UserID); ok {
+		cfg = danmakuConfigFromUser(user)
+		opts.MergeSources = cfg.MergeSources
+		credentialFingerprint = danmakuCredentialFingerprint(user.DanmakuAppID, user.DanmakuAppKey)
+		ctx = context.WithValue(ctx, danmakuUserContextKey{}, danmakuUserContext{
+			source: cfg.Source,
+			appID:  strings.TrimSpace(user.DanmakuAppID),
+			appKey: strings.TrimSpace(user.DanmakuAppKey),
+		})
+	}
 	if !cfg.Enabled {
 		return &DanmakuFetchResult{DanmakuRenderConfig: cfg, SourceType: "auto"}, nil
 	}
-	key := danmakuResultCacheKey(cfg.Source, mediaID, keyword, episodeID, opts.MergeSources)
+	key := danmakuResultCacheKey(opts.UserID, cfg.Source, credentialFingerprint, mediaID, keyword, episodeID, opts.MergeSources)
 	if cached, ok := s.resultCacheGet(key); ok {
+		cached.DanmakuRenderConfig = cfg
 		return cached, nil
 	}
 	value, err, _ := s.fetchGroup.Do(key, func() (any, error) {
@@ -400,7 +627,7 @@ func (s *DanmakuService) FetchWithOptions(ctx context.Context, mediaID, keyword,
 		if cached, ok := s.resultCacheGet(key); ok {
 			return cached, nil
 		}
-		res, err := s.fetchWithOptionsUncached(ctx, mediaID, keyword, episodeID, opts)
+		res, err := s.fetchWithOptionsUncached(ctx, cfg, mediaID, keyword, episodeID, opts)
 		if err != nil {
 			// 与原实现一致：失败时仍把已填充的渲染配置/匹配信息交给调用方。
 			return res, err
@@ -409,6 +636,9 @@ func (s *DanmakuService) FetchWithOptions(ctx context.Context, mediaID, keyword,
 		return res, nil
 	})
 	res, _ := value.(*DanmakuFetchResult)
+	if res != nil {
+		res.DanmakuRenderConfig = cfg
+	}
 	if err != nil {
 		return cloneDanmakuFetchResult(res), err
 	}
@@ -416,8 +646,8 @@ func (s *DanmakuService) FetchWithOptions(ctx context.Context, mediaID, keyword,
 }
 
 // fetchWithOptionsUncached 是未命中缓存时执行的原始抓取流程。
-func (s *DanmakuService) fetchWithOptionsUncached(ctx context.Context, mediaID, keyword, episodeID string, opts DanmakuFetchOptions) (*DanmakuFetchResult, error) {
-	res := &DanmakuFetchResult{DanmakuRenderConfig: s.Config(ctx), SourceType: "auto"}
+func (s *DanmakuService) fetchWithOptionsUncached(ctx context.Context, cfg DanmakuRenderConfig, mediaID, keyword, episodeID string, opts DanmakuFetchOptions) (*DanmakuFetchResult, error) {
+	res := &DanmakuFetchResult{DanmakuRenderConfig: cfg, SourceType: "auto"}
 	if !res.Enabled {
 		return res, nil
 	}
@@ -870,19 +1100,37 @@ func (s *DanmakuService) fetchBody(ctx context.Context, sourceURL string, follow
 	return string(body), nil
 }
 
-// danmakuCredentials resolves the application credentials for the official
-// dandanplay API. Admin-configured values (danmaku.app_id / danmaku.app_key)
-// win; otherwise the built-in obfuscated fallback pair is used. Returns
-// ok=false for any other host so credentials — including the built-in pair —
-// are never sent to third-party dandanplay protocol mirrors. The "official"
-// host follows danmakuOfficialBase (overridable in tests).
+// danmakuCredentials resolves application credentials. Per-user explicit
+// credentials are used for any configured source. Legacy global credentials
+// and the built-in fallback pair are only sent to the official host, never to
+// third-party dandanplay protocol mirrors.
 func (s *DanmakuService) danmakuCredentials(ctx context.Context, sourceURL string) (appID, appKey string, ok bool) {
 	u, err := url.Parse(sourceURL)
 	if err != nil {
 		return "", "", false
 	}
 	official, err := url.Parse(danmakuOfficialBase)
-	if err != nil || !strings.EqualFold(u.Hostname(), official.Hostname()) {
+	if err != nil {
+		return "", "", false
+	}
+	isOfficial := strings.EqualFold(u.Hostname(), official.Hostname())
+	if userCtx, ok := ctx.Value(danmakuUserContextKey{}).(danmakuUserContext); ok {
+		userSource := strings.TrimSpace(userCtx.source)
+		if userSource == "" {
+			userSource = danmakuOfficialBase
+		}
+		if sameDanmakuBase(sourceURL, userSource) {
+			id, key := strings.TrimSpace(userCtx.appID), strings.TrimSpace(userCtx.appKey)
+			if id != "" && key != "" {
+				return id, key, true
+			}
+			if id != "" || key != "" {
+				s.log.Warn("danmaku user credentials incomplete, ignoring them",
+					zap.Bool("has_app_id", id != ""), zap.Bool("has_app_key", key != ""))
+			}
+		}
+	}
+	if !isOfficial {
 		return "", "", false
 	}
 	var id, key string
@@ -1216,7 +1464,9 @@ func (s *DanmakuService) fetchCommentWithFallback(ctx context.Context, primary,
 		}
 		lastErr = err
 		if i < len(bases)-1 {
-			s.log.Warn("danmaku comment fetch failed on configured source, falling back to official", zap.String("source", base), zap.Error(err))
+			s.log.Warn("danmaku comment fetch failed on configured source, falling back to official",
+				zap.String("source", redactSensitiveURL(base)),
+				zap.Error(redactSensitiveError(err)))
 		}
 	}
 	return "", "auto", lastErr
@@ -1232,7 +1482,9 @@ func (s *DanmakuService) searchCandidatesWithSource(ctx context.Context, configu
 		if err == nil {
 			return candidates, configured, nil
 		}
-		s.log.Warn("danmaku search failed on configured source, falling back to official", zap.String("source", configured), zap.Error(err))
+		s.log.Warn("danmaku search failed on configured source, falling back to official",
+			zap.String("source", redactSensitiveURL(configured)),
+			zap.Error(redactSensitiveError(err)))
 	}
 	candidates, err := s.searchCandidates(ctx, official, name, episode)
 	return candidates, official, err
@@ -1366,9 +1618,9 @@ func (s *DanmakuService) lookupConfiguredEpisodes(ctx context.Context, configure
 	candidates, err := s.searchCandidates(ctx, configured, m.AnimeTitle, episodeNum)
 	if err != nil {
 		s.log.Debug("danmaku configured lookup failed",
-			zap.String("source", configured),
+			zap.String("source", redactSensitiveURL(configured)),
 			zap.String("anime", m.AnimeTitle),
-			zap.Error(err))
+			zap.Error(redactSensitiveError(err)))
 		return nil, false
 	}
 	matched := matchDanmakuEpisodes(candidates, episodeNum, m.EpisodeTitle)

internal/service/danmaku_service_test.go

@@ -60,6 +60,7 @@ func seedDanmakuMedia(t *testing.T, svc *DanmakuService, id, title, originalName
 type danmakuSourceServer struct {
 	server         *httptest.Server
 	lastSearch     string // full query (anime=...&episode=...)
+	lastHeaders    http.Header
 	searchResponse string // JSON body served for /api/v2/search/episodes
 }
 
@@ -76,6 +77,7 @@ func newDanmakuSourceServerWithSearch(t *testing.T, searchResponse string) *danm
 	mux := http.NewServeMux()
 	mux.HandleFunc("/api/v2/search/episodes", func(w http.ResponseWriter, r *http.Request) {
 		ds.lastSearch = r.URL.RawQuery
+		ds.lastHeaders = r.Header.Clone()
 		w.Header().Set("Content-Type", "application/json")
 		fmt.Fprint(w, ds.searchResponse)
 	})
@@ -404,3 +406,43 @@ func TestDanmakuFetchCoalescesConcurrentRequests(t *testing.T) {
 	}
 	require.EqualValues(t, 1, atomic.LoadInt32(&searchCalls))
 }
+
+func TestDanmakuFetchUsesPerUserSourceAndCredentials(t *testing.T) {
+	srv := newDanmakuSourceServer(t)
+	svc := newDanmakuTestService(t)
+	ctx := context.Background()
+
+	user := model.User{Username: "danmaku-user", PasswordHash: "x", Role: "user", IsActive: true}
+	user.ID = "danmaku-user-1"
+	user.DanmakuEnabled = true
+	user.DanmakuSource = srv.URL()
+	user.DanmakuAppID = "user-app-id"
+	user.DanmakuAppKey = "user-app-secret"
+	user.DanmakuOpacity = 0.65
+	user.DanmakuFontSize = 30
+	user.DanmakuArea = 0.7
+	user.PlayerVolume = 0.42
+	user.PlayerPlaybackRate = 1.25
+	require.NoError(t, svc.repo.User.Create(ctx, &user))
+	seedDanmakuMedia(t, svc, "per-user-media", "测试动画", "", 0)
+
+	res, err := svc.FetchWithOptions(ctx, "per-user-media", "", "", DanmakuFetchOptions{UserID: user.ID})
+	require.NoError(t, err)
+	require.Contains(t, res.Raw, "弹幕A")
+	require.Equal(t, srv.URL(), res.Source)
+	require.Equal(t, 0.42, res.Volume)
+	require.Equal(t, 1.25, res.PlaybackRate)
+	require.Equal(t, "0.65", res.Opacity)
+	require.Equal(t, "30", res.FontSize)
+	require.Equal(t, srv.lastHeaders.Get("X-AppId"), "user-app-id")
+	require.NotEmpty(t, srv.lastHeaders.Get("X-Signature"))
+
+	// Credential rotation must invalidate the cached fetch for the same user.
+	require.NoError(t, svc.repo.User.UpdateFields(ctx, user.ID, map[string]any{
+		"danmaku_app_id":  "user-app-id-2",
+		"danmaku_app_key": "user-app-secret-2",
+	}))
+	_, err = svc.FetchWithOptions(ctx, "per-user-media", "", "", DanmakuFetchOptions{UserID: user.ID})
+	require.NoError(t, err)
+	require.Equal(t, "user-app-id-2", srv.lastHeaders.Get("X-AppId"))
+}

internal/service/emby_compat.go

@@ -21,6 +21,7 @@ import (
 	"github.com/truewhile/MeBox/internal/model"
 	"github.com/truewhile/MeBox/internal/repository"
 	"go.uber.org/zap"
+	"golang.org/x/sync/singleflight"
 )
 
 // 用一个固定的 ServerId 字符串。Emby 客户端会缓存这个 id，第一次见到
@@ -65,6 +66,12 @@ type EmbyService struct {
 	peopleMu    sync.RWMutex
 	peopleCache map[string]embyPeopleCacheEntry
 
+	// latestFlight collapses the homepage stampede: clients request Latest
+	// for every library at once, and a shared expiry used to rebuild each
+	// library in parallel.
+	latestFlight  singleflight.Group
+	latestRefresh sync.Map
+
 	tmdb          *TMDbProvider
 	adult         *AdultProvider
 	personImageMu sync.RWMutex
@@ -134,6 +141,10 @@ type ItemsParams struct {
 	SortOrder        string
 	Limit            int
 	StartIndex       int
+	// SeasonIndex 对应客户端的 Season / SeasonIndex 查询参数（季序号，0 为特别篇）。
+	// nil 表示不按季过滤；非 nil 时只返回该季的剧集。客户端普遍用季序号而不是
+	// 虚拟季 ID 请求剧集，缺了它 /Shows/{id}/Episodes?Season=N 会返回整部剧。
+	SeasonIndex *int
 }
 
 const (
@@ -198,6 +209,10 @@ func (e *EmbyService) Items(ctx context.Context, p ItemsParams) (map[string]any,
 			if containsEmbyFilter(p.Filters, "IsFavorite") {
 				return e.favoriteItems(ctx, p)
 			}
+			// 继续观看必须走 MeBox 本地 PlaybackHistory，不能转发到远程共用账号。
+			if containsEmbyFilter(p.Filters, "IsResumable") {
+				return e.resumableItems(ctx, p)
+			}
 			mountID, _, _ := DecodeEmbyRemoteID(p.ParentID)
 			mount, acct, _ := e.remote.ResolveMount(ctx, mountID)
 			if mount == nil || acct == nil {

internal/service/emby_items_cache.go

@@ -47,10 +47,20 @@ func (e *EmbyService) embyItemsCacheKey(kind string, p ItemsParams) string {
 		p.SortOrder,
 		strconv.Itoa(p.StartIndex),
 		strconv.Itoa(p.Limit),
+		formatSeasonIndexCacheKeyPart(p.SeasonIndex),
 	}, "|")))
 	return "media:emby:" + hex.EncodeToString(sum[:])
 }
 
+// formatSeasonIndexCacheKeyPart keeps "no season filter" distinct from "season 0"
+// so a client's Season=0 (specials) request never reuses an unfiltered response.
+func formatSeasonIndexCacheKeyPart(seasonIndex *int) string {
+	if seasonIndex == nil {
+		return "season:*"
+	}
+	return "season:" + strconv.Itoa(*seasonIndex)
+}
+
 func (e *EmbyService) embyLatestCacheKey(userID, parentID string, limit int) string {
 	// v2: payload tags for virtual artwork changed so clients drop cached placeholders.
 	sum := sha256.Sum256([]byte(strings.Join([]string{"latest-v2", userID, parentID, strconv.Itoa(limit)}, "|")))

internal/service/emby_items_detail.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"go.uber.org/zap"
@@ -37,14 +38,6 @@ func (e *EmbyService) Item(ctx context.Context, mediaID, userID string) (map[str
 		if err := e.mergeRemoteUserData(ctx, userID, out); err != nil {
 			return nil, err
 		}
-		if favorite, _ := IsUserFavorite(ctx, e.repo, userID, mediaID); favorite {
-			userData, _ := out["UserData"].(map[string]any)
-			if userData == nil {
-				userData = map[string]any{}
-				out["UserData"] = userData
-			}
-			userData["IsFavorite"] = true
-		}
 		return out, nil
 	}
 	if lib, err := e.repo.Library.FindByID(ctx, mediaID); err != nil {
@@ -120,44 +113,124 @@ func (e *EmbyService) Item(ctx context.Context, mediaID, userID string) (map[str
 	return e.itemPayload(e.withPayloadCache(ctx), m, fav, pos, true), nil
 }
 
-// LatestItems 最近添加，全库或指定库。远程媒体库(parentID 带前缀)直接透传远程。
+// LatestItems 最近添加，全库或指定库。远程媒体库(parentID 带前缀)走远程并缓存。
 func (e *EmbyService) LatestItems(ctx context.Context, userID, parentID string, limit int) ([]map[string]any, error) {
+	if e == nil {
+		return nil, nil
+	}
 	if limit <= 0 || limit > 100 {
 		limit = 20
 	}
-	if e.remote != nil && IsEmbyRemoteID(parentID) {
-		mountID, remoteParent, _ := DecodeEmbyRemoteID(parentID)
-		mount, acct, _ := e.remote.ResolveMount(ctx, mountID)
-		if mount == nil || acct == nil {
-			return nil, nil
+	cacheKey := e.embyLatestCacheKey(userID, parentID, limit)
+	if items, stale, ok := e.cachedLatestItemsWithStale(ctx, cacheKey); ok {
+		if stale {
+			e.refreshLatestItemsAsync(cacheKey, userID, parentID, limit)
 		}
-		if !EmbyMountLibraryAllowed(e.mediaVisibility(ctx, userID), mount) {
-			return nil, nil
+		return items, nil
+	}
+	value, err := e.loadLatestItemsCached(ctx, userID, parentID, limit)
+	if err != nil {
+		return nil, err
+	}
+	if value.Items == nil {
+		return []map[string]any{}, nil
+	}
+	return value.Items, nil
+}
+
+func (e *EmbyService) loadLatestItemsCached(ctx context.Context, userID, parentID string, limit int) (embyLatestCacheValue, error) {
+	cacheKey := e.embyLatestCacheKey(userID, parentID, limit)
+	// 一个客户端断开不应取消正在为其他客户端填充的共享重建。
+	loadCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 45*time.Second)
+	defer cancel()
+	v, err, _ := e.latestFlight.Do(cacheKey, func() (any, error) {
+		if items, ok := e.cachedLatestItems(loadCtx, cacheKey); ok {
+			return embyLatestCacheValue{Items: items}, nil
 		}
-		out, err := e.remote.RemoteLatest(ctx, mount, acct, remoteParent, limit)
+		value, err := e.loadLatestItems(loadCtx, userID, parentID, limit)
 		if err != nil {
 			return nil, err
 		}
-		if err := e.mergeRemoteUserData(ctx, userID, out); err != nil {
-			return nil, err
+		if e.cache != nil {
+			freshTTL := time.Duration(e.embyLatestCacheTTLSeconds()) * time.Second
+			e.cache.SetJSONWithStale(loadCtx, cacheKey, value, freshTTL, freshTTL+30*time.Minute)
 		}
-		return out, nil
+		e.rememberArtworkRefs(value.Artwork)
+		return value, nil
+	})
+	if err != nil {
+		return embyLatestCacheValue{}, err
+	}
+	cached, _ := v.(embyLatestCacheValue)
+	return cached, nil
+}
+
+func (e *EmbyService) refreshLatestItemsAsync(cacheKey, userID, parentID string, limit int) {
+	if e == nil || e.cache == nil {
+		return
+	}
+	if _, loaded := e.latestRefresh.LoadOrStore(cacheKey, struct{}{}); loaded {
+		return
+	}
+	go func() {
+		defer e.latestRefresh.Delete(cacheKey)
+		if _, err := e.loadLatestItemsCached(context.Background(), userID, parentID, limit); err != nil && e.log != nil {
+			e.log.Debug("background refresh of latest items failed",
+				zap.String("parent_id", parentID),
+				zap.Error(redactSensitiveError(err)))
+		}
+	}()
+}
+
+func (e *EmbyService) cachedLatestItems(ctx context.Context, cacheKey string) ([]map[string]any, bool) {
+	items, stale, ok := e.cachedLatestItemsWithStale(ctx, cacheKey)
+	return items, ok && !stale
+}
+
+func (e *EmbyService) cachedLatestItemsWithStale(ctx context.Context, cacheKey string) ([]map[string]any, bool, bool) {
+	if e == nil || e.cache == nil {
+		return nil, false, false
 	}
-	cacheKey := e.embyLatestCacheKey(userID, parentID, limit)
 	var cached embyLatestCacheValue
-	if e.cache != nil && e.cache.GetJSON(ctx, cacheKey, &cached) {
-		e.rememberArtworkRefs(cached.Artwork)
-		return cached.Items, nil
+	found, stale := e.cache.GetJSONStale(ctx, cacheKey, &cached)
+	if !found {
+		return nil, false, false
+	}
+	e.rememberArtworkRefs(cached.Artwork)
+	if cached.Items == nil {
+		return []map[string]any{}, stale, true
+	}
+	return cached.Items, stale, true
+}
+
+func (e *EmbyService) loadLatestItems(ctx context.Context, userID, parentID string, limit int) (embyLatestCacheValue, error) {
+	if e.remote != nil && IsEmbyRemoteID(parentID) {
+		mountID, remoteParent, _ := DecodeEmbyRemoteID(parentID)
+		mount, acct, _ := e.remote.ResolveMount(ctx, mountID)
+		if mount == nil || acct == nil || !EmbyMountLibraryAllowed(e.mediaVisibility(ctx, userID), mount) {
+			return embyLatestCacheValue{Items: []map[string]any{}}, nil
+		}
+		out, err := e.remote.RemoteLatestForDisplay(ctx, mount, acct, remoteParent, limit)
+		if err != nil {
+			return embyLatestCacheValue{}, err
+		}
+		if out == nil {
+			out = []map[string]any{}
+		}
+		if err := e.mergeRemoteUserData(ctx, userID, out); err != nil {
+			return embyLatestCacheValue{}, err
+		}
+		return embyLatestCacheValue{Items: out}, nil
 	}
 	q := e.repo.DB.WithContext(ctx).Model(&model.Media{}).Where("deleted_at IS NULL")
 	q = e.applyUserMediaVisibility(ctx, q, userID)
 	if parentID != "" {
 		if episodic, err := e.libraryIsEpisodic(ctx, parentID); err == nil && episodic {
 			out, artwork, err := e.latestSeriesItemsForLibrary(ctx, userID, parentID, limit)
-			if err == nil && e.cache != nil {
-				e.cache.SetJSON(ctx, cacheKey, embyLatestCacheValue{Items: out, Artwork: artwork}, time.Duration(e.embyLatestCacheTTLSeconds())*time.Second)
+			if err != nil {
+				return embyLatestCacheValue{}, err
 			}
-			return out, err
+			return embyLatestCacheValue{Items: out, Artwork: artwork}, nil
 		}
 		q = q.Where("library_id IN ?", e.mergedLibraryIDs(ctx, parentID))
 	}
@@ -170,7 +243,7 @@ func (e *EmbyService) LatestItems(ctx context.Context, userID, parentID string,
 	}
 	var rows []model.Media
 	if err := q.Order(mediaReleaseOrderSQL(true)).Limit(rowLimit).Find(&rows).Error; err != nil {
-		return nil, err
+		return embyLatestCacheValue{}, err
 	}
 	rows = e.collapseMediaVersionRows(ctx, rows)
 	if len(rows) > limit {
@@ -178,12 +251,9 @@ func (e *EmbyService) LatestItems(ctx context.Context, userID, parentID string,
 	}
 	out, err := e.payloadsForMedia(ctx, rows, userID)
 	if err != nil {
-		return nil, err
+		return embyLatestCacheValue{}, err
 	}
-	if e.cache != nil {
-		e.cache.SetJSON(ctx, cacheKey, embyLatestCacheValue{Items: out}, time.Duration(e.embyLatestCacheTTLSeconds())*time.Second)
-	}
-	return out, nil
+	return embyLatestCacheValue{Items: out}, nil
 }
 
 func (e *EmbyService) latestSeriesItemsForLibrary(ctx context.Context, userID, libraryID string, limit int) ([]map[string]any, map[string]embyArtworkRef, error) {
@@ -194,7 +264,8 @@ func (e *EmbyService) latestSeriesItemsForLibrary(ctx context.Context, userID, l
 		Where("library_id IN ? AND (season_num > 0 OR episode_num > 0)", e.mergedLibraryIDs(ctx, libraryID))
 	q = e.applyUserMediaVisibility(ctx, q, userID)
 	var rows []model.Media
-	if err := q.Order(mediaReleaseOrderSQL(true)).Limit(embySeriesGroupingLimit).Find(&rows).Error; err != nil {
+	// 只要最近几部剧的卡片，不要把整库 5 万行拉进内存再丢掉。
+	if err := q.Order(mediaReleaseOrderSQL(true)).Limit(embyLatestSeriesRowLimit(limit)).Find(&rows).Error; err != nil {
 		return nil, nil, err
 	}
 	groups := e.seriesGroupsFromMedia(ctx, rows)
@@ -209,6 +280,24 @@ func (e *EmbyService) latestSeriesItemsForLibrary(ctx context.Context, userID, l
 	return items, e.artworkRefsForSeriesGroups(groups), nil
 }
 
+// embyLatestSeriesRowLimit 是 Latest 剧集卡片的候选窗口。按「每部剧最近约 40
+// 集」估，刚好覆盖现有 25 部 × 40 集的分组测试，又不会为了 16 张海报去扫整库。
+// ponytail: 一部长剧如果占满窗口，更老的剧不会出现在 Latest 行；点进媒体库
+// 仍走完整分组。上限 2000 行。
+func embyLatestSeriesRowLimit(limit int) int {
+	if limit < 1 {
+		limit = 20
+	}
+	n := limit * 40
+	if n < 200 {
+		n = 200
+	}
+	if n > 2000 {
+		n = 2000
+	}
+	return n
+}
+
 // ResumeItems 列出有未完成播放进度的媒体。
 func (e *EmbyService) ResumeItems(ctx context.Context, userID string, limit int) (map[string]any, error) {
 	return e.resumableItems(ctx, ItemsParams{UserID: userID, Limit: limit})
@@ -369,12 +458,26 @@ func (e *EmbyService) resumableItems(ctx context.Context, p ItemsParams) (map[st
 		return map[string]any{"Items": []any{}, "TotalRecordCount": int64(0), "StartIndex": p.StartIndex}, nil
 	}
 
+	mediaIDs := make([]string, 0, len(hist))
 	localIDs := make([]string, 0, len(hist))
 	for _, h := range hist {
+		mediaIDs = append(mediaIDs, h.MediaID)
 		if !IsEmbyRemoteID(h.MediaID) {
 			localIDs = append(localIDs, h.MediaID)
 		}
 	}
+	favSet := map[string]bool{}
+	if len(mediaIDs) > 0 {
+		var favs []model.Favorite
+		if err := e.repo.DB.WithContext(ctx).
+			Where("user_id = ? AND media_id IN ?", p.UserID, mediaIDs).
+			Find(&favs).Error; err != nil {
+			return nil, err
+		}
+		for _, fav := range favs {
+			favSet[fav.MediaID] = true
+		}
+	}
 	byID := map[string]*model.Media{}
 	if len(localIDs) > 0 {
 		var medias []model.Media
@@ -393,7 +496,7 @@ func (e *EmbyService) resumableItems(ctx context.Context, p ItemsParams) (map[st
 	// 总数用候选行数（本地过滤后 + 远程候选），对继续观看行的翻页语义
 	// 足够准确。
 	needed := p.StartIndex + p.Limit
-	items := make([]map[string]any, 0, p.Limit)
+	slots := make([]resumeSlot, 0, len(hist))
 	localTotal, remoteTotal := 0, 0
 	for _, h := range hist {
 		if m, ok := byID[h.MediaID]; ok {
@@ -401,36 +504,77 @@ func (e *EmbyService) resumableItems(ctx context.Context, p ItemsParams) (map[st
 				continue
 			}
 			localTotal++
-			if produced := len(items); produced < needed {
-				items = append(items, e.itemPayload(ctx, m, false, h.PositionMs, false))
-			}
+			slots = append(slots, resumeSlot{item: e.itemPayload(ctx, m, favSet[h.MediaID], h.PositionMs, false)})
 			continue
 		}
 		if e.remote == nil || !IsEmbyRemoteID(h.MediaID) {
 			continue
 		}
 		remoteTotal++
-		if len(items) >= needed {
-			continue
-		}
-		mountID, remoteID, _ := DecodeEmbyRemoteID(h.MediaID)
-		mount, acct, err := e.remote.ResolveMount(ctx, mountID)
-		if err != nil || mount == nil || acct == nil {
-			continue
-		}
-		item, err := e.remote.RemoteItem(ctx, mount, acct, remoteID)
-		if err != nil || item == nil {
-			continue
-		}
-		if p.ParentID != "" {
-			parentID, _ := item["ParentId"].(string)
-			seriesID, _ := item["SeriesId"].(string)
-			if parentID != p.ParentID && seriesID != p.ParentID && mountID != p.ParentID {
+		slots = append(slots, resumeSlot{fetch: &resumeRemoteFetch{hist: h}})
+	}
+	for {
+		filled := 0
+		pending := make([]*resumeRemoteFetch, 0)
+		for i := range slots {
+			if slots[i].item != nil {
+				filled++
+				if filled >= needed {
+					break
+				}
 				continue
 			}
+			f := slots[i].fetch
+			if f == nil || f.done {
+				continue
+			}
+			if f.mount == nil {
+				mountID, remoteID, _ := DecodeEmbyRemoteID(f.hist.MediaID)
+				mount, acct, err := e.remote.ResolveMount(ctx, mountID)
+				if err != nil || mount == nil || acct == nil {
+					f.done = true
+					continue
+				}
+				f.mount, f.acct, f.remoteID = mount, acct, remoteID
+			}
+			pending = append(pending, f)
+			if filled+len(pending) >= needed {
+				break
+			}
 		}
-		item["UserData"] = mergedRemoteUserData(item["UserData"], &h)
-		items = append(items, item)
+		if len(pending) == 0 {
+			break
+		}
+		e.fillResumeRemotes(ctx, pending)
+		for i := range slots {
+			f := slots[i].fetch
+			if f == nil || !pendingContains(pending, f) {
+				continue
+			}
+			f.done = true
+			item := f.item
+			f.item = nil
+			if item == nil {
+				continue
+			}
+			if p.ParentID != "" {
+				parentID, _ := item["ParentId"].(string)
+				seriesID, _ := item["SeriesId"].(string)
+				mountID, _, _ := DecodeEmbyRemoteID(f.hist.MediaID)
+				if parentID != p.ParentID && seriesID != p.ParentID && mountID != p.ParentID {
+					continue
+				}
+			}
+			item["UserData"] = applyMeBoxUserData(item["UserData"], &f.hist, favSet[f.hist.MediaID])
+			slots[i].item = item
+		}
+	}
+	items := make([]map[string]any, 0, p.Limit)
+	for i := range slots {
+		if slots[i].item == nil {
+			continue
+		}
+		items = append(items, slots[i].item)
 	}
 
 	total := int64(localTotal + remoteTotal)
@@ -441,6 +585,57 @@ func (e *EmbyService) resumableItems(ctx context.Context, p ItemsParams) (map[st
 	return map[string]any{"Items": items[p.StartIndex:end], "TotalRecordCount": total, "StartIndex": p.StartIndex}, nil
 }
 
+type resumeSlot struct {
+	item  map[string]any
+	fetch *resumeRemoteFetch
+}
+
+type resumeRemoteFetch struct {
+	hist     model.PlaybackHistory
+	mount    *model.EmbyMount
+	acct     *model.StrmAccount
+	remoteID string
+	item     map[string]any
+	done     bool
+}
+
+func pendingContains(rows []*resumeRemoteFetch, target *resumeRemoteFetch) bool {
+	for _, row := range rows {
+		if row == target {
+			return true
+		}
+	}
+	return false
+}
+
+// fillResumeRemotes 并行补齐继续观看里的远程条目。同一页以前是串行 GET，
+// 远程一慢就把整个 Resume 拖到数秒。结果按原播放历史顺序回填。
+func (e *EmbyService) fillResumeRemotes(ctx context.Context, rows []*resumeRemoteFetch) {
+	if e == nil || e.remote == nil || len(rows) == 0 {
+		return
+	}
+	var wg sync.WaitGroup
+	sem := make(chan struct{}, 4)
+	for i := range rows {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			select {
+			case sem <- struct{}{}:
+			case <-ctx.Done():
+				return
+			}
+			defer func() { <-sem }()
+			item, err := e.remote.RemoteItem(ctx, rows[i].mount, rows[i].acct, rows[i].remoteID)
+			if err != nil || item == nil {
+				return
+			}
+			rows[i].item = item
+		}(i)
+	}
+	wg.Wait()
+}
+
 func (e *EmbyService) itemPayload(ctx context.Context, m *model.Media, fav bool, posMs int64, includePeople bool) map[string]any {
 	itemType := "Movie"
 	name := m.Title
@@ -448,10 +643,12 @@ func (e *EmbyService) itemPayload(ctx context.Context, m *model.Media, fav bool,
 	seriesID := m.SeriesID
 	seriesName := ""
 	seasonID := ""
+	seasonNum := m.SeasonNum
 	if e.mediaShouldBeEpisode(ctx, m) {
 		itemType = "Episode"
 		seriesID = e.seriesIDForMedia(ctx, m)
 		seriesName = e.seriesNameForMedia(ctx, m)
+		seasonNum = embySeasonNumForMedia(m)
 		seasonID = e.seasonIDForMedia(ctx, m)
 		parentID = seasonID
 		episodeTitle := strings.TrimSpace(m.EpisodeTitle)
@@ -496,7 +693,7 @@ func (e *EmbyService) itemPayload(ctx context.Context, m *model.Media, fav bool,
 		"MediaType":         "Video",
 		"IsFolder":          false,
 		"ProductionYear":    m.Year,
-		"ParentIndexNumber": m.SeasonNum,
+		"ParentIndexNumber": seasonNum,
 		"IndexNumber":       m.EpisodeNum,
 		"Overview":          m.Overview,
 		"RunTimeTicks":      runTimeTicks,
@@ -508,7 +705,7 @@ func (e *EmbyService) itemPayload(ctx context.Context, m *model.Media, fav bool,
 		"Path":              m.Path,
 		"ParentId":          parentID,
 		"SeasonId":          seasonID,
-		"SeasonName":        seasonName(m.SeasonNum),
+		"SeasonName":        seasonName(seasonNum),
 		"SeriesId":          seriesID,
 		"SeriesName":        seriesName,
 		"ImageTags":         imageTags,

internal/service/emby_items_list.go

@@ -121,16 +121,31 @@ func (e *EmbyService) mediaItems(ctx context.Context, p ItemsParams) (map[string
 
 func (e *EmbyService) episodeItems(ctx context.Context, rows []model.Media, p ItemsParams) (map[string]any, error) {
 	rows = e.filterMediaRowsForUser(ctx, rows, p.UserID)
-	if p.SearchTerm != "" {
-		filtered := rows[:0]
-		needle := strings.ToLower(p.SearchTerm)
-		for _, row := range rows {
-			if strings.Contains(strings.ToLower(row.Title), needle) || strings.Contains(strings.ToLower(row.OriginalName), needle) {
-				filtered = append(filtered, row)
+	// rows 可能来自 series 分组的内存 memo（embySeriesGroup.Episodes）。过滤必须
+	// 分配新切片：就地复用 rows[:0] 会覆写 memo 里的元素，让后续请求看到被前一次
+	// 过滤污染的剧集列表（例如按季筛选一次之后，特别篇就从缓存分组里消失了）。
+	if p.SeasonIndex != nil {
+		filtered := make([]model.Media, 0, len(rows))
+		for i := range rows {
+			if embyRowMatchesSeasonIndex(&rows[i], p.SeasonIndex) {
+				filtered = append(filtered, rows[i])
 			}
 		}
 		rows = filtered
 	}
+	if p.SearchTerm != "" {
+		needle := strings.ToLower(p.SearchTerm)
+		filtered := make([]model.Media, 0, len(rows))
+		for i := range rows {
+			if strings.Contains(strings.ToLower(rows[i].Title), needle) || strings.Contains(strings.ToLower(rows[i].OriginalName), needle) {
+				filtered = append(filtered, rows[i])
+			}
+		}
+		rows = filtered
+	}
+	// sort.SliceStable 同样会就地重排：先拷贝一份，避免把 memo 分组里的剧集顺序
+	// 按每次请求的分页/筛选结果固定下来。
+	rows = append([]model.Media(nil), rows...)
 	sort.SliceStable(rows, func(i, j int) bool {
 		if rows[i].SeasonNum != rows[j].SeasonNum {
 			return rows[i].SeasonNum < rows[j].SeasonNum

internal/service/emby_remote.go

@@ -510,12 +510,12 @@ func (r *EmbyRemoteService) ensureTokenOnLine(ctx context.Context, acct *model.S
 	req.Header.Set("X-Emby-Authorization", `MediaBrowser Client="MeBox", Device="MeBox-Federated", DeviceId="mebox-federated", Version="1.0"`)
 	resp, err := r.http.Do(req)
 	if err != nil {
-		return fmt.Errorf("连接远程 Emby 失败: %w", err)
+		return redactSensitiveError(fmt.Errorf("连接远程 Emby 失败: %w", err))
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode >= 300 {
 		data, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return fmt.Errorf("远程 Emby 登录失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data)))
+		return redactSensitiveError(fmt.Errorf("远程 Emby 登录失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data))))
 	}
 	var login struct {
 		AccessToken string `json:"AccessToken"`
@@ -599,8 +599,16 @@ func (r *EmbyRemoteService) doGet(ctx context.Context, acct *model.StrmAccount,
 	}
 	if lastErr != nil {
 		if r.log != nil && acct != nil {
-			r.log.Warn("remote emby request failed",
-				zap.String("account", acct.Name), zap.String("path", path), zap.Error(lastErr))
+			fields := []zap.Field{
+				zap.String("account", acct.Name),
+				zap.String("path", path),
+				zap.Error(redactSensitiveError(lastErr)),
+			}
+			if errors.Is(lastErr, context.Canceled) {
+				r.log.Debug("remote emby request canceled", fields...)
+			} else {
+				r.log.Warn("remote emby request failed", fields...)
+			}
 		}
 		return lastErr
 	}
@@ -629,7 +637,7 @@ func (r *EmbyRemoteService) doGetOnLine(ctx context.Context, acct *model.StrmAcc
 		req.Header.Set("X-Emby-Token", cfg.Token)
 		resp, err := r.http.Do(req)
 		if err != nil {
-			return fmt.Errorf("请求远程 Emby 失败: %w", err)
+			return redactSensitiveError(fmt.Errorf("请求远程 Emby 失败: %w", err))
 		}
 		// 读 8MB+1 以区分"刚好 8MB"与"被截断"：截断的 JSON 会让
 		// Unmarshal 报 unexpected end，难以定位；这里显式报错。
@@ -656,7 +664,7 @@ func (r *EmbyRemoteService) doGetOnLine(ctx context.Context, acct *model.StrmAcc
 			continue
 		}
 		if resp.StatusCode >= 300 {
-			return fmt.Errorf("远程 Emby 请求失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data)))
+			return redactSensitiveError(fmt.Errorf("远程 Emby 请求失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data))))
 		}
 		if out == nil {
 			return nil
@@ -805,6 +813,15 @@ func (r *EmbyRemoteService) RemoteSearchMount(ctx context.Context, mount *model.
 
 // RemoteItem 拉取远程单条目详情（含响应的重写）。
 func (r *EmbyRemoteService) RemoteItem(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteID string) (map[string]any, error) {
+	cacheKey := ""
+	if r != nil && r.cache != nil && mount != nil && remoteID != "" {
+		cacheKey = r.remoteCacheKey("item", mount.ID, remoteID)
+		var cached map[string]any
+		if r.cache.GetJSON(ctx, cacheKey, &cached) && len(cached) > 0 {
+			r.rememberRemotePeople(mount, cached)
+			return cached, nil
+		}
+	}
 	cfg, err := r.remoteConfigWithToken(ctx, acct)
 	if err != nil {
 		return nil, err
@@ -817,6 +834,9 @@ func (r *EmbyRemoteService) RemoteItem(ctx context.Context, mount *model.EmbyMou
 	}
 	r.rememberRemotePeople(mount, out)
 	RewriteEmbyRemoteIDs(out, mount.ID)
+	if cacheKey != "" && len(out) > 0 {
+		r.cache.SetJSON(ctx, cacheKey, out, r.remoteMediaCacheTTL())
+	}
 	return out, nil
 }
 
@@ -840,6 +860,180 @@ func (r *EmbyRemoteService) RemoteLatest(ctx context.Context, mount *model.EmbyM
 	return out, nil
 }
 
+// RemoteLatestForDisplay 返回可直接展示的最新媒体条目。剧集库优先取 Series；
+// 远程 Latest 只返回 Episode 时，按 SeriesId 归并，避免调用方拿到单集 ID
+// 后无法在 Series 卡片列表中找到对应条目。
+func (r *EmbyRemoteService) RemoteLatestForDisplay(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteViewID string, limit int) ([]map[string]any, error) {
+	if remoteCollectionLooksEpisodic(mount.CollectionType) {
+		return r.RemoteLatestSeries(ctx, mount, acct, remoteViewID, limit)
+	}
+	items, err := r.RemoteLatest(ctx, mount, acct, remoteViewID, limit)
+	if err != nil {
+		return nil, err
+	}
+	if remoteItemsContainEpisodes(items) {
+		return remoteSeriesItemsFromLatest(mount, items, limit), nil
+	}
+	return items, nil
+}
+
+// RemoteLatestSeries 拉取剧集库最近更新的 Series。部分 Emby 服务不支持
+// DateLastContentAdded 或过滤 Series，此时回退到 Latest 并把 Episode 归并到
+// 对应 Series。
+//
+// 使用 Recursive=true 并跳过 anime/ 等中间容器，与 RemoteSeriesCards /
+// Emby 客户端列剧集方式一致。
+func (r *EmbyRemoteService) RemoteLatestSeries(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteViewID string, limit int) ([]map[string]any, error) {
+	if limit <= 0 || limit > 100 {
+		limit = 20
+	}
+	cfg, err := r.remoteConfigWithToken(ctx, acct)
+	if err != nil {
+		return nil, err
+	}
+	q := url.Values{}
+	q.Set("ParentId", remoteViewID)
+	q.Set("IncludeItemTypes", "Series")
+	q.Set("Recursive", "true")
+	q.Set("SortBy", "DateLastContentAdded")
+	q.Set("SortOrder", "Descending")
+	// 多取一些以便滤掉中间容器后仍够 limit。
+	q.Set("Limit", strconv.Itoa(limit*4))
+	q.Set("Fields", "Overview,Genres,ProviderIds,Path,RecursiveItemCount,SeriesPrimaryImage,DateCreated,DateLastMediaAdded,PremiereDate,ProductionYear,CommunityRating,CriticRating")
+	var body struct {
+		Items []map[string]any `json:"Items"`
+	}
+	if err := r.doGet(ctx, acct, cfg, "/Users/"+url.PathEscape(r.remoteUserID(cfg))+"/Items", q, &body); err == nil && len(body.Items) > 0 {
+		filtered := make([]map[string]any, 0, limit)
+		for _, it := range body.Items {
+			name := remoteItemString(it, "Name")
+			path := remoteItemString(it, "Path")
+			if remoteSeriesItemLooksLikeContainer(name, path) {
+				continue
+			}
+			filtered = append(filtered, it)
+			if len(filtered) >= limit {
+				break
+			}
+		}
+		if len(filtered) > 0 {
+			RewriteEmbyRemoteIDs(filtered, mount.ID)
+			return filtered, nil
+		}
+	}
+
+	items, err := r.RemoteLatest(ctx, mount, acct, remoteViewID, limit)
+	if err != nil {
+		return nil, err
+	}
+	return remoteSeriesItemsFromLatest(mount, items, limit), nil
+}
+
+func remoteCollectionLooksEpisodic(collectionType string) bool {
+	switch strings.ToLower(strings.TrimSpace(collectionType)) {
+	case "tvshows", "tv":
+		return true
+	default:
+		return false
+	}
+}
+
+func remoteItemsContainEpisodes(items []map[string]any) bool {
+	for _, item := range items {
+		if strings.EqualFold(strings.TrimSpace(remoteItemString(item, "Type")), "Episode") {
+			return true
+		}
+	}
+	return false
+}
+
+func remoteSeriesItemsFromLatest(mount *model.EmbyMount, items []map[string]any, limit int) []map[string]any {
+	if limit <= 0 || limit > 100 {
+		limit = 20
+	}
+	out := make([]map[string]any, 0, len(items))
+	seen := make(map[string]struct{}, len(items))
+	for _, item := range items {
+		if len(out) >= limit {
+			break
+		}
+		if !strings.EqualFold(strings.TrimSpace(remoteItemString(item, "Type")), "Episode") {
+			id := strings.TrimSpace(remoteItemString(item, "Id"))
+			if id == "" {
+				continue
+			}
+			if _, exists := seen[id]; exists {
+				continue
+			}
+			seen[id] = struct{}{}
+			out = append(out, item)
+			continue
+		}
+
+		seriesID := remoteItemSeriesID(item, mount)
+		if seriesID == "" {
+			continue
+		}
+		if _, exists := seen[seriesID]; exists {
+			continue
+		}
+		seen[seriesID] = struct{}{}
+		out = append(out, remoteSeriesPayloadFromEpisode(mount, item, seriesID))
+	}
+	return out
+}
+
+func remoteItemSeriesID(item map[string]any, mount *model.EmbyMount) string {
+	seriesID := strings.TrimSpace(remoteItemString(item, "SeriesId"))
+	if seriesID == "" {
+		return ""
+	}
+	if _, rawID, ok := DecodeEmbyRemoteID(seriesID); ok {
+		if mount == nil {
+			return rawID
+		}
+		return EncodeEmbyRemoteID(mount.ID, rawID)
+	}
+	if mount == nil {
+		return seriesID
+	}
+	return EncodeEmbyRemoteID(mount.ID, seriesID)
+}
+
+func remoteSeriesPayloadFromEpisode(mount *model.EmbyMount, episode map[string]any, seriesID string) map[string]any {
+	name := strings.TrimSpace(remoteItemString(episode, "SeriesName"))
+	if name == "" {
+		name = strings.TrimSpace(remoteItemString(episode, "Name"))
+	}
+	out := map[string]any{
+		"Id":   seriesID,
+		"Name": name,
+		"Type": "Series",
+	}
+	if mount != nil && strings.TrimSpace(mount.RemoteViewID) != "" {
+		out["ParentId"] = EncodeEmbyRemoteID(mount.ID, mount.RemoteViewID)
+	}
+	if tag := strings.TrimSpace(remoteItemString(episode, "SeriesPrimaryImageTag")); tag != "" {
+		out["ImageTags"] = map[string]any{"Primary": tag}
+	}
+	year := remoteItemInt(episode, "SeriesProductionYear")
+	if year == 0 {
+		year = remoteItemInt(episode, "SeriesYear")
+	}
+	if year == 0 {
+		year = remoteItemInt(episode, "ProductionYear")
+	}
+	if year > 0 {
+		out["ProductionYear"] = year
+	}
+	for _, key := range []string{"Genres", "ProviderIds", "DateLastMediaAdded", "CommunityRating", "CriticRating", "OfficialRating"} {
+		if value, ok := episode[key]; ok {
+			out[key] = value
+		}
+	}
+	return out
+}
+
 // RemotePlaybackInfo 拉取远程 PlaybackInfo，并按挂载的 proxy_play 配置重写
 // 播放 URL：不代理=指向远程绝对地址（播放字节不过 MeBox）；代理=指向 MeBox
 // 本地 /Videos/{encodedID} 端点（由 ProxyVideoStream 反代）。
@@ -1109,7 +1303,7 @@ func (r *EmbyRemoteService) proxyVideoStreamOnLine(ctx context.Context, w http.R
 	defer resp.Body.Close()
 	if resp.StatusCode >= 400 {
 		data, _ := io.ReadAll(io.LimitReader(resp.Body, 256))
-		return fmt.Errorf("远程 Emby 视频流失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data)))
+		return redactSensitiveError(fmt.Errorf("远程 Emby 视频流失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data))))
 	}
 	for _, header := range []string{"Content-Type", "Content-Length", "Content-Range", "Accept-Ranges", "ETag", "Cache-Control"} {
 		if value := resp.Header.Get(header); value != "" {
@@ -1269,12 +1463,12 @@ func (r *EmbyRemoteService) doMutateOnLine(ctx context.Context, cfg *EmbyRemoteC
 	req.Header.Set("X-Emby-Token", cfg.Token)
 	resp, err := r.http.Do(req)
 	if err != nil {
-		return fmt.Errorf("请求远程 Emby 失败: %w", err)
+		return redactSensitiveError(fmt.Errorf("请求远程 Emby 失败: %w", err))
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode >= 300 {
 		data, _ := io.ReadAll(io.LimitReader(resp.Body, 256))
-		return fmt.Errorf("远程 Emby 状态同步失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data)))
+		return redactSensitiveError(fmt.Errorf("远程 Emby 状态同步失败(%d): %s", resp.StatusCode, strings.TrimSpace(string(data))))
 	}
 	return nil
 }

internal/service/emby_remote_web.go

@@ -180,31 +180,31 @@ func (r *EmbyRemoteService) MapRemoteItemToMedia(ctx context.Context, mount *mod
 	if _, rid, ok := DecodeEmbyRemoteID(seriesID); ok {
 		seriesID = rid
 	}
-		rating := remoteItemFloat(item, "CommunityRating")
-		if rating == 0 {
-			rating = remoteItemFloat(item, "CriticRating")
-		}
-		year := remoteItemInt(item, "ProductionYear")
-		if year == 0 {
-			year = remoteItemInt(item, "Year")
-		}
-		if year == 0 {
-			year = remoteItemInt(item, "SeriesProductionYear")
-		}
-		if year == 0 {
-			year = remoteItemInt(item, "SeriesYear")
-		}
-		media := model.Media{
-			Base:         model.Base{ID: EncodeEmbyRemoteID(encodeScope, remoteID)},
-			Title:        remoteItemString(item, "Name"),
-			OriginalName: remoteItemString(item, "OriginalTitle"),
-			Overview:     remoteItemString(item, "Overview"),
-			Year:         year,
-			Rating:       float32(rating),
-			Path:         remoteItemString(item, "Path"),
-			Genres:       remoteItemGenres(item),
-			ScrapeStatus: "done",
-		}
+	rating := remoteItemFloat(item, "CommunityRating")
+	if rating == 0 {
+		rating = remoteItemFloat(item, "CriticRating")
+	}
+	year := remoteItemInt(item, "ProductionYear")
+	if year == 0 {
+		year = remoteItemInt(item, "Year")
+	}
+	if year == 0 {
+		year = remoteItemInt(item, "SeriesProductionYear")
+	}
+	if year == 0 {
+		year = remoteItemInt(item, "SeriesYear")
+	}
+	media := model.Media{
+		Base:         model.Base{ID: EncodeEmbyRemoteID(encodeScope, remoteID)},
+		Title:        remoteItemString(item, "Name"),
+		OriginalName: remoteItemString(item, "OriginalTitle"),
+		Overview:     remoteItemString(item, "Overview"),
+		Year:         year,
+		Rating:       float32(rating),
+		Path:         remoteItemString(item, "Path"),
+		Genres:       remoteItemGenres(item),
+		ScrapeStatus: "done",
+	}
 	if date, ok := parseEmbyRemoteDate(remoteItemString(item, "DateCreated")); ok {
 		media.CreatedAt = date
 		media.UpdatedAt = date
@@ -388,6 +388,17 @@ func (r *EmbyRemoteService) RemoteMediaDetail(ctx context.Context, mount *model.
 // remoteMediaDetailRaw 拉取远程条目详情，同时返回原始载荷（ID 已伪装），
 // 供调用方免二次请求读取 Type / SeriesId 等字段。
 func (r *EmbyRemoteService) remoteMediaDetailRaw(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteID string) (*model.Media, map[string]any, error) {
+	cacheKey := ""
+	if r != nil && r.cache != nil && mount != nil && remoteID != "" {
+		cacheKey = r.remoteCacheKey("detail", mount.ID, remoteID)
+		var cached struct {
+			Media *model.Media   `json:"media"`
+			Raw   map[string]any `json:"raw"`
+		}
+		if r.cache.GetJSON(ctx, cacheKey, &cached) && cached.Media != nil {
+			return cached.Media, cached.Raw, nil
+		}
+	}
 	cfg, err := r.remoteConfigWithToken(ctx, acct)
 	if err != nil {
 		return nil, nil, err
@@ -400,6 +411,12 @@ func (r *EmbyRemoteService) remoteMediaDetailRaw(ctx context.Context, mount *mod
 	}
 	RewriteEmbyRemoteIDs(out, mount.ID)
 	m := r.MapRemoteItemToMedia(ctx, mount, acct, cfg, out)
+	if cacheKey != "" {
+		r.cache.SetJSON(ctx, cacheKey, struct {
+			Media *model.Media   `json:"media"`
+			Raw   map[string]any `json:"raw"`
+		}{Media: &m, Raw: out}, r.remoteMediaCacheTTL())
+	}
 	return &m, out, nil
 }
 
@@ -492,19 +509,24 @@ func (r *EmbyRemoteService) remoteEpisodesOf(ctx context.Context, mount *model.E
 	return items, total, nil
 }
 
+// remoteSeriesPageSize 是远程剧集分页拉取的每页条数：Fields 带 Overview/Path
+// 等重字段，单页 1000 条时载荷会超过 doGet 的 8MB 截断上限，JSON 被静默截断
+// 直接解析失败，因此按 200 条翻页拉全量。
+const remoteSeriesPageSize = 200
+
 // RemoteSeriesCards 远程剧集库的系列卡片（ChildCount 作为集数）。
 //
-// 远程 Emby 的 Series DTO 不会返回 DateLastMediaAdded 字段（即使请求 Fields
-// 也缺失），但其服务端排序支持 SortBy=DateLastContentAdded——即客户端"上次
-// 添加集日期"排序。因此这里直接按该键倒序分页拉全量，返回的卡片顺序与对方
-// Emby 客户端选择"上次添加集日期"完全一致；LastAddedAt 在远程提供字段时
-// 才填充，否则保持 nil（前端对无该值的卡片维持服务器顺序，不再回退加入日期）。
+// 与 Emby 客户端一致：IncludeItemTypes=Series + Recursive=true，按
+// DateLastContentAdded 倒序分页拉全库剧集。多媒体根下的 anime/ 等中间容器
+// 若偶发出现在结果里则过滤掉；LastAddedAt 仅在远程提供 DateLastMediaAdded
+// 时填充。
 func (r *EmbyRemoteService) RemoteSeriesCards(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteViewID string) ([]SeriesCard, error) {
 	cfg, err := r.remoteConfigWithToken(ctx, acct)
 	if err != nil {
 		return nil, err
 	}
-	cacheKey := r.remoteCacheKey("series-cards", acct.ID, mount.ID, remoteViewID)
+	// v3：Recursive=true（对齐 Emby 客户端），与旧直属/下探缓存区分。
+	cacheKey := r.remoteCacheKey("series-cards-v3", acct.ID, mount.ID, remoteViewID)
 	var cached []SeriesCard
 	if r.cache != nil && r.cache.GetJSON(ctx, cacheKey, &cached) {
 		return cached, nil
@@ -512,19 +534,17 @@ func (r *EmbyRemoteService) RemoteSeriesCards(ctx context.Context, mount *model.
 	q := url.Values{}
 	q.Set("ParentId", remoteViewID)
 	q.Set("IncludeItemTypes", "Series")
-	q.Set("Recursive", "false")
+	q.Set("Recursive", "true")
 	q.Set("SortBy", "DateLastContentAdded")
 	q.Set("SortOrder", "Descending")
-	// 每页 200：Fields 带全量重字段（Overview/MediaStreams 等）时单页 1000
-	// 条的载荷会超过 doGet 的 8MB 截断上限，JSON 被静默截断直接解析失败。
-	q.Set("Limit", "200")
+	q.Set("Limit", strconv.Itoa(remoteSeriesPageSize))
 	q.Set("Fields", "Overview,Genres,ProviderIds,Path,RecursiveItemCount,SeriesPrimaryImage,DateCreated,DateLastMediaAdded,PremiereDate,ProductionYear,CommunityRating,CriticRating")
 	var body struct {
 		Items            []map[string]any `json:"Items"`
 		TotalRecordCount int64            `json:"TotalRecordCount"`
 	}
 	cards := make([]SeriesCard, 0)
-	for startIndex := 0; ; startIndex += 200 {
+	for startIndex := 0; ; startIndex += remoteSeriesPageSize {
 		q.Set("StartIndex", strconv.Itoa(startIndex))
 		body.Items = nil
 		if err := r.doGet(ctx, acct, cfg, "/Users/"+url.PathEscape(r.remoteUserID(cfg))+"/Items", q, &body); err != nil {
@@ -534,9 +554,13 @@ func (r *EmbyRemoteService) RemoteSeriesCards(ctx context.Context, mount *model.
 			break
 		}
 		for _, it := range body.Items {
+			name := remoteItemString(it, "Name")
+			path := remoteItemString(it, "Path")
+			if remoteSeriesItemLooksLikeContainer(name, path) {
+				continue
+			}
 			RewriteEmbyRemoteIDs(it, mount.ID)
 			m := r.MapRemoteItemToMedia(ctx, mount, acct, cfg, it)
-			// 集数优先用递归条目数（ChildCount 只算直属 Season 文件夹数）。
 			count := remoteItemInt(it, "RecursiveItemCount")
 			if count == 0 {
 				count = remoteItemInt(it, "ChildCount")
@@ -548,9 +572,16 @@ func (r *EmbyRemoteService) RemoteSeriesCards(ctx context.Context, mount *model.
 			if date, ok := parseEmbyRemoteDate(remoteItemString(it, "DateLastMediaAdded")); ok {
 				lastAdded = &date
 			}
-			cards = append(cards, SeriesCard{Key: m.ID, Rep: m, LinkMedia: m, Count: count, LastAddedAt: lastAdded})
+			cards = append(cards, SeriesCard{
+				Key:         m.ID,
+				Rep:         m,
+				LinkMedia:   m,
+				Count:       count,
+				IsSeries:    true,
+				LastAddedAt: lastAdded,
+			})
 		}
-		if int64(len(cards)) >= body.TotalRecordCount || len(body.Items) < 1000 {
+		if int64(startIndex+len(body.Items)) >= body.TotalRecordCount || len(body.Items) < remoteSeriesPageSize {
 			break
 		}
 	}
@@ -560,6 +591,14 @@ func (r *EmbyRemoteService) RemoteSeriesCards(ctx context.Context, mount *model.
 	return cards, nil
 }
 
+func remoteSeriesItemLooksLikeContainer(name, path string) bool {
+	if isEmbyGenericContainer(name) {
+		return true
+	}
+	base := pathBaseSlash(strings.TrimRight(strings.ReplaceAll(path, "\\", "/"), "/"))
+	return base != "" && isEmbyGenericContainer(base)
+}
+
 // RemoteLatestCards 远程库最新条目（首页预览卡片），映射 SeriesCard。
 func (r *EmbyRemoteService) RemoteLatestCards(ctx context.Context, mount *model.EmbyMount, acct *model.StrmAccount, remoteViewID string, limit int) ([]SeriesCard, error) {
 	cfg, err := r.remoteConfigWithToken(ctx, acct)
@@ -572,52 +611,14 @@ func (r *EmbyRemoteService) RemoteLatestCards(ctx context.Context, mount *model.
 		return cached, nil
 	}
 
-	// 剧集类媒体库：直接拉取最新入库/更新的 Series 剧集本身（按上次添加集日期倒序）。
-	// 避免 Emby /Items/Latest 默认返回无年份/无系列海报的单集（Episode）。
-	if mount != nil && (mount.CollectionType == "tvshows" || mount.CollectionType == "tv") {
-		q := url.Values{}
-		q.Set("ParentId", remoteViewID)
-		q.Set("IncludeItemTypes", "Series")
-		q.Set("Recursive", "false")
-		q.Set("SortBy", "DateLastContentAdded")
-		q.Set("SortOrder", "Descending")
-		q.Set("Limit", strconv.Itoa(limit))
-		q.Set("Fields", "Overview,Genres,ProviderIds,Path,RecursiveItemCount,SeriesPrimaryImage,DateCreated,DateLastMediaAdded,PremiereDate,ProductionYear,CommunityRating,CriticRating")
-		var body struct {
-			Items []map[string]any `json:"Items"`
-		}
-		if err := r.doGet(ctx, acct, cfg, "/Users/"+url.PathEscape(r.remoteUserID(cfg))+"/Items", q, &body); err == nil && len(body.Items) > 0 {
-			cards := make([]SeriesCard, 0, len(body.Items))
-			for _, it := range body.Items {
-				RewriteEmbyRemoteIDs(it, mount.ID)
-				m := r.MapRemoteItemToMedia(ctx, mount, acct, cfg, it)
-				count := remoteItemInt(it, "RecursiveItemCount")
-				if count == 0 {
-					count = remoteItemInt(it, "ChildCount")
-				}
-				if count == 0 {
-					count = 1
-				}
-				var lastAdded *time.Time
-				if date, ok := parseEmbyRemoteDate(remoteItemString(it, "DateLastMediaAdded")); ok {
-					lastAdded = &date
-				}
-				cards = append(cards, SeriesCard{Key: m.ID, Rep: m, LinkMedia: m, Count: count, LastAddedAt: lastAdded})
-			}
-			if r.cache != nil {
-				r.cache.SetJSON(ctx, cacheKey, cards, r.remoteMediaCacheTTL())
-			}
-			return cards, nil
-		}
-	}
-
-	items, err := r.RemoteLatest(ctx, mount, acct, remoteViewID, limit)
+	items, err := r.RemoteLatestForDisplay(ctx, mount, acct, remoteViewID, limit)
 	if err != nil {
 		return nil, err
 	}
 	cards := make([]SeriesCard, 0, len(items))
 	for _, it := range items {
 		m := r.MapRemoteItemToMedia(ctx, mount, acct, cfg, it)
+		isSeries := strings.EqualFold(strings.TrimSpace(remoteItemString(it, "Type")), "Series")
 		var lastAdded *time.Time
 		if !m.UpdatedAt.IsZero() {
 			t := m.UpdatedAt
@@ -630,7 +631,17 @@ func (r *EmbyRemoteService) RemoteLatestCards(ctx context.Context, mount *model.
 		if count == 0 {
 			count = remoteItemInt(it, "ChildCount")
 		}
-		cards = append(cards, SeriesCard{Key: m.ID, Rep: m, LinkMedia: m, Count: count, LastAddedAt: lastAdded})
+		if count == 0 {
+			count = 1
+		}
+		cards = append(cards, SeriesCard{
+			Key:         m.ID,
+			Rep:         m,
+			LinkMedia:   m,
+			Count:       count,
+			IsSeries:    isSeries,
+			LastAddedAt: lastAdded,
+		})
 	}
 	if r.cache != nil {
 		r.cache.SetJSON(ctx, cacheKey, cards, r.remoteMediaCacheTTL())

internal/service/emby_remote_web_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"testing"
@@ -120,10 +121,15 @@ func TestRemoteSeriesCardsAutoAuthOnFirstBrowse(t *testing.T) {
 		}
 		if r.URL.Path == "/emby/Users/real-user-guid/Items" {
 			q := r.URL.Query()
-			if q.Get("ParentId") != "view-1" || q.Get("IncludeItemTypes") != "Series" {
+			if q.Get("IncludeItemTypes") != "Series" || q.Get("ParentId") != "view-1" {
 				w.WriteHeader(http.StatusBadRequest)
 				return
 			}
+			if q.Get("Recursive") != "true" {
+				w.WriteHeader(http.StatusBadRequest)
+				_, _ = w.Write([]byte("expected Recursive=true"))
+				return
+			}
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]any{
 				"TotalRecordCount": 1,
@@ -230,6 +236,11 @@ func TestRemoteSeriesCardsResolveUserIDFromAPIKey(t *testing.T) {
 			return
 		}
 		if r.URL.Path == "/emby/Users/real-user-guid/Items" {
+			q := r.URL.Query()
+			if q.Get("ParentId") != "view-2" || q.Get("Recursive") != "true" {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]any{
 				"TotalRecordCount": 1,
@@ -465,6 +476,9 @@ func TestRemoteLatestCardsTvShowsYearAndPoster(t *testing.T) {
 	if cards[0].Count != 12 {
 		t.Fatalf("expected Count 12, got %d", cards[0].Count)
 	}
+	if !cards[0].IsSeries {
+		t.Fatalf("expected remote latest card to be marked as series")
+	}
 	if cards[0].Rep.PosterURL == "" {
 		t.Fatalf("expected PosterURL not empty")
 	}
@@ -476,6 +490,439 @@ func TestRemoteLatestCardsTvShowsYearAndPoster(t *testing.T) {
 	}
 }
 
+func TestRemoteLatestCardsTvShowsGroupsEpisodeFallbackBySeries(t *testing.T) {
+	var seriesQueryCalled atomic.Bool
+	var latestCalled atomic.Bool
+	var requestedSeriesType atomic.Value
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch strings.TrimPrefix(r.URL.Path, "/emby") {
+		case "/Users/remote-user/Items":
+			seriesQueryCalled.Store(true)
+			requestedSeriesType.Store(r.URL.Query().Get("IncludeItemTypes"))
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"Items":            []map[string]any{},
+				"TotalRecordCount": 0,
+			})
+		case "/Users/remote-user/Items/Latest":
+			latestCalled.Store(true)
+			_ = json.NewEncoder(w).Encode([]map[string]any{
+				{
+					"Id":                    "episode-2",
+					"Name":                  "第二集",
+					"Type":                  "Episode",
+					"SeriesId":              "series-b",
+					"SeriesName":            "剧集 B",
+					"SeriesProductionYear":  2025,
+					"SeriesPrimaryImageTag": "poster-b",
+				},
+				{
+					"Id":                   "episode-1",
+					"Name":                 "第一集",
+					"Type":                 "Episode",
+					"SeriesId":             "series-a",
+					"SeriesName":           "剧集 A",
+					"SeriesProductionYear": 2024,
+				},
+				{
+					"Id":         "episode-1b",
+					"Name":       "第一集下",
+					"Type":       "Episode",
+					"SeriesId":   "series-a",
+					"SeriesName": "剧集 A",
+				},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.EmbyMount{})
+	repos := repository.New(db)
+	svc := NewEmbyRemoteService(&config.Config{}, zap.NewNop(), repos, NewCryptoService("", zap.NewNop()))
+
+	rawConfig, _ := json.Marshal(map[string]string{
+		"url":            server.URL,
+		"token":          "fake-token",
+		"remote_user_id": "remote-user",
+	})
+	acct := &model.StrmAccount{
+		Base:     model.Base{ID: "acct-tv-fallback"},
+		Name:     "tv-emby",
+		Provider: model.StrmProviderEmbyRemote,
+		Config:   string(rawConfig),
+		Enabled:  true,
+	}
+	if err := repos.StrmAccount.Create(t.Context(), acct); err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	mount := &model.EmbyMount{
+		Base:           model.Base{ID: "mount-tv-fallback"},
+		AccountID:      acct.ID,
+		RemoteViewID:   "view-tv",
+		RemoteViewName: "剧集库",
+		CollectionType: "tvshows",
+		Enabled:        true,
+	}
+	if err := repos.EmbyMount.Create(t.Context(), mount); err != nil {
+		t.Fatalf("create mount: %v", err)
+	}
+
+	cards, err := svc.RemoteLatestCards(t.Context(), mount, acct, mount.RemoteViewID, 10)
+	if err != nil {
+		t.Fatalf("RemoteLatestCards failed: %v", err)
+	}
+	if !seriesQueryCalled.Load() || !latestCalled.Load() {
+		t.Fatalf("expected both Series query and Latest fallback, series=%v latest=%v", seriesQueryCalled.Load(), latestCalled.Load())
+	}
+	if got, _ := requestedSeriesType.Load().(string); got != "Series" {
+		t.Fatalf("series query IncludeItemTypes = %q, want Series", got)
+	}
+	if len(cards) != 2 {
+		t.Fatalf("expected 2 deduplicated series cards, got %d: %#v", len(cards), cards)
+	}
+	wantKeys := []string{
+		EncodeEmbyRemoteID(mount.ID, "series-b"),
+		EncodeEmbyRemoteID(mount.ID, "series-a"),
+	}
+	for i, want := range wantKeys {
+		if cards[i].Key != want {
+			t.Fatalf("card[%d].Key = %q, want %q", i, cards[i].Key, want)
+		}
+		if !cards[i].IsSeries {
+			t.Fatalf("card[%d] should be marked as series", i)
+		}
+	}
+}
+
+func TestEmbyLatestItemsRemoteTvShowsUseSeriesIDs(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch strings.TrimPrefix(r.URL.Path, "/emby") {
+		case "/Users/remote-user/Items":
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"Items":            []map[string]any{},
+				"TotalRecordCount": 0,
+			})
+		case "/Users/remote-user/Items/Latest":
+			_ = json.NewEncoder(w).Encode([]map[string]any{
+				{
+					"Id":         "episode-10",
+					"Name":       "第十集",
+					"Type":       "Episode",
+					"SeriesId":   "series-10",
+					"SeriesName": "远程剧集",
+				},
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	db := newServiceTestDB(t,
+		&model.Setting{},
+		&model.User{},
+		&model.Favorite{},
+		&model.PlaybackHistory{},
+		&model.StrmAccount{},
+		&model.EmbyMount{},
+	)
+	repos := repository.New(db)
+	remoteSvc := NewEmbyRemoteService(&config.Config{}, zap.NewNop(), repos, NewCryptoService("", zap.NewNop()))
+	svc := NewEmbyService(&config.Config{}, zap.NewNop(), repos).SetEmbyRemote(remoteSvc)
+
+	rawConfig, _ := json.Marshal(map[string]string{
+		"url":            server.URL,
+		"token":          "fake-token",
+		"remote_user_id": "remote-user",
+	})
+	acct := &model.StrmAccount{
+		Base:     model.Base{ID: "acct-emby-latest"},
+		Name:     "tv-emby",
+		Provider: model.StrmProviderEmbyRemote,
+		Config:   string(rawConfig),
+		Enabled:  true,
+	}
+	if err := repos.StrmAccount.Create(t.Context(), acct); err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	mount := &model.EmbyMount{
+		Base:           model.Base{ID: "mount-emby-latest"},
+		AccountID:      acct.ID,
+		RemoteViewID:   "view-tv",
+		RemoteViewName: "剧集库",
+		CollectionType: "tvshows",
+		Enabled:        true,
+	}
+	if err := repos.EmbyMount.Create(t.Context(), mount); err != nil {
+		t.Fatalf("create mount: %v", err)
+	}
+
+	items, err := svc.LatestItems(t.Context(), "user-1", EncodeEmbyRemoteID(mount.ID, mount.RemoteViewID), 10)
+	if err != nil {
+		t.Fatalf("LatestItems failed: %v", err)
+	}
+	if len(items) != 1 {
+		t.Fatalf("expected 1 series item, got %d: %#v", len(items), items)
+	}
+	if items[0]["Type"] != "Series" {
+		t.Fatalf("latest item Type = %#v, want Series", items[0]["Type"])
+	}
+	wantID := EncodeEmbyRemoteID(mount.ID, "series-10")
+	if items[0]["Id"] != wantID {
+		t.Fatalf("latest item Id = %#v, want %q", items[0]["Id"], wantID)
+	}
+}
+
+// 远程剧集库分页拉全量：超过一页时必须继续翻页，否则第 201 条之后的剧集
+// 既不会出现在媒体库列表里，首页深链过来的 ?series= 也无从命中。
+func TestRemoteSeriesCardsFetchAllPages(t *testing.T) {
+	const totalSeries = remoteSeriesPageSize*2 + 50
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		query := r.URL.Query()
+		if query.Get("Recursive") != "true" {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = w.Write([]byte("expected Recursive=true"))
+			return
+		}
+		startIndex, _ := strconv.Atoi(query.Get("StartIndex"))
+		limit, _ := strconv.Atoi(query.Get("Limit"))
+		requests.Add(1)
+		items := make([]map[string]any, 0, limit)
+		for i := startIndex; i < totalSeries && len(items) < limit; i++ {
+			items = append(items, map[string]any{
+				"Id":                 "series-" + strconv.Itoa(i),
+				"Name":               "剧集 " + strconv.Itoa(i),
+				"Type":               "Series",
+				"RecursiveItemCount": 12,
+			})
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"Items":            items,
+			"TotalRecordCount": totalSeries,
+		})
+	}))
+	defer server.Close()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.EmbyMount{})
+	repos := repository.New(db)
+	svc := NewEmbyRemoteService(&config.Config{}, zap.NewNop(), repos, NewCryptoService("", zap.NewNop()))
+
+	rawConfig, _ := json.Marshal(map[string]string{
+		"url":            server.URL,
+		"token":          "fake-token",
+		"remote_user_id": "remote-user",
+	})
+	acct := &model.StrmAccount{
+		Base:     model.Base{ID: "acct-series-pages"},
+		Name:     "tv-emby",
+		Provider: model.StrmProviderEmbyRemote,
+		Config:   string(rawConfig),
+		Enabled:  true,
+	}
+	if err := repos.StrmAccount.Create(t.Context(), acct); err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	mount := &model.EmbyMount{
+		Base:           model.Base{ID: "mount-series-pages"},
+		AccountID:      acct.ID,
+		RemoteViewID:   "view-tv",
+		RemoteViewName: "电视剧",
+		CollectionType: "tvshows",
+		Enabled:        true,
+	}
+	if err := repos.EmbyMount.Create(t.Context(), mount); err != nil {
+		t.Fatalf("create mount: %v", err)
+	}
+
+	cards, err := svc.RemoteSeriesCards(t.Context(), mount, acct, mount.RemoteViewID)
+	if err != nil {
+		t.Fatalf("RemoteSeriesCards failed: %v", err)
+	}
+	if len(cards) != totalSeries {
+		t.Fatalf("expected all %d series, got %d", totalSeries, len(cards))
+	}
+	if got := requests.Load(); got != 3 {
+		t.Fatalf("expected 3 paged requests, got %d", got)
+	}
+	lastKey := EncodeEmbyRemoteID(mount.ID, "series-"+strconv.Itoa(totalSeries-1))
+	if cards[len(cards)-1].Key != lastKey {
+		t.Fatalf("last card key = %q, want %q", cards[len(cards)-1].Key, lastKey)
+	}
+}
+
+// 与 Emby 客户端一致：Recursive=true 拉全库 Series，并过滤 anime 等中间容器。
+func TestRemoteSeriesCardsRecursiveFiltersAnimeContainers(t *testing.T) {
+	var sawRecursive atomic.Bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if strings.TrimPrefix(r.URL.Path, "/emby") != "/Users/remote-user/Items" {
+			http.NotFound(w, r)
+			return
+		}
+		q := r.URL.Query()
+		if q.Get("ParentId") != "view-2023" || q.Get("IncludeItemTypes") != "Series" {
+			http.NotFound(w, r)
+			return
+		}
+		if q.Get("Recursive") == "true" {
+			sawRecursive.Store(true)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"TotalRecordCount": 5,
+			"Items": []map[string]any{
+				{"Id": "c0", "Name": "anime", "Type": "Series", "Path": "https://cdn/0/anime/", "RecursiveItemCount": 3086},
+				{"Id": "c1", "Name": "anime", "Type": "Series", "Path": "https://cdn/1/anime/", "RecursiveItemCount": 567},
+				{"Id": "s-a", "Name": "数码宝贝 BEATBREAK", "Type": "Series", "Path": "https://cdn/0/anime/digimon", "RecursiveItemCount": 24},
+				{"Id": "s-b", "Name": "活死喵之夜", "Type": "Series", "Path": "https://cdn/0/anime/nyaight", "RecursiveItemCount": 12},
+				{"Id": "s-c", "Name": "药屋少女的呢喃", "Type": "Series", "Path": "https://cdn/1/anime/kusuriya", "RecursiveItemCount": 51},
+			},
+		})
+	}))
+	defer server.Close()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.EmbyMount{})
+	repos := repository.New(db)
+	svc := NewEmbyRemoteService(&config.Config{}, zap.NewNop(), repos, NewCryptoService("", zap.NewNop()))
+
+	rawConfig, _ := json.Marshal(map[string]string{
+		"url":            server.URL,
+		"token":          "fake-token",
+		"remote_user_id": "remote-user",
+	})
+	acct := &model.StrmAccount{
+		Base:     model.Base{ID: "acct-recursive"},
+		Name:     "nijigem",
+		Provider: model.StrmProviderEmbyRemote,
+		Config:   string(rawConfig),
+		Enabled:  true,
+	}
+	if err := repos.StrmAccount.Create(t.Context(), acct); err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	mount := &model.EmbyMount{
+		Base:           model.Base{ID: "mount-recursive"},
+		AccountID:      acct.ID,
+		RemoteViewID:   "view-2023",
+		RemoteViewName: "2023前 动漫",
+		CollectionType: "tvshows",
+		Enabled:        true,
+	}
+	if err := repos.EmbyMount.Create(t.Context(), mount); err != nil {
+		t.Fatalf("create mount: %v", err)
+	}
+
+	cards, err := svc.RemoteSeriesCards(t.Context(), mount, acct, mount.RemoteViewID)
+	if err != nil {
+		t.Fatalf("RemoteSeriesCards failed: %v", err)
+	}
+	if !sawRecursive.Load() {
+		t.Fatal("expected Recursive=true on remote Items request")
+	}
+	if len(cards) != 3 {
+		t.Fatalf("cards = %d, want 3 real series after filtering anime containers", len(cards))
+	}
+	for _, card := range cards {
+		if strings.EqualFold(card.Rep.Title, "anime") {
+			t.Fatalf("container title %q should have been filtered", card.Rep.Title)
+		}
+	}
+}
+
+// 首页「最新条目」卡片 key 必须与媒体库剧集列表的 key 一致，否则点击后
+// 媒体库页找不到目标剧集，只能退回整库列表。
+func TestRemoteLatestCardsKeyMatchesSeriesList(t *testing.T) {
+	var seriesQueryCalls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if strings.TrimPrefix(r.URL.Path, "/emby") != "/Users/remote-user/Items" {
+			http.NotFound(w, r)
+			return
+		}
+		seriesQueryCalls.Add(1)
+		parentID := r.URL.Query().Get("ParentId")
+		if parentID == "series-latest" {
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"Items":            []map[string]any{},
+				"TotalRecordCount": 0,
+			})
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"Items": []map[string]any{
+				{
+					"Id":                 "series-latest",
+					"Name":               "刚刚更新",
+					"Type":               "Series",
+					"RecursiveItemCount": 24,
+				},
+			},
+			"TotalRecordCount": 1,
+		})
+	}))
+	defer server.Close()
+
+	db := newServiceTestDB(t, &model.StrmAccount{}, &model.EmbyMount{})
+	repos := repository.New(db)
+	svc := NewEmbyRemoteService(&config.Config{}, zap.NewNop(), repos, NewCryptoService("", zap.NewNop()))
+
+	rawConfig, _ := json.Marshal(map[string]string{
+		"url":            server.URL,
+		"token":          "fake-token",
+		"remote_user_id": "remote-user",
+	})
+	acct := &model.StrmAccount{
+		Base:     model.Base{ID: "acct-latest-key"},
+		Name:     "tv-emby",
+		Provider: model.StrmProviderEmbyRemote,
+		Config:   string(rawConfig),
+		Enabled:  true,
+	}
+	if err := repos.StrmAccount.Create(t.Context(), acct); err != nil {
+		t.Fatalf("create account: %v", err)
+	}
+	mount := &model.EmbyMount{
+		Base:           model.Base{ID: "mount-latest-key"},
+		AccountID:      acct.ID,
+		RemoteViewID:   "view-tv",
+		RemoteViewName: "电视剧",
+		CollectionType: "tvshows",
+		Enabled:        true,
+	}
+	if err := repos.EmbyMount.Create(t.Context(), mount); err != nil {
+		t.Fatalf("create mount: %v", err)
+	}
+
+	latestCards, err := svc.RemoteLatestCards(t.Context(), mount, acct, mount.RemoteViewID, 10)
+	if err != nil {
+		t.Fatalf("RemoteLatestCards failed: %v", err)
+	}
+	if len(latestCards) != 1 || !latestCards[0].IsSeries {
+		t.Fatalf("expected 1 series latest card, got %#v", latestCards)
+	}
+	seriesCards, err := svc.RemoteSeriesCards(t.Context(), mount, acct, mount.RemoteViewID)
+	if err != nil {
+		t.Fatalf("RemoteSeriesCards failed: %v", err)
+	}
+	if seriesQueryCalls.Load() < 2 {
+		t.Fatalf("expected both latest and series list queries, got %d", seriesQueryCalls.Load())
+	}
+	found := false
+	for _, card := range seriesCards {
+		if card.Key == latestCards[0].Key {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("latest card key %q not present in series list keys %#v", latestCards[0].Key, seriesCards)
+	}
+}
+
 func TestRemoteLatestFields(t *testing.T) {
 	var requestedFields string
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/service/emby_season_index_test.go

@@ -0,0 +1,231 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/truewhile/MeBox/internal/model"
+)
+
+// seasonIndexFixture builds one series covering every season-numbering class a
+// client can ask for: two regular seasons, a generic specials bucket (season 0)
+// and an OVA folder (negative season).
+func seasonIndexFixture(t *testing.T) (*EmbyService, string) {
+	t.Helper()
+	svc := newTestEmbyService(t)
+	lib := model.Library{Name: "剧集", Path: `F:\media\剧集`, Type: "tv", Enabled: true}
+	if err := svc.repo.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	rows := []model.Media{
+		{
+			Base:       model.Base{ID: "s1e1"},
+			LibraryID:  lib.ID,
+			Title:      "權力的遊戲",
+			Path:       `F:\media\剧集\權力的遊戲 (2011)\Season 01\權力的遊戲 - S01E01.mkv`,
+			SeasonNum:  1,
+			EpisodeNum: 1,
+		},
+		{
+			Base:       model.Base{ID: "s1e2"},
+			LibraryID:  lib.ID,
+			Title:      "權力的遊戲",
+			Path:       `F:\media\剧集\權力的遊戲 (2011)\Season 01\權力的遊戲 - S01E02.mkv`,
+			SeasonNum:  1,
+			EpisodeNum: 2,
+		},
+		{
+			Base:       model.Base{ID: "s2e1"},
+			LibraryID:  lib.ID,
+			Title:      "權力的遊戲",
+			Path:       `F:\media\剧集\權力的遊戲 (2011)\Season 02\權力的遊戲 - S02E01.mkv`,
+			SeasonNum:  2,
+			EpisodeNum: 1,
+		},
+		{
+			Base:       model.Base{ID: "spec1"},
+			LibraryID:  lib.ID,
+			Title:      "權力的遊戲",
+			Path:       `F:\media\剧集\權力的遊戲 (2011)\Specials\權力的遊戲 - S00E01.mkv`,
+			SeasonNum:  0,
+			EpisodeNum: 1,
+		},
+		{
+			Base:       model.Base{ID: "ova1"},
+			LibraryID:  lib.ID,
+			Title:      "權力的遊戲",
+			Path:       `F:\media\剧集\權力的遊戲 (2011)\OVA\權力的遊戲 - OVA.mkv`,
+			SeasonNum:  0,
+			EpisodeNum: 1,
+		},
+	}
+	for i := range rows {
+		if err := svc.repo.DB.Create(&rows[i]).Error; err != nil {
+			t.Fatalf("create media: %v", err)
+		}
+	}
+
+	items, err := svc.Items(t.Context(), ItemsParams{
+		ParentID:         lib.ID,
+		IncludeItemTypes: []string{"Series"},
+		Limit:            10,
+	})
+	if err != nil {
+		t.Fatalf("series items: %v", err)
+	}
+	cards := items["Items"].([]map[string]any)
+	if len(cards) != 1 {
+		t.Fatalf("want one series card, got %#v", cards)
+	}
+	return svc, cards[0]["Id"].(string)
+}
+
+func episodeIDs(t *testing.T, out map[string]any) []string {
+	t.Helper()
+	items, ok := out["Items"].([]map[string]any)
+	if !ok {
+		t.Fatalf("Items has unexpected type: %#v", out["Items"])
+	}
+	ids := make([]string, 0, len(items))
+	for _, item := range items {
+		ids = append(ids, item["Id"].(string))
+	}
+	return ids
+}
+
+// itemsTotal reads TotalRecordCount, which is int on the episode path and int64
+// on the empty-envelope path.
+func itemsTotal(t *testing.T, out map[string]any) int {
+	t.Helper()
+	switch v := out["TotalRecordCount"].(type) {
+	case int:
+		return v
+	case int64:
+		return int(v)
+	default:
+		t.Fatalf("TotalRecordCount has unexpected type: %#v", out["TotalRecordCount"])
+		return 0
+	}
+}
+
+func assertEpisodeIDs(t *testing.T, got, want []string) {
+	t.Helper()
+	if len(got) != len(want) {
+		t.Fatalf("episode ids = %#v, want %#v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("episode ids = %#v, want %#v", got, want)
+		}
+	}
+}
+
+// TestEmbyEpisodeItemsFilterBySeasonIndex is the regression guard for clients
+// that scope episodes by season number (Season=N) instead of the virtual season
+// id: without the filter every season was returned for any requested season.
+func TestEmbyEpisodeItemsFilterBySeasonIndex(t *testing.T) {
+	svc, seriesID := seasonIndexFixture(t)
+
+	cases := []struct {
+		name      string
+		season    *int
+		wantIDs   []string
+		wantTotal int
+	}{
+		{
+			name:   "unfiltered returns every episode",
+			season: nil,
+			// episodeItems sorts by the stored season/episode numbers, so the two
+			// specials (both stored as season 0) come first in creation order.
+			wantIDs:   []string{"spec1", "ova1", "s1e1", "s1e2", "s2e1"},
+			wantTotal: 5,
+		},
+		{name: "season 1", season: intPtr(1), wantIDs: []string{"s1e1", "s1e2"}, wantTotal: 2},
+		{name: "season 2", season: intPtr(2), wantIDs: []string{"s2e1"}, wantTotal: 1},
+		{name: "season 0 is the specials bucket", season: intPtr(0), wantIDs: []string{"spec1"}, wantTotal: 1},
+		{name: "OVA season", season: intPtr(embySeasonOVA), wantIDs: []string{"ova1"}, wantTotal: 1},
+		{name: "unknown season is empty", season: intPtr(9), wantIDs: []string{}, wantTotal: 0},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := svc.Items(t.Context(), ItemsParams{
+				ParentID:         seriesID,
+				IncludeItemTypes: []string{"Episode"},
+				Recursive:        true,
+				Limit:            50,
+				SeasonIndex:      tc.season,
+			})
+			if err != nil {
+				t.Fatalf("items: %v", err)
+			}
+			assertEpisodeIDs(t, episodeIDs(t, out), tc.wantIDs)
+			if total := itemsTotal(t, out); total != tc.wantTotal {
+				t.Fatalf("TotalRecordCount = %d, want %d", total, tc.wantTotal)
+			}
+		})
+	}
+}
+
+// TestEmbySeasonIndexFilterKeepsSeasonIdsWorking pins the pre-existing
+// SeasonId behaviour: resolving through the virtual season id must still return
+// exactly that season.
+func TestEmbySeasonIndexFilterKeepsSeasonIdsWorking(t *testing.T) {
+	svc, seriesID := seasonIndexFixture(t)
+
+	items, err := svc.Items(t.Context(), ItemsParams{ParentID: seriesID, Limit: 50})
+	if err != nil {
+		t.Fatalf("seasons: %v", err)
+	}
+	seasons := items["Items"].([]map[string]any)
+	var seasonTwoID string
+	for _, season := range seasons {
+		if season["IndexNumber"] == 2 {
+			seasonTwoID = season["Id"].(string)
+		}
+	}
+	if seasonTwoID == "" {
+		t.Fatalf("season 2 missing from payload: %#v", seasons)
+	}
+
+	out, err := svc.Items(t.Context(), ItemsParams{
+		ParentID:         seasonTwoID,
+		IncludeItemTypes: []string{"Episode"},
+		Recursive:        true,
+		Limit:            50,
+	})
+	if err != nil {
+		t.Fatalf("season episodes: %v", err)
+	}
+	got := episodeIDs(t, out)
+	assertEpisodeIDs(t, got, []string{"s2e1"})
+}
+
+// TestEmbyItemsCacheKeySeparatesSeasonFilters guards against a cached unfiltered
+// response being reused for a season-scoped request (and vice versa).
+func TestEmbyItemsCacheKeySeparatesSeasonFilters(t *testing.T) {
+	svc := newTestEmbyService(t)
+	base := ItemsParams{ParentID: "series-1", IncludeItemTypes: []string{"Episode"}, Limit: 50}
+
+	unfiltered := svc.embyItemsCacheKey("items", base)
+	seasonZero := svc.embyItemsCacheKey("items", withSeasonIndex(base, 0))
+	seasonTwo := svc.embyItemsCacheKey("items", withSeasonIndex(base, 2))
+
+	if unfiltered == seasonZero {
+		t.Fatal("unfiltered and Season=0 keys must differ")
+	}
+	if unfiltered == seasonTwo {
+		t.Fatal("unfiltered and Season=2 keys must differ")
+	}
+	if seasonZero == seasonTwo {
+		t.Fatal("Season=0 and Season=2 keys must differ")
+	}
+	if again := svc.embyItemsCacheKey("items", withSeasonIndex(base, 2)); again != seasonTwo {
+		t.Fatal("cache key must be stable for the same season filter")
+	}
+}
+
+func withSeasonIndex(p ItemsParams, season int) ItemsParams {
+	p.SeasonIndex = intPtr(season)
+	return p
+}
+
+func intPtr(v int) *int { return &v }

internal/service/emby_series.go

@@ -143,8 +143,11 @@ func (e *EmbyService) findSeasonGroupBySeriesCandidates(ctx context.Context, id,
 	}
 	matched := make([]string, 0, 1)
 	for _, cand := range candidates {
-		if seasonID(cand.SeriesID, cand.SeasonNum) == id {
-			matched = append(matched, cand.SeriesID)
+		for _, seasonNum := range embySeasonCandidates(cand.SeasonNum) {
+			if seasonID(cand.SeriesID, seasonNum) == id {
+				matched = append(matched, cand.SeriesID)
+				break
+			}
 		}
 	}
 	for _, matchedSeries := range matched {
@@ -257,10 +260,7 @@ func (e *EmbyService) seasonsForSeries(series embySeriesGroup) []embySeasonGroup
 	bySeason := map[int]*embySeasonGroup{}
 	order := []int{}
 	for _, episode := range series.Episodes {
-		seasonNum := episode.SeasonNum
-		if seasonNum < 0 {
-			seasonNum = 1
-		}
+		seasonNum := embySeasonNumForMedia(&episode)
 		season, ok := bySeason[seasonNum]
 		if !ok {
 			season = &embySeasonGroup{
@@ -276,7 +276,9 @@ func (e *EmbyService) seasonsForSeries(series embySeriesGroup) []embySeasonGroup
 		}
 		season.Episodes = append(season.Episodes, episode)
 	}
-	sort.Ints(order)
+	sort.SliceStable(order, func(i, j int) bool {
+		return embySeasonSortOrder(order[i]) < embySeasonSortOrder(order[j])
+	})
 	out := make([]embySeasonGroup, 0, len(order))
 	for _, seasonNum := range order {
 		out = append(out, *bySeason[seasonNum])

internal/service/emby_series_hierarchy_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"sort"
 	"testing"
 	"time"
 
@@ -156,6 +157,12 @@ func TestEmbySeriesGroupingPaginatesAfterFullLibraryGrouping(t *testing.T) {
 	}
 }
 
+func TestEmbyLatestSeriesRowLimitCoversGroupedFixture(t *testing.T) {
+	if got := embyLatestSeriesRowLimit(25); got < 25*40 {
+		t.Fatalf("latest window %d is smaller than the 25x40 fixture", got)
+	}
+}
+
 func TestEmbyItemsKeepSpecialsInSeasonZero(t *testing.T) {
 	svc := newTestEmbyService(t)
 	lib := model.Library{Name: "番剧", Path: `F:\downloads\日番`, Type: "anime", Enabled: true}
@@ -209,6 +216,147 @@ func TestEmbyItemsKeepSpecialsInSeasonZero(t *testing.T) {
 	}
 }
 
+func TestEmbySeparatesOVAAndOADFromSeasonOne(t *testing.T) {
+	svc := newTestEmbyService(t)
+	lib := model.Library{Name: "动漫", Path: `/media/影视库/动漫`, Type: "anime", Enabled: true}
+	if err := svc.repo.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	for _, media := range []model.Media{
+		{
+			Base:       model.Base{ID: "tolove-s01e01"},
+			LibraryID:  lib.ID,
+			Title:      "出包王女",
+			Path:       `/media/影视库/动漫/出包王女/S01/To LOVE-Ru S01E01.mkv.strm`,
+			SeasonNum:  1,
+			EpisodeNum: 1,
+		},
+		{
+			Base:       model.Base{ID: "tolove-ova01"},
+			LibraryID:  lib.ID,
+			Title:      "出包王女",
+			Path:       `/media/影视库/动漫/出包王女/S01/To LOVE-Ru [OVA01].mkv.strm`,
+			SeasonNum:  0,
+			EpisodeNum: 1,
+		},
+		{
+			Base:       model.Base{ID: "tolove-oad01"},
+			LibraryID:  lib.ID,
+			Title:      "出包王女",
+			Path:       `/media/影视库/动漫/出包王女/OAD/To LOVE-Ru Darkness [OAD01].mkv.strm`,
+			SeasonNum:  -1,
+			EpisodeNum: 1,
+		},
+	} {
+		if err := svc.repo.DB.Create(&media).Error; err != nil {
+			t.Fatalf("create media: %v", err)
+		}
+	}
+
+	root, err := svc.Items(t.Context(), ItemsParams{ParentID: lib.ID, Limit: 50})
+	if err != nil {
+		t.Fatalf("library items: %v", err)
+	}
+	rootItems := root["Items"].([]map[string]any)
+	if len(rootItems) != 1 || rootItems[0]["Type"] != "Series" {
+		t.Fatalf("expected one series card, got %#v", rootItems)
+	}
+	if rootItems[0]["ChildCount"] != 3 {
+		t.Fatalf("series ChildCount = %#v, want 3", rootItems[0]["ChildCount"])
+	}
+
+	seasons, err := svc.Items(t.Context(), ItemsParams{ParentID: rootItems[0]["Id"].(string), Limit: 50})
+	if err != nil {
+		t.Fatalf("series seasons: %v", err)
+	}
+	seasonItems := seasons["Items"].([]map[string]any)
+	if len(seasonItems) != 3 {
+		t.Fatalf("expected season 1, OVA and OAD separately, got %#v", seasonItems)
+	}
+	for i, want := range []int{1, embySeasonOVA, embySeasonOAD} {
+		if seasonItems[i]["IndexNumber"] != want {
+			t.Fatalf("season order [%d] = %#v, want %d", i, seasonItems[i], want)
+		}
+	}
+
+	seasonByIndex := make(map[int]map[string]any, len(seasonItems))
+	for _, season := range seasonItems {
+		index, ok := season["IndexNumber"].(int)
+		if !ok {
+			t.Fatalf("season index has unexpected type: %#v", season)
+		}
+		seasonByIndex[index] = season
+	}
+	for index, name := range map[int]string{
+		1:             "第 1 季",
+		embySeasonOVA: "OVA",
+		embySeasonOAD: "OAD",
+	} {
+		season := seasonByIndex[index]
+		if season == nil || season["Name"] != name || season["ChildCount"] != 1 {
+			t.Fatalf("season %d = %#v, want name=%q with one episode", index, season, name)
+		}
+		episodes, err := svc.Items(t.Context(), ItemsParams{
+			ParentID:         season["Id"].(string),
+			IncludeItemTypes: []string{"Episode"},
+			Recursive:        true,
+			Limit:            50,
+		})
+		if err != nil {
+			t.Fatalf("season %d episodes: %v", index, err)
+		}
+		episodeItems := episodes["Items"].([]map[string]any)
+		if len(episodeItems) != 1 || episodeItems[0]["ParentIndexNumber"] != index {
+			t.Fatalf("season %d episodes = %#v", index, episodeItems)
+		}
+	}
+}
+
+func TestEmbySeasonSortOrderMatchesWeb(t *testing.T) {
+	seasons := []int{
+		embySeasonNCED,
+		embySeasonOAD,
+		2,
+		embySeasonTheatrical,
+		1,
+		embySeasonGenericSpecial,
+		embySeasonOVA,
+	}
+	sort.SliceStable(seasons, func(i, j int) bool {
+		return embySeasonSortOrder(seasons[i]) < embySeasonSortOrder(seasons[j])
+	})
+	want := []int{
+		1,
+		2,
+		embySeasonGenericSpecial,
+		embySeasonTheatrical,
+		embySeasonOVA,
+		embySeasonOAD,
+		embySeasonNCED,
+	}
+	for i := range want {
+		if seasons[i] != want[i] {
+			t.Fatalf("season order = %#v, want %#v", seasons, want)
+		}
+	}
+}
+
+func TestEmbySeasonCandidatesCoverPersistedSpecialNumbers(t *testing.T) {
+	for _, persisted := range []int{0, -1} {
+		candidates := embySeasonCandidates(persisted)
+		found := map[int]bool{}
+		for _, seasonNum := range candidates {
+			found[seasonNum] = true
+		}
+		if !found[embySeasonOVA] || !found[embySeasonOAD] {
+			t.Fatalf("candidates for persisted season %d = %#v, want OVA and OAD", persisted, candidates)
+		}
+	}
+	if candidates := embySeasonCandidates(2); len(candidates) != 1 || candidates[0] != 2 {
+		t.Fatalf("regular season candidates = %#v, want [2]", candidates)
+	}
+}
+
 func TestEmbyEpisodeStillIsPrimaryImageNotArt(t *testing.T) {
 	svc := newTestEmbyService(t)
 	lib := model.Library{Name: "剧集", Path: `/media/tv`, Type: "tv", Enabled: true}

internal/service/emby_series_ids.go

@@ -22,7 +22,7 @@ func (e *EmbyService) seriesIDForMedia(ctx context.Context, m *model.Media) stri
 }
 
 func (e *EmbyService) seasonIDForMedia(ctx context.Context, m *model.Media) string {
-	return seasonID(e.seriesIDForMedia(ctx, m), m.SeasonNum)
+	return seasonID(e.seriesIDForMedia(ctx, m), embySeasonNumForMedia(m))
 }
 
 func (e *EmbyService) seriesNameForMedia(ctx context.Context, m *model.Media) string {
@@ -100,23 +100,160 @@ func stableEmbyID(prefix string, parts ...string) string {
 	return prefix + hex.EncodeToString(h.Sum(nil))[:32]
 }
 
-func seasonID(seriesID string, seasonNum int) string {
-	if seasonNum < 0 {
-		seasonNum = 1
+const (
+	embySeasonTheatrical     = -1
+	embySeasonOVA            = -2
+	embySeasonOAD            = -3
+	embySeasonOVD            = -4
+	embySeasonONA            = -5
+	embySeasonExtra          = -6
+	embySeasonBonus          = -7
+	embySeasonOmake          = -8
+	embySeasonPictureDrama   = -9
+	embySeasonNCOP           = -10
+	embySeasonNCED           = -11
+	embySeasonGenericSpecial = 0
+)
+
+// embySeasonNumForMedia keeps MeBox's special categories distinct in the Emby
+// hierarchy. Databases may store every special as season 0 or -1, so the path
+// classification is authoritative when it identifies a special category.
+func embySeasonNumForMedia(m *model.Media) int {
+	if m == nil {
+		return 0
 	}
+	switch mediaSpecialKind(m.Path) {
+	case mediaSpecialTheatrical:
+		return embySeasonTheatrical
+	case mediaSpecialOVA:
+		return embySeasonOVA
+	case mediaSpecialOAD:
+		return embySeasonOAD
+	case mediaSpecialOVD:
+		return embySeasonOVD
+	case mediaSpecialONA:
+		return embySeasonONA
+	case mediaSpecialExtra:
+		return embySeasonExtra
+	case mediaSpecialBonus:
+		return embySeasonBonus
+	case mediaSpecialOmake:
+		return embySeasonOmake
+	case mediaSpecialPicture:
+		return embySeasonPictureDrama
+	case mediaSpecialNCOP:
+		return embySeasonNCOP
+	case mediaSpecialNCED:
+		return embySeasonNCED
+	case mediaSpecialGeneric:
+		return embySeasonGenericSpecial
+	}
+	if m.SeasonNum < 0 {
+		return embySeasonGenericSpecial
+	}
+	return m.SeasonNum
+}
+
+// embyRowMatchesSeasonIndex 判断某条剧集是否属于客户端请求的季序号。
+// seasonIndex 为 nil 时不参与过滤。判定复用 embySeasonNumForMedia，保证与
+// /Shows/{id}/Seasons 暴露的 IndexNumber 完全一致（含特别篇的负数分类）。
+func embyRowMatchesSeasonIndex(m *model.Media, seasonIndex *int) bool {
+	if seasonIndex == nil {
+		return true
+	}
+	return embySeasonNumForMedia(m) == *seasonIndex
+}
+
+func embySeasonCandidates(seasonNum int) []int {
+	if seasonNum > 0 {
+		return []int{seasonNum}
+	}
+	return []int{
+		embySeasonGenericSpecial,
+		embySeasonTheatrical,
+		embySeasonOVA,
+		embySeasonOAD,
+		embySeasonOVD,
+		embySeasonONA,
+		embySeasonExtra,
+		embySeasonBonus,
+		embySeasonOmake,
+		embySeasonPictureDrama,
+		embySeasonNCOP,
+		embySeasonNCED,
+	}
+}
+
+func seasonID(seriesID string, seasonNum int) string {
 	return stableEmbyID(embyVirtualSeasonPrefix, seriesID, strconv.Itoa(seasonNum))
 }
 
 func seasonName(seasonNum int) string {
-	if seasonNum == 0 {
+	switch seasonNum {
+	case embySeasonGenericSpecial:
 		return "特别篇"
-	}
-	if seasonNum < 0 {
-		seasonNum = 1
+	case embySeasonTheatrical:
+		return "剧场版"
+	case embySeasonOVA:
+		return "OVA"
+	case embySeasonOAD:
+		return "OAD"
+	case embySeasonOVD:
+		return "OVD"
+	case embySeasonONA:
+		return "ONA"
+	case embySeasonExtra:
+		return "Extra"
+	case embySeasonBonus:
+		return "Bonus"
+	case embySeasonOmake:
+		return "Omake"
+	case embySeasonPictureDrama:
+		return "Picture Drama"
+	case embySeasonNCOP:
+		return "NCOP"
+	case embySeasonNCED:
+		return "NCED"
 	}
 	return fmt.Sprintf("第 %d 季", seasonNum)
 }
 
+// embySeasonSortOrder mirrors the web UI's seasonSortOrder: regular seasons
+// first in ascending order, followed by specials in a stable category order.
+func embySeasonSortOrder(seasonNum int) int {
+	if seasonNum > 0 {
+		return seasonNum
+	}
+	switch seasonNum {
+	case embySeasonGenericSpecial:
+		return 1000
+	case embySeasonTheatrical:
+		return 1001
+	case embySeasonOVA:
+		return 1002
+	case embySeasonOAD:
+		return 1003
+	case embySeasonOVD:
+		return 1004
+	case embySeasonONA:
+		return 1005
+	case embySeasonExtra:
+		return 1006
+	case embySeasonBonus:
+		return 1007
+	case embySeasonOmake:
+		return 1008
+	case embySeasonPictureDrama:
+		return 1009
+	case embySeasonNCOP:
+		return 1010
+	case embySeasonNCED:
+		return 1011
+	default:
+		return 2000
+	}
+}
+
 func sortSeriesGroups(groups []embySeriesGroup, p ItemsParams) {
 	switch primarySupportedEmbySort(p.SortBy, false) {
 	case "sortname", "name":

internal/service/emby_user_data.go

@@ -11,8 +11,8 @@ import (
 	"github.com/truewhile/MeBox/internal/model"
 )
 
-// SetFavorite 把 mediaID 标为 userID 的收藏。挂载的远程 Emby 条目会同时写入
-// 本地 favourites 表并透传到对应远程服务器，保证网页与第三方 Emby 客户端一致。
+// SetFavorite 把 mediaID 标为 userID 的收藏。只写入 MeBox 本地 favourites 表，
+// 按 user_id 隔离；挂载远程 Emby 共用账号，不能再透传收藏以免串用户。
 func (e *EmbyService) SetFavorite(ctx context.Context, userID, mediaID string, favorite bool) error {
 	if err := SyncUserFavorite(ctx, e.repo, e.remote, userID, mediaID, favorite); err != nil {
 		return err
@@ -22,15 +22,8 @@ func (e *EmbyService) SetFavorite(ctx context.Context, userID, mediaID string, f
 }
 
 // MarkPlayed 把 mediaID 标为已看（写一个 100% 进度的 history 行）。
-// 远程 Emby 条目直接透传到对应服务器（本地不落库）。
+// 远程挂载条目同样只落本地 PlaybackHistory，按 MeBox 用户隔离。
 func (e *EmbyService) MarkPlayed(ctx context.Context, userID, mediaID string, played bool) error {
-	if e.remote != nil && IsEmbyRemoteID(mediaID) {
-		acctID, remoteID, _ := DecodeEmbyRemoteID(mediaID)
-		if err := e.ProxyRemoteSetPlayed(ctx, acctID, remoteID, played); err != nil {
-			return err
-		}
-		return nil
-	}
 	if !played {
 		err := e.repo.DB.WithContext(ctx).
 			Where("user_id = ? AND media_id = ?", userID, mediaID).
@@ -40,15 +33,20 @@ func (e *EmbyService) MarkPlayed(ctx context.Context, userID, mediaID string, pl
 		}
 		return err
 	}
-	m, err := e.repo.Media.FindByID(ctx, mediaID)
-	if err != nil || m == nil {
-		return errors.New("media not found")
+	dur := int64(0)
+	if IsEmbyRemoteID(mediaID) {
+		dur = remoteItemDurationMs(ctx, e, mediaID)
+	} else {
+		m, err := e.repo.Media.FindByID(ctx, mediaID)
+		if err != nil || m == nil {
+			return errors.New("media not found")
+		}
+		dur = int64(m.DurationSec) * 1000
 	}
-	dur := int64(m.DurationSec) * 1000
 	if dur <= 0 {
 		dur = 1
 	}
-	err = e.repo.History.Upsert(ctx, &model.PlaybackHistory{
+	err := e.repo.History.Upsert(ctx, &model.PlaybackHistory{
 		UserID:     userID,
 		MediaID:    mediaID,
 		PositionMs: dur,
@@ -62,6 +60,36 @@ func (e *EmbyService) MarkPlayed(ctx context.Context, userID, mediaID string, pl
 	return err
 }
 
+func remoteItemDurationMs(ctx context.Context, e *EmbyService, mediaID string) int64 {
+	if e == nil || e.remote == nil || !IsEmbyRemoteID(mediaID) {
+		return 0
+	}
+	mountID, remoteID, _ := DecodeEmbyRemoteID(mediaID)
+	mount, acct, err := e.remote.ResolveMount(ctx, mountID)
+	if err != nil || mount == nil || acct == nil {
+		return 0
+	}
+	item, err := e.remote.RemoteItem(ctx, mount, acct, remoteID)
+	if err != nil || item == nil {
+		return 0
+	}
+	switch ticks := item["RunTimeTicks"].(type) {
+	case float64:
+		if ticks > 0 {
+			return int64(ticks) / 10_000
+		}
+	case int64:
+		if ticks > 0 {
+			return ticks / 10_000
+		}
+	case int:
+		if ticks > 0 {
+			return int64(ticks) / 10_000
+		}
+	}
+	return 0
+}
+
 // RecordProgress 记录播放进度（来自 Emby 客户端的 /Sessions/Playing/Progress）。
 // 不携带 PlaySessionId 的旧调用仍保持兼容。
 func (e *EmbyService) RecordProgress(ctx context.Context, userID, mediaID string, positionTicks, runtimeTicks int64) error {
@@ -138,8 +166,9 @@ func embyPlaySessionStartedAtMs(playSessionID string) int64 {
 	return value
 }
 
-// mergeRemoteUserData applies the current MeBox user's locally recorded playback
-// and favourite state to remote Emby payloads.
+// mergeRemoteUserData overlays the current MeBox user's locally recorded
+// playback and favourite state onto remote Emby payloads. Remote mounts share
+// one upstream Emby account, so upstream UserData must never leak across MeBox users.
 func (e *EmbyService) mergeRemoteUserData(ctx context.Context, userID string, payload any) error {
 	if strings.TrimSpace(userID) == "" || payload == nil {
 		return nil
@@ -178,18 +207,7 @@ func (e *EmbyService) mergeRemoteUserData(ctx context.Context, userID string, pa
 	}
 	for _, item := range items {
 		id, _ := item["Id"].(string)
-		userData, _ := item["UserData"].(map[string]any)
-		if h := byMediaID[id]; h != nil {
-			item["UserData"] = mergedRemoteUserData(userData, h)
-			userData, _ = item["UserData"].(map[string]any)
-		}
-		if favSet[id] {
-			if userData == nil {
-				userData = map[string]any{}
-				item["UserData"] = userData
-			}
-			userData["IsFavorite"] = true
-		}
+		item["UserData"] = applyMeBoxUserData(item["UserData"], byMediaID[id], favSet[id])
 	}
 	return nil
 }
@@ -221,12 +239,37 @@ func remoteItemMaps(payload any) []map[string]any {
 }
 
 func mergedRemoteUserData(raw any, history *model.PlaybackHistory) map[string]any {
+	favorite := false
+	if existing, ok := raw.(map[string]any); ok {
+		if v, ok := existing["IsFavorite"].(bool); ok {
+			favorite = v
+		}
+	}
+	return applyMeBoxUserData(raw, history, favorite)
+}
+
+// applyMeBoxUserData rebuilds UserData for a remote item using only MeBox-local
+// per-user state. Shared upstream Emby favourite/progress fields are discarded.
+func applyMeBoxUserData(raw any, history *model.PlaybackHistory, favorite bool) map[string]any {
 	userData := map[string]any{}
 	if existing, ok := raw.(map[string]any); ok {
 		for key, value := range existing {
-			userData[key] = value
+			switch key {
+			case "IsFavorite", "PlaybackPositionTicks", "Played", "PlayedPercentage", "PlayCount", "LastPlayedDate":
+				continue
+			default:
+				userData[key] = value
+			}
 		}
 	}
+	userData["IsFavorite"] = favorite
+	if history == nil {
+		userData["PlaybackPositionTicks"] = int64(0)
+		userData["Played"] = false
+		userData["PlayedPercentage"] = float64(0)
+		userData["PlayCount"] = 0
+		return userData
+	}
 	duration := history.DurationMs
 	position := history.PositionMs
 	percentage := float64(0)
@@ -237,18 +280,9 @@ func mergedRemoteUserData(raw any, history *model.PlaybackHistory) map[string]an
 	userData["Played"] = history.Completed
 	userData["PlayedPercentage"] = percentage
 	if history.Completed {
-		playCount := 0
-		switch value := userData["PlayCount"].(type) {
-		case int:
-			playCount = value
-		case int64:
-			playCount = int(value)
-		case float64:
-			playCount = int(value)
-		}
-		if playCount < 1 {
-			userData["PlayCount"] = 1
-		}
+		userData["PlayCount"] = 1
+	} else {
+		userData["PlayCount"] = 0
 	}
 	return userData
 }

internal/service/emby_user_data_test.go

@@ -18,16 +18,18 @@ func TestMergedRemoteUserData(t *testing.T) {
 		preserve any
 	}{
 		{
-			name: "in-progress preserves remote fields",
+			name: "in-progress preserves non-user remote fields only",
 			raw: map[string]any{
-				"PlayCount": 2,
-				"Custom":    "remote-value",
+				"PlayCount":             2,
+				"IsFavorite":            true,
+				"PlaybackPositionTicks": int64(999),
+				"Custom":                "remote-value",
 			},
 			history:  model.PlaybackHistory{PositionMs: 25_000, DurationMs: 100_000},
 			position: 250_000_000,
 			played:   false,
 			percent:  25,
-			count:    2,
+			count:    0,
 			preserve: "remote-value",
 		},
 		{
@@ -59,10 +61,47 @@ func TestMergedRemoteUserData(t *testing.T) {
 			if tt.preserve != nil && out["Custom"] != tt.preserve {
 				t.Fatalf("Custom = %#v, want %#v", out["Custom"], tt.preserve)
 			}
+			if out["IsFavorite"] != false && out["IsFavorite"] != true {
+				t.Fatalf("IsFavorite missing: %#v", out)
+			}
 		})
 	}
 }
 
+func TestApplyMeBoxUserDataClearsSharedRemoteState(t *testing.T) {
+	out := applyMeBoxUserData(map[string]any{
+		"IsFavorite":            true,
+		"PlaybackPositionTicks": int64(42_000_000),
+		"Played":                true,
+		"PlayedPercentage":      80.0,
+		"PlayCount":             3,
+		"Key":                   "keep",
+	}, nil, false)
+	if out["IsFavorite"] != false {
+		t.Fatalf("IsFavorite = %#v, want false", out["IsFavorite"])
+	}
+	if out["PlaybackPositionTicks"] != int64(0) {
+		t.Fatalf("PlaybackPositionTicks = %#v, want 0", out["PlaybackPositionTicks"])
+	}
+	if out["Played"] != false {
+		t.Fatalf("Played = %#v, want false", out["Played"])
+	}
+	if out["PlayedPercentage"] != float64(0) {
+		t.Fatalf("PlayedPercentage = %#v, want 0", out["PlayedPercentage"])
+	}
+	if out["PlayCount"] != 0 {
+		t.Fatalf("PlayCount = %#v, want 0", out["PlayCount"])
+	}
+	if out["Key"] != "keep" {
+		t.Fatalf("Key = %#v, want keep", out["Key"])
+	}
+
+	fav := applyMeBoxUserData(map[string]any{"IsFavorite": false}, nil, true)
+	if fav["IsFavorite"] != true {
+		t.Fatalf("favorite overlay IsFavorite = %#v, want true", fav["IsFavorite"])
+	}
+}
+
 func TestRemoteItemMapsFindsEnvelopeItems(t *testing.T) {
 	remoteID := EncodeEmbyRemoteID("mount-1", "item-1")
 	payload := map[string]any{
@@ -108,3 +147,57 @@ func TestRecordProgressFallbacksToExistingHistoryDuration(t *testing.T) {
 		t.Fatalf("expected 95%% progress to be completed")
 	}
 }
+
+func TestMarkPlayedStoresRemoteItemLocallyPerUser(t *testing.T) {
+	svc := newTestEmbyService(t)
+	remoteID := EncodeEmbyRemoteID("mount-test", "item-played")
+	alice := &model.User{Username: "alice_played", Role: "user", Tier: "free", IsActive: true}
+	bob := &model.User{Username: "bob_played", Role: "user", Tier: "free", IsActive: true}
+	if err := svc.repo.User.Create(t.Context(), alice); err != nil {
+		t.Fatalf("create alice: %v", err)
+	}
+	if err := svc.repo.User.Create(t.Context(), bob); err != nil {
+		t.Fatalf("create bob: %v", err)
+	}
+
+	if err := svc.MarkPlayed(t.Context(), alice.ID, remoteID, true); err != nil {
+		t.Fatalf("mark played: %v", err)
+	}
+
+	var aliceRows, bobRows int64
+	_ = svc.repo.DB.Model(&model.PlaybackHistory{}).Where("user_id = ? AND media_id = ?", alice.ID, remoteID).Count(&aliceRows)
+	_ = svc.repo.DB.Model(&model.PlaybackHistory{}).Where("user_id = ? AND media_id = ?", bob.ID, remoteID).Count(&bobRows)
+	if aliceRows != 1 {
+		t.Fatalf("alice history rows = %d, want 1", aliceRows)
+	}
+	if bobRows != 0 {
+		t.Fatalf("bob should not see alice remote played state, rows=%d", bobRows)
+	}
+
+	payload := map[string]any{
+		"Id": remoteID,
+		"UserData": map[string]any{
+			"IsFavorite":            true,
+			"PlaybackPositionTicks": int64(50_000_000),
+			"Played":                true,
+		},
+	}
+	if err := svc.mergeRemoteUserData(t.Context(), bob.ID, payload); err != nil {
+		t.Fatalf("merge for bob: %v", err)
+	}
+	bobData := payload["UserData"].(map[string]any)
+	if bobData["IsFavorite"] != false {
+		t.Fatalf("bob IsFavorite leaked: %#v", bobData)
+	}
+	if bobData["Played"] != false || bobData["PlaybackPositionTicks"] != int64(0) {
+		t.Fatalf("bob playback leaked: %#v", bobData)
+	}
+
+	if err := svc.mergeRemoteUserData(t.Context(), alice.ID, payload); err != nil {
+		t.Fatalf("merge for alice: %v", err)
+	}
+	aliceData := payload["UserData"].(map[string]any)
+	if aliceData["Played"] != true {
+		t.Fatalf("alice Played = %#v, want true", aliceData["Played"])
+	}
+}

internal/service/favorites_sync.go

@@ -10,21 +10,14 @@ import (
 	"github.com/truewhile/MeBox/internal/repository"
 )
 
-// SyncUserFavorite keeps favourite state aligned across the local favourites table
-// and the upstream remote Emby server for mounted items.
-func SyncUserFavorite(ctx context.Context, repo *repository.Container, remote *EmbyRemoteService, userID, mediaID string, favorite bool) error {
+// SyncUserFavorite keeps favourite state in the local favourites table, keyed
+// by MeBox user_id. Remote Emby mounts share one upstream account, so favourite
+// state is intentionally not proxied upstream.
+func SyncUserFavorite(ctx context.Context, repo *repository.Container, _ *EmbyRemoteService, userID, mediaID string, favorite bool) error {
 	if repo == nil || userID == "" || mediaID == "" {
 		return errors.New("missing favourite sync inputs")
 	}
-	if err := setLocalFavorite(ctx, repo, userID, mediaID, favorite); err != nil {
-		return err
-	}
-	if favorite || IsEmbyRemoteID(mediaID) {
-		if err := proxyRemoteFavorite(ctx, remote, mediaID, favorite); err != nil {
-			return err
-		}
-	}
-	return nil
+	return setLocalFavorite(ctx, repo, userID, mediaID, favorite)
 }
 
 // IsUserFavorite reports whether the user has favourited mediaID locally.
@@ -57,18 +50,3 @@ func setLocalFavorite(ctx context.Context, repo *repository.Container, userID, m
 		Where("user_id = ? AND media_id = ?", userID, mediaID).
 		Delete(&model.Favorite{}).Error
 }
-
-func proxyRemoteFavorite(ctx context.Context, remote *EmbyRemoteService, mediaID string, favorite bool) error {
-	if remote == nil || !IsEmbyRemoteID(mediaID) {
-		return nil
-	}
-	mountID, remoteItemID, ok := DecodeEmbyRemoteID(mediaID)
-	if !ok {
-		return nil
-	}
-	_, acct, err := remote.ResolveMount(ctx, mountID)
-	if err != nil {
-		return err
-	}
-	return remote.ProxySetFavorite(ctx, acct, remoteItemID, favorite)
-}

internal/service/ffmpeg_auto_install.go

@@ -180,18 +180,20 @@ func downloadFFmpegArchive(ctx context.Context, log *zap.Logger, urls []string,
 	var lastErr error
 	for i, u := range urls {
 		if i > 0 && log != nil {
-			log.Warn("ffmpeg 主下载源不可用，切换备用源", zap.String("url", u))
+			log.Warn("ffmpeg 主下载源不可用，切换备用源", zap.String("url", redactSensitiveURL(u)))
 		}
 		if err := downloadFFmpegFile(ctx, log, u, dest); err != nil {
 			lastErr = err
 			if log != nil {
-				log.Warn("ffmpeg 下载失败", zap.String("url", u), zap.Error(err))
+				log.Warn("ffmpeg 下载失败",
+					zap.String("url", redactSensitiveURL(u)),
+					zap.Error(redactSensitiveError(err)))
 			}
 			continue
 		}
 		return nil
 	}
-	return fmt.Errorf("所有下载源均失败：%v", lastErr)
+	return redactSensitiveError(fmt.Errorf("所有下载源均失败：%v", lastErr))
 }
 
 // downloadFFmpegFile 下载单个归档文件（最多 10 分钟，限制大小上限）。
@@ -221,10 +223,12 @@ func downloadFFmpegFile(ctx context.Context, log *zap.Logger, url, dest string)
 		return err
 	}
 	if n > 500<<20 {
-		return fmt.Errorf("归档文件过大（>500MB）: %s", url)
+		return fmt.Errorf("归档文件过大（>500MB）: %s", redactSensitiveURL(url))
 	}
 	if log != nil {
-		log.Info("ffmpeg 归档下载完成", zap.String("url", url), zap.Int64("bytes", n))
+		log.Info("ffmpeg 归档下载完成",
+			zap.String("url", redactSensitiveURL(url)),
+			zap.Int64("bytes", n))
 	}
 	return nil
 }

internal/service/ffprobe.go

@@ -27,8 +27,19 @@ type FFprobeService struct {
 	log     *zap.Logger
 	mu      sync.RWMutex
 	limiter chan struct{}
+
+	// availMu guards the short-lived availability cache used by Available().
+	availMu        sync.Mutex
+	availCheckedAt time.Time
+	availValue     bool
 }
 
+// ffprobeAvailabilityTTL bounds how long an Available() result is reused.
+// Resolving a binary stats up to a couple dozen candidate paths, and the scanner
+// consults availability per root while deciding whether to queue backfill
+// probes. A short TTL keeps a freshly installed ffmpeg visible within seconds.
+const ffprobeAvailabilityTTL = 30 * time.Second
+
 // NewFFprobeService is the constructor.
 func NewFFprobeService(cfg *config.Config, log *zap.Logger) *FFprobeService {
 	maxConcurrent := normalizeFFprobeMaxConcurrent(cfg.App.FFprobeMaxConcurrent)
@@ -54,6 +65,29 @@ func (f *FFprobeService) SetMaxConcurrent(n int) {
 	f.limiter = make(chan struct{}, normalizeFFprobeMaxConcurrent(n))
 }
 
+// Available reports whether a probe can actually run right now: either an
+// ffprobe binary or the ffmpeg fallback must be resolvable. The scan path uses
+// this to decide whether re-queueing probes for media that still lack technical
+// metadata is worth doing — without a binary every probe would just fail.
+func (f *FFprobeService) Available() bool {
+	if f == nil || f.cfg == nil {
+		return false
+	}
+	f.availMu.Lock()
+	defer f.availMu.Unlock()
+	if !f.availCheckedAt.IsZero() && time.Since(f.availCheckedAt) < ffprobeAvailabilityTTL {
+		return f.availValue
+	}
+	available := true
+	if _, err := resolveLocalExecutable(f.cfg.App.FFprobePath, "ffprobe"); err != nil {
+		_, ffmpegErr := resolveLocalExecutable(f.cfg.App.FFmpegPath, "ffmpeg")
+		available = ffmpegErr == nil
+	}
+	f.availValue = available
+	f.availCheckedAt = time.Now()
+	return available
+}
+
 // ProbeResult is the subset of ffprobe output consumed by the scanner.
 type ProbeResult struct {
 	DurationSec int

internal/service/image_proxy.go

@@ -24,17 +24,19 @@ import (
 	"time"
 
 	"go.uber.org/zap"
+	"golang.org/x/sync/singleflight"
 
 	"github.com/truewhile/MeBox/internal/config"
 )
 
 // ImageProxy fetches and caches remote images on behalf of the browser.
 type ImageProxy struct {
-	cfg      *config.Config
-	log      *zap.Logger
-	client   *http.Client
-	cacheDir string
-	mu       sync.Mutex
+	cfg        *config.Config
+	log        *zap.Logger
+	client     *http.Client
+	cacheDir   string
+	mu         sync.Mutex
+	fetchGroup singleflight.Group
 
 	// resizeSem bounds concurrent decode/resize jobs. Emby TV clients request
 	// poster grids in bursts; letting every request decode a source image at

internal/service/image_proxy_remote.go

@@ -95,7 +95,7 @@ func (p *ImageProxy) serveRemoteImage(ctx context.Context, w http.ResponseWriter
 	}
 	// No negative caching: a previously failed fetch is retried on every
 	// subsequent request, so the image recovers as soon as upstream does.
-	data, ctype, contentLength, err := p.fetchAndCacheRemoteImage(ctx, raw, host, cachePath, failPath)
+	data, ctype, contentLength, err := p.fetchAndCacheRemoteImageShared(ctx, raw, host, cachePath, failPath)
 	if err != nil {
 		if forceRefresh && p.serveCachedImage(w, r, key, cachePath, opts) {
 			return nil
@@ -196,14 +196,48 @@ func (p *ImageProxy) fetchAndCacheRemoteImage(ctx context.Context, raw, host, ca
 			p.writeImageCache(cachePath, failPath, "img-*.tmp", data)
 			return data, ctype, contentLength, nil
 		}
-		p.log.Warn("imageproxy: curl fallback failed", zap.String("host", host), zap.Error(err))
+		logImageFetchError(p.log, "imageproxy: curl fallback failed", host, "curl", err)
 		lastErr = err
 	}
 	p.markImageFetchFailed(failPath)
 	if lastErr == nil {
 		lastErr = errors.New("upstream image fetch failed")
 	}
-	return nil, "", "", lastErr
+	return nil, "", "", redactSensitiveError(lastErr)
+}
+
+type sharedRemoteImageResult struct {
+	data          []byte
+	contentType   string
+	contentLength string
+}
+
+// fetchAndCacheRemoteImageShared coalesces concurrent requests for the same
+// upstream image. A poster can appear in the hero, a shelf and the detail page
+// at the same time; without this guard every resize variant may fetch the same
+// original before the first cache write finishes.
+func (p *ImageProxy) fetchAndCacheRemoteImageShared(ctx context.Context, raw, host, cachePath, failPath string) ([]byte, string, string, error) {
+	value, err, _ := p.fetchGroup.Do(cachePath, func() (any, error) {
+		loadCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 45*time.Second)
+		defer cancel()
+		data, contentType, contentLength, err := p.fetchAndCacheRemoteImage(loadCtx, raw, host, cachePath, failPath)
+		if err != nil {
+			return nil, err
+		}
+		return sharedRemoteImageResult{
+			data:          data,
+			contentType:   contentType,
+			contentLength: contentLength,
+		}, nil
+	})
+	if err != nil {
+		return nil, "", "", err
+	}
+	result, ok := value.(sharedRemoteImageResult)
+	if !ok {
+		return nil, "", "", errors.New("upstream image fetch failed")
+	}
+	return result.data, result.contentType, result.contentLength, nil
 }
 
 // Fetch pulls a remote image and returns bytes plus Content-Type using cache.

internal/service/image_proxy_remote_fetch.go

@@ -48,14 +48,14 @@ func (p *ImageProxy) canUseExternalImageFallback() bool {
 func (p *ImageProxy) fetchRemoteImageOnce(ctx context.Context, raw, host string, candidate remoteImageFetchClient) ([]byte, string, string, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, raw, nil)
 	if err != nil {
-		p.log.Warn("imageproxy: build request failed", zap.String("url", raw), zap.Error(err))
+		p.log.Warn("imageproxy: build request failed", zap.String("url", redactSensitiveURL(raw)), zap.Error(redactSensitiveError(err)))
 		return nil, "", "", errImageProxyRequestSetup
 	}
 	applyRemoteImageHeaders(req, host, raw)
 
 	resp, err := candidate.client.Do(req)
 	if err != nil {
-		p.log.Warn("imageproxy: upstream fetch failed", zap.String("host", host), zap.String("client", candidate.name), zap.Error(err))
+		logImageFetchError(p.log, "imageproxy: upstream fetch failed", host, candidate.name, err)
 		return nil, "", "", err
 	}
 	defer resp.Body.Close()
@@ -65,7 +65,7 @@ func (p *ImageProxy) fetchRemoteImageOnce(ctx context.Context, raw, host string,
 	}
 	data, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
 	if err != nil || len(data) == 0 {
-		p.log.Warn("imageproxy: read upstream body failed", zap.String("host", host), zap.String("client", candidate.name), zap.Error(err))
+		p.log.Warn("imageproxy: read upstream body failed", zap.String("host", host), zap.String("client", candidate.name), zap.Error(redactSensitiveError(err)))
 		if err == nil {
 			err = errors.New("upstream image body is empty")
 		}
@@ -79,6 +79,22 @@ func (p *ImageProxy) fetchRemoteImageOnce(ctx context.Context, raw, host string,
 	return data, ctype, resp.Header.Get("Content-Length"), nil
 }
 
+func logImageFetchError(log *zap.Logger, message, host, client string, err error) {
+	if log == nil || err == nil {
+		return
+	}
+	fields := []zap.Field{
+		zap.String("host", host),
+		zap.String("client", client),
+		zap.Error(redactSensitiveError(err)),
+	}
+	if errors.Is(err, context.Canceled) {
+		log.Debug(message, fields...)
+		return
+	}
+	log.Warn(message, fields...)
+}
+
 func applyRemoteImageHeaders(req *http.Request, host, raw string) {
 	req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36")
 	req.Header.Set("Accept", "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8")
@@ -162,9 +178,9 @@ func fetchRemoteImageWithCurl(ctx context.Context, raw, host string) ([]byte, st
 		"--header", "Cache-Control: no-cache",
 		"--header", "Pragma: no-cache",
 	}
-		if referer := remoteImageReferer(host, raw); referer != "" {
-			args = append(args, "--referer", referer)
-		}
+	if referer := remoteImageReferer(host, raw); referer != "" {
+		args = append(args, "--referer", referer)
+	}
 	if cookie := remoteImageCookie(host); cookie != "" {
 		args = append(args, "--cookie", cookie)
 	}
@@ -188,9 +204,9 @@ func fetchRemoteImageWithCurl(ctx context.Context, raw, host string) ([]byte, st
 	if waitErr != nil {
 		message := strings.TrimSpace(stderr.String())
 		if message != "" {
-			return nil, "", "", errors.New(message)
+			return nil, "", "", redactSensitiveError(errors.New(message))
 		}
-		return nil, "", "", waitErr
+		return nil, "", "", redactSensitiveError(waitErr)
 	}
 	if len(data) == 0 {
 		return nil, "", "", errors.New("curl image body is empty")

internal/service/image_resize.go

@@ -226,6 +226,34 @@ func (p *ImageProxy) acquireResizeSlot(ctx context.Context) (func(), bool) {
 	}
 }
 
+// tryAcquireResizeSlot 不等待。槽位忙时返回 false，调用方应改出原图。
+func (p *ImageProxy) tryAcquireResizeSlot() (func(), bool) {
+	if p == nil {
+		return func() {}, true
+	}
+	p.resizeSemMu.Lock()
+	if p.resizeSem == nil {
+		p.resizeSem = make(chan struct{}, imageResizeConcurrency())
+	}
+	sem := p.resizeSem
+	p.resizeSemMu.Unlock()
+	select {
+	case sem <- struct{}{}:
+		return func() { <-sem }, true
+	default:
+		return nil, false
+	}
+}
+
+// acquireResizeSlotFor 对中等体积的图只尝试一次槽位。忙则放弃缩放，
+// 避免背景图墙在 2 核机器上排成数秒。超大原图仍等待，以免直出多兆字节。
+func (p *ImageProxy) acquireResizeSlotFor(ctx context.Context, size int64) (func(), bool) {
+	if size > 0 && size <= resizeQueueBypassBytes {
+		return p.tryAcquireResizeSlot()
+	}
+	return p.acquireResizeSlot(ctx)
+}
+
 // serveResizedFromFile 从 srcPath 读取图片，按选项缩放后写出，并把结果缓存
 // 到磁盘以免每次请求都重新解码。原图已满足目标尺寸时直接输出原文件。
 // 返回 false 表示缩放不可用，调用方应回退到原图直出。
@@ -241,8 +269,13 @@ func (p *ImageProxy) serveResizedFromFile(w http.ResponseWriter, r *http.Request
 	if serveCachedImageFile(w, r, key, cachePath) {
 		return true
 	}
+	// 本地海报大多已经是一百多 KB 的 JPEG。先解码再缩放会把 2 核机器的
+	// 并发槽（2）堵成数秒队列。体积已经适合直接下发时，不要排队。
+	if serveCompactOriginal(w, r, srcPath, stat) {
+		return true
+	}
 
-	release, ok := p.acquireResizeSlot(r.Context())
+	release, ok := p.acquireResizeSlotFor(r.Context(), stat.Size())
 	if !ok {
 		return false
 	}
@@ -273,6 +306,43 @@ func (p *ImageProxy) serveResizedFromFile(w http.ResponseWriter, r *http.Request
 	return true
 }
 
+// compactImageSkipBytes 是“直接出原图”的体积上限。超过它的原图（多兆字节
+// 的剧照、未压缩 sidecar）仍然走缩放，避免把大文件直接塞给电视端。
+// ponytail: 200KB 覆盖这台机器上的典型海报（平均约 100KB）；更大的图仍尝试缩放。
+const compactImageSkipBytes = 200 * 1024
+
+// resizeQueueBypassBytes 是“槽位忙就放弃缩放”的上限。超过它的原图继续排队，
+// 以免把未压缩的剧照直接发给客户端。
+const resizeQueueBypassBytes = 1536 * 1024
+
+// serveCompactOriginal 在源文件已经很小且是浏览器可直接显示的 JPEG/WebP 时
+// 跳过解码。返回 false 表示仍应走缩放路径。
+func serveCompactOriginal(w http.ResponseWriter, r *http.Request, srcPath string, stat os.FileInfo) bool {
+	if stat == nil || stat.Size() <= 0 || stat.Size() > compactImageSkipBytes {
+		return false
+	}
+	file, err := os.Open(srcPath) // #nosec G304 -- srcPath is an allowed local path or a SHA-derived cache path.
+	if err != nil {
+		return false
+	}
+	var header [12]byte
+	n, _ := file.Read(header[:])
+	_ = file.Close()
+	if !isCompactWebImage(header[:n]) {
+		return false
+	}
+	return serveImageFile(w, r, filepath.Base(srcPath), srcPath, imageBrowserCacheControl)
+}
+
+func isCompactWebImage(header []byte) bool {
+	if len(header) >= 3 && header[0] == 0xff && header[1] == 0xd8 && header[2] == 0xff {
+		return true
+	}
+	return len(header) >= 12 &&
+		string(header[0:4]) == "RIFF" &&
+		string(header[8:12]) == "WEBP"
+}
+
 // writeResizeCache 原子写入缩放结果；失败只记日志，不影响本次响应。
 func (p *ImageProxy) writeResizeCache(cachePath string, data []byte) {
 	dir := filepath.Dir(cachePath)

internal/service/image_resize_test.go

@@ -2,12 +2,15 @@ package service
 
 import (
 	"bytes"
+	"context"
 	"image"
 	"image/color"
+	"image/jpeg"
 	"image/png"
 	"net/http/httptest"
 	"os"
 	"testing"
+	"time"
 )
 
 // encodeTestPNG 生成一张结构规则、易于压缩的测试用 PNG。
@@ -274,3 +277,60 @@ func TestServeResizedFromFileUsesCacheBeforeDecodingSource(t *testing.T) {
 		t.Fatal("expected cached thumbnail to be reused without decoding the source")
 	}
 }
+
+func TestServeResizedFromFileSkipsDecodeForCompactJPEG(t *testing.T) {
+	dir := t.TempDir()
+	src := dir + string(os.PathSeparator) + "poster.jpg"
+	var buf bytes.Buffer
+	if err := jpeg.Encode(&buf, image.NewRGBA(image.Rect(0, 0, 800, 1200)), &jpeg.Options{Quality: 40}); err != nil {
+		t.Fatalf("encode jpeg: %v", err)
+	}
+	if buf.Len() == 0 || buf.Len() > compactImageSkipBytes {
+		t.Fatalf("test jpeg is %d bytes, want a compact poster", buf.Len())
+	}
+	if err := os.WriteFile(src, buf.Bytes(), 0o644); err != nil {
+		t.Fatalf("write source: %v", err)
+	}
+
+	proxy := &ImageProxy{cacheDir: dir + string(os.PathSeparator) + "cache"}
+	rec := httptest.NewRecorder()
+	if !proxy.serveResizedFromFile(rec, httptest.NewRequest("GET", "/x?maxWidth=120", nil), src, imageResizeOptions{MaxWidth: 120}) {
+		t.Fatal("expected compact jpeg to be served")
+	}
+	if !bytes.Equal(rec.Body.Bytes(), buf.Bytes()) {
+		t.Fatal("expected the original jpeg, not a decoded thumbnail")
+	}
+}
+
+func TestServeResizedFromFileDoesNotQueueWhenResizeBusy(t *testing.T) {
+	dir := t.TempDir()
+	src := dir + string(os.PathSeparator) + "backdrop.jpg"
+	data := make([]byte, compactImageSkipBytes+1024)
+	data[0], data[1], data[2] = 0xff, 0xd8, 0xff
+	if err := os.WriteFile(src, data, 0o644); err != nil {
+		t.Fatalf("write source: %v", err)
+	}
+	proxy := &ImageProxy{cacheDir: dir + string(os.PathSeparator) + "cache"}
+	var releases []func()
+	for i := 0; i < imageResizeConcurrency(); i++ {
+		release, ok := proxy.acquireResizeSlot(context.Background())
+		if !ok {
+			t.Fatal("expected a resize slot")
+		}
+		releases = append(releases, release)
+	}
+	defer func() {
+		for _, release := range releases {
+			release()
+		}
+	}()
+
+	start := time.Now()
+	handled := proxy.serveResizedFromFile(httptest.NewRecorder(), httptest.NewRequest("GET", "/x?maxWidth=480", nil), src, imageResizeOptions{MaxWidth: 480})
+	if time.Since(start) > 200*time.Millisecond {
+		t.Fatal("resize slot was busy but the request still waited in the queue")
+	}
+	if handled {
+		t.Fatal("expected a busy resize slot to fall back so the caller can serve the original")
+	}
+}

internal/service/local_metadata_artwork.go

@@ -101,7 +101,21 @@ func localBackdropCandidates(mediaPath string) []string {
 		seen[key] = struct{}{}
 		names = append(names, name)
 	}
+	_, episode := ParseEpisode(mediaPath)
 	for _, base := range mediaSidecarBaseVariants(mediaPath) {
+		// Jellyfin/Emby commonly stores an episode still beside the video as
+		// "<episode>-thumb.jpg" or "<episode>.jpg". Episode-specific artwork
+		// must win over a series-level fanart.jpg in the parent folder,
+		// otherwise a rescan flattens every episode to the same backdrop.
+		add(base + "-thumb")
+		add(base + ".thumb")
+		if episode > 0 {
+			add(base + "-still")
+			add(base + ".still")
+			add(base + "-scene")
+			add(base + ".scene")
+			add(base)
+		}
 		add(base + "-fanart")
 		add(base + ".fanart")
 		add(base + "-backdrop")

internal/service/local_metadata_test.go

@@ -236,8 +236,8 @@ func TestReadLocalVarietyMetadataUsesLocalArtwork(t *testing.T) {
 	if got.PosterURL != showPoster {
 		t.Fatalf("PosterURL = %q, want show poster %q, not episode thumb %q", got.PosterURL, showPoster, episodeThumb)
 	}
-	if got.BackdropURL != backdrop {
-		t.Fatalf("BackdropURL = %q, want %q", got.BackdropURL, backdrop)
+	if got.BackdropURL != episodeThumb {
+		t.Fatalf("BackdropURL = %q, want episode thumb %q, not series backdrop %q", got.BackdropURL, episodeThumb, backdrop)
 	}
 }
 

internal/service/log_redact.go

@@ -0,0 +1,89 @@
+package service
+
+import (
+	"errors"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+const sensitiveLogKeyPattern = `api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|token|password|passwd|pwd|authorization|client[_-]?secret|secret|signature|sig|x[_-]?emby[_-]?token|x[_-]?api[_-]?key|x[_-]?amz[_-]?signature|x[_-]?amz[_-]?credential|x[_-]?amz[_-]?security[_-]?token|awsaccesskeyid|session[_-]?id`
+
+var (
+	sensitiveLogQueryRE      = regexp.MustCompile(`(?i)([?&;])(` + sensitiveLogKeyPattern + `)=([^&#\s"']+)`)
+	sensitiveLogJSONRE       = regexp.MustCompile(`(?i)("(?:` + sensitiveLogKeyPattern + `)"\s*:\s*")((?:[^"\\]|\\.)*)(")`)
+	sensitiveLogAssignmentRE = regexp.MustCompile(`(?im)((?:^|[\s,{])(?:` + sensitiveLogKeyPattern + `)\s*[:=]\s*(?:(?:bearer|basic)\s+)?)([^\s,;"'}\]]+)`)
+)
+
+// redactSensitiveURL removes credentials from URLs before they reach logs or
+// error messages. Query values are replaced with REDACTED and URL userinfo
+// passwords are removed.
+func redactSensitiveURL(raw string) string {
+	trimmed := strings.TrimSpace(raw)
+	u, err := url.Parse(trimmed)
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		return redactSensitiveText(raw)
+	}
+	if u.User != nil {
+		if _, hasPassword := u.User.Password(); hasPassword {
+			u.User = url.UserPassword(u.User.Username(), "REDACTED")
+		}
+	}
+	query := u.Query()
+	changed := false
+	for key := range query {
+		if isSensitiveLogKey(key) {
+			query.Set(key, "REDACTED")
+			changed = true
+		}
+	}
+	if changed {
+		u.RawQuery = query.Encode()
+	}
+	return u.String()
+}
+
+func redactSensitiveText(value string) string {
+	value = sensitiveLogQueryRE.ReplaceAllString(value, `${1}${2}=REDACTED`)
+	value = sensitiveLogJSONRE.ReplaceAllString(value, `${1}REDACTED${3}`)
+	return sensitiveLogAssignmentRE.ReplaceAllString(value, `${1}REDACTED`)
+}
+
+type logRedactedError struct {
+	err error
+}
+
+func (e logRedactedError) Error() string {
+	return redactSensitiveText(e.err.Error())
+}
+
+func (e logRedactedError) Unwrap() error {
+	return e.err
+}
+
+// redactSensitiveError wraps an error with a redacted Error string while
+// preserving errors.Is and errors.As behavior.
+func redactSensitiveError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var alreadyRedacted logRedactedError
+	if errors.As(err, &alreadyRedacted) {
+		return err
+	}
+	return logRedactedError{err: err}
+}
+
+func isSensitiveLogKey(key string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(key))
+	normalized = strings.ReplaceAll(normalized, "-", "_")
+	switch normalized {
+	case "api_key", "apikey", "access_token", "refresh_token", "id_token", "token",
+		"password", "passwd", "pwd", "authorization", "client_secret", "secret",
+		"signature", "sig", "x_emby_token", "x_api_key", "x_amz_signature",
+		"x_amz_credential", "x_amz_security_token", "awsaccesskeyid", "session_id":
+		return true
+	default:
+		return false
+	}
+}

internal/service/log_redact_test.go

@@ -0,0 +1,52 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestRedactSensitiveURL(t *testing.T) {
+	raw := "https://user:secret@media.example/emby/Items/1/Images/primary?api_key=abc123&X-Emby-Token=xyz&X-Amz-Signature=sig123&quality=90"
+	got := redactSensitiveURL(raw)
+	for _, secret := range []string{"secret", "abc123", "xyz", "sig123"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("redacted URL still contains %q: %s", secret, got)
+		}
+	}
+	if !strings.Contains(got, "quality=90") {
+		t.Fatalf("non-sensitive query value was removed: %s", got)
+	}
+}
+
+func TestRedactSensitiveTextCoversJSONAndHeaders(t *testing.T) {
+	raw := `{"AccessToken":"json-token","quality":"90"} Authorization: Bearer bearer-token; X-Emby-Token=header-token`
+	got := redactSensitiveText(raw)
+	for _, secret := range []string{"json-token", "bearer-token", "header-token"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("redacted text still contains %q: %s", secret, got)
+		}
+	}
+	if !strings.Contains(got, `"quality":"90"`) {
+		t.Fatalf("non-sensitive JSON value was removed: %s", got)
+	}
+}
+
+func TestRedactSensitiveErrorPreservesWrapping(t *testing.T) {
+	base := errors.New(`Get "https://media.example/item?token=secret&quality=90": context canceled`)
+	err := redactSensitiveError(context.Canceled)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatal("redacted error lost context.Canceled")
+	}
+	if strings.Contains(err.Error(), "secret") {
+		t.Fatalf("redacted error leaked token: %s", err.Error())
+	}
+	redactedBase := redactSensitiveError(base)
+	if strings.Contains(redactedBase.Error(), "secret") {
+		t.Fatalf("redacted base error leaked token: %s", redactedBase.Error())
+	}
+	if !errors.Is(redactedBase, base) {
+		t.Fatal("redacted error lost original error identity")
+	}
+}

internal/service/manual_scrape_test.go

@@ -199,7 +199,7 @@ func TestManualSearchFallsBackToMovieFolderForGenericQuery(t *testing.T) {
 			http.NotFound(w, r)
 			return
 		}
-		if r.URL.Query().Get("query") != "inception" {
+		if !strings.EqualFold(r.URL.Query().Get("query"), "inception") {
 			_ = json.NewEncoder(w).Encode(map[string]any{"results": []any{}})
 			return
 		}
@@ -248,7 +248,7 @@ func TestManualSearchFallsBackToMovieFolderForGenericQuery(t *testing.T) {
 	if len(results) != 1 || results[0].TMDbID != 27205 {
 		t.Fatalf("manual search results=%#v, want folder fallback candidate; queries=%v", results, queries)
 	}
-	if len(queries) < 2 || queries[0] != "00000" || queries[len(queries)-1] != "inception" {
+	if len(queries) < 2 || queries[0] != "00000" || !strings.EqualFold(queries[len(queries)-1], "inception") {
 		t.Fatalf("manual search queries=%v, want explicit query then folder fallback", queries)
 	}
 }

internal/service/media.go

@@ -3,6 +3,7 @@ package service
 
 import (
 	"go.uber.org/zap"
+	"golang.org/x/sync/singleflight"
 
 	"github.com/truewhile/MeBox/internal/config"
 	"github.com/truewhile/MeBox/internal/model"
@@ -11,10 +12,12 @@ import (
 
 // MediaService offers high-level CRUD over libraries and media items.
 type MediaService struct {
-	cfg   *config.Config
-	log   *zap.Logger
-	repo  *repository.Container
-	cache *RuntimeCacheService
+	cfg                *config.Config
+	log                *zap.Logger
+	repo               *repository.Container
+	cache              *RuntimeCacheService
+	groupedMediaFlight singleflight.Group
+	libraryRowsFlight  singleflight.Group
 }
 
 type MediaVisibility struct {

internal/service/media_cache.go

@@ -31,11 +31,12 @@ func (s *MediaService) mediaListCacheKey(libraryID string, libraryIDs []string,
 		fmt.Sprintf("%d:%d:%t", page, pageSize, filter.IncludeNSFW),
 		strings.Join(allowed, ","),
 		strings.Join(hidden, ","),
+		filter.SeriesID,
 	}, "|")))
 	return "media:list:" + hex.EncodeToString(sum[:])
 }
 
-func (s *MediaService) libraryPreviewCacheKey(libraries []model.Library, cardLimit int, filter repository.MediaQueryFilter) string {
+func (s *MediaService) libraryPreviewCacheKey(libraries []model.Library, cardLimit int, filter repository.MediaQueryFilter, includeCounts bool) string {
 	libIDs := make([]string, len(libraries))
 	for i, lib := range libraries {
 		libIDs[i] = lib.ID
@@ -48,9 +49,10 @@ func (s *MediaService) libraryPreviewCacheKey(libraries []model.Library, cardLim
 	sum := sha1.Sum([]byte(strings.Join([]string{
 		"preview",
 		strings.Join(libIDs, ","),
-		fmt.Sprintf("%d:%t", cardLimit, filter.IncludeNSFW),
+		fmt.Sprintf("%d:%t:%t", cardLimit, filter.IncludeNSFW, includeCounts),
 		strings.Join(allowed, ","),
 		strings.Join(hidden, ","),
+		filter.SeriesID,
 	}, "|")))
 	return "media:preview:" + hex.EncodeToString(sum[:])
 }
@@ -69,6 +71,24 @@ func (s *MediaService) seriesCardsCacheKey(libraryID string, visibility MediaVis
 	return "media:series-cards:" + hex.EncodeToString(sum[:])
 }
 
+func (s *MediaService) libraryCountCacheKey(libraryIDs []string, filter repository.MediaQueryFilter) string {
+	ids := append([]string(nil), libraryIDs...)
+	allowed := append([]string(nil), filter.AllowedLibraryIDs...)
+	hidden := append([]string(nil), filter.HiddenLibraryIDs...)
+	sort.Strings(ids)
+	sort.Strings(allowed)
+	sort.Strings(hidden)
+	sum := sha1.Sum([]byte(strings.Join([]string{
+		"counts",
+		strings.Join(ids, ","),
+		fmt.Sprintf("%t", filter.IncludeNSFW),
+		strings.Join(allowed, ","),
+		strings.Join(hidden, ","),
+		filter.SeriesID,
+	}, "|")))
+	return "media:lib-counts:" + hex.EncodeToString(sum[:])
+}
+
 func (s *MediaService) mediaCacheTTLSeconds() int {
 	if s == nil || s.cfg == nil || s.cfg.Cache.MediaTTLSeconds < 1 {
 		return 90
@@ -82,25 +102,42 @@ func (s *MediaService) mediaObjectTTL() time.Duration {
 	return time.Duration(s.mediaCacheTTLSeconds()) * time.Second
 }
 
+// derivedReadCacheTTL 给首页预览、剧集分组、库计数这类派生读缓存一个更长的
+// 下限。扫描/刮削/删改都会走 invalidateMediaCache 清掉 media: 前缀，所以
+// 拉长 TTL 不会在写入后继续吐旧卡片。配置里的 TTL 更长时仍以配置为准。
+func (s *MediaService) derivedReadCacheTTL() time.Duration {
+	ttl := s.mediaObjectTTL()
+	const floor = 10 * time.Minute
+	if ttl < floor {
+		return floor
+	}
+	return ttl
+}
+
 func hashObjectCacheKey(parts []string) string {
 	sum := sha1.Sum([]byte(strings.Join(parts, "|")))
 	return hex.EncodeToString(sum[:])
 }
 
-// mediaGroupedRowsCacheKey 版本分组源行（已挂库元数据）的对象缓存。
-func (s *MediaService) mediaGroupedRowsCacheKey(libraryID string, libraryIDs []string, filter repository.MediaQueryFilter) string {
+// groupedItemsCacheKey caches the fully grouped version list. Version grouping
+// requires scanning every row in the library, so recomputing it for each page
+// request makes pagination O(pages × library size) instead of O(library size).
+// Only the grouped result is cached; caching the ungrouped rows as well would
+// duplicate large libraries in the process memory for no additional hit path.
+func (s *MediaService) groupedItemsCacheKey(libraryID string, libraryIDs []string, filter repository.MediaQueryFilter) string {
 	libs := append([]string(nil), libraryIDs...)
 	sort.Strings(libs)
 	allowed := append([]string(nil), filter.AllowedLibraryIDs...)
 	hidden := append([]string(nil), filter.HiddenLibraryIDs...)
 	sort.Strings(allowed)
 	sort.Strings(hidden)
-	return "media:obj:grouped-rows:" + hashObjectCacheKey([]string{
+	return "media:obj:grouped-items:" + hashObjectCacheKey([]string{
 		libraryID,
 		strings.Join(libs, ","),
 		fmt.Sprintf("%t", filter.IncludeNSFW),
 		strings.Join(allowed, ","),
 		strings.Join(hidden, ","),
+		filter.SeriesID,
 	})
 }
 

internal/service/media_display_library.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"sort"
 	"strings"
 
 	"github.com/truewhile/MeBox/internal/model"
@@ -12,14 +13,12 @@ func (s *MediaService) attachLibraryMetadata(ctx context.Context, items []model.
 	if s == nil || s.repo == nil || s.repo.Library == nil || len(items) == 0 {
 		return
 	}
-	libs, err := s.repo.Library.List(ctx)
+	libs, err := s.displayLibraries(ctx)
 	if err != nil {
 		return
 	}
 	byID := make(map[string]model.Library, len(libs))
-	for i := range libs {
-		libs[i] = normalizeLocalLibraryPathForDisplay(libs[i])
-		lib := libs[i]
+	for _, lib := range libs {
 		byID[lib.ID] = lib
 	}
 	resolver := newMediaDisplayLibraryResolver(ctx, s.repo, libs)
@@ -44,11 +43,39 @@ func (s *MediaService) attachLibraryMetadata(ctx context.Context, items []model.
 	}
 }
 
+func (s *MediaService) displayLibraries(ctx context.Context) ([]model.Library, error) {
+	const cacheKey = "media:obj:library-metadata"
+	if s.cache != nil {
+		if cachedObj, ok := s.cache.GetObject(cacheKey); ok {
+			if cached, ok := cachedObj.([]model.Library); ok {
+				return cached, nil
+			}
+		}
+	}
+	libs, err := s.repo.Library.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for i := range libs {
+		libs[i] = normalizeLocalLibraryPathForDisplay(libs[i])
+	}
+	if s.cache != nil {
+		s.cache.SetObject(cacheKey, libs, s.mediaObjectTTL())
+	}
+	return libs, nil
+}
+
 type mediaDisplayLibraryResolver struct {
 	byID              map[string]model.Library
 	displayByID       map[string]model.Library
 	displayByMergeKey map[string]model.Library
 	displayLibraries  []model.Library
+	localDisplays     []mediaLocalDisplayLibrary
+}
+
+type mediaLocalDisplayLibrary struct {
+	library model.Library
+	path    string
 }
 
 func newMediaDisplayLibraryResolver(ctx context.Context, repo *repository.Container, libs []model.Library) mediaDisplayLibraryResolver {
@@ -58,6 +85,7 @@ func newMediaDisplayLibraryResolver(ctx context.Context, repo *repository.Contai
 		displayByID:       make(map[string]model.Library, len(displayLibraries)),
 		displayByMergeKey: make(map[string]model.Library, len(displayLibraries)),
 		displayLibraries:  displayLibraries,
+		localDisplays:     make([]mediaLocalDisplayLibrary, 0, len(displayLibraries)),
 	}
 	for _, lib := range libs {
 		normalized := normalizeLocalLibraryPathForDisplay(lib)
@@ -70,7 +98,23 @@ func newMediaDisplayLibraryResolver(ctx context.Context, repo *repository.Contai
 				resolver.displayByMergeKey[key] = lib
 			}
 		}
+		if _, ok := ParseCloudLibraryMount(lib.Path); ok || !lib.Enabled {
+			continue
+		}
+		displayPath := cleanPathForVolumeMapping(resolveMappedDestinationPath(lib.Path))
+		if displayPath == "" || displayPath == "." {
+			continue
+		}
+		resolver.localDisplays = append(resolver.localDisplays, mediaLocalDisplayLibrary{
+			library: lib,
+			path:    displayPath,
+		})
 	}
+	// 最长路径优先：一次命中就是原逻辑中最具体的媒体库，避免每条媒体都
+	// 重新规范化全部库路径并扫描整个库列表。
+	sort.SliceStable(resolver.localDisplays, func(i, j int) bool {
+		return len(resolver.localDisplays[i].path) > len(resolver.localDisplays[j].path)
+	})
 	return resolver
 }
 
@@ -172,26 +216,10 @@ func (r mediaDisplayLibraryResolver) bestPathDisplayLibrary(media model.Media) (
 	if isRelativeVolumeMarkerPath(media.Path) {
 		mediaPath = cleanPathForVolumeMapping(resolveMappedDestinationPath(media.Path))
 	}
-	var best model.Library
-	bestLen := 0
-	for _, lib := range r.displayLibraries {
-		if _, ok := ParseCloudLibraryMount(lib.Path); ok || !lib.Enabled {
-			continue
+	for _, display := range r.localDisplays {
+		if mediaPath == display.path || strings.HasPrefix(mediaPath, strings.TrimRight(display.path, "/")+"/") {
+			return display.library, true
 		}
-		libPath := cleanPathForVolumeMapping(resolveMappedDestinationPath(lib.Path))
-		if libPath == "" || libPath == "." {
-			continue
-		}
-		if mediaPath != libPath && !strings.HasPrefix(mediaPath, strings.TrimRight(libPath, "/")+"/") {
-			continue
-		}
-		if len(libPath) > bestLen {
-			best = lib
-			bestLen = len(libPath)
-		}
-	}
-	if bestLen > 0 {
-		return best, true
 	}
 	return model.Library{}, false
 }

internal/service/media_display_library_test.go

@@ -0,0 +1,43 @@
+package service
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/truewhile/MeBox/internal/model"
+)
+
+func TestMediaDisplayLibraryResolverUsesMostSpecificPath(t *testing.T) {
+	root := t.TempDir()
+	parentPath := filepath.Join(root, "media")
+	nestedPath := filepath.Join(parentPath, "anime")
+	parent := model.Library{
+		Base:    model.Base{ID: "parent"},
+		Name:    "媒体",
+		Path:    parentPath,
+		Enabled: true,
+	}
+	nested := model.Library{
+		Base:    model.Base{ID: "nested"},
+		Name:    "动漫",
+		Path:    nestedPath,
+		Enabled: true,
+	}
+
+	resolver := newMediaDisplayLibraryResolver(t.Context(), nil, []model.Library{parent, nested})
+	got, ok := resolver.DisplayLibraryForMedia(model.Media{
+		LibraryID: parent.ID,
+		Path:      filepath.Join(nestedPath, "Show", "S01E01.mkv"),
+	})
+	if !ok || got.ID != nested.ID {
+		t.Fatalf("display library = %q, %t; want nested library", got.ID, ok)
+	}
+
+	got, ok = resolver.DisplayLibraryForMedia(model.Media{
+		LibraryID: parent.ID,
+		Path:      filepath.Join(parentPath, "Movie", "Movie.mkv"),
+	})
+	if !ok || got.ID != parent.ID {
+		t.Fatalf("display library = %q, %t; want parent library", got.ID, ok)
+	}
+}

internal/service/media_library.go

@@ -2,7 +2,6 @@ package service
 
 import (
 	"context"
-	"time"
 
 	"github.com/truewhile/MeBox/internal/model"
 	"github.com/truewhile/MeBox/internal/repository"
@@ -15,17 +14,49 @@ type LibraryPreviewItem struct {
 	Cards []SeriesCard `json:"cards"`
 }
 
-type libraryPreviewCacheValue struct {
-	Items []LibraryPreviewItem `json:"items"`
-}
-
 // ListLibraries returns every library configured on the server.
 func (s *MediaService) ListLibraries(ctx context.Context) ([]model.Library, error) {
 	return s.repo.Library.List(ctx)
 }
 
+// CountLibrariesCached returns per-library media totals. The homepage metadata
+// request asks for every library, and the underlying COUNT is repeated on each
+// refresh. Writes already drop the media: prefix, so a longer TTL is safe.
+func (s *MediaService) CountLibrariesCached(ctx context.Context, libraryIDs []string, filter repository.MediaQueryFilter) (map[string]int64, error) {
+	if len(libraryIDs) == 0 {
+		return map[string]int64{}, nil
+	}
+	cacheKey := s.libraryCountCacheKey(libraryIDs, filter)
+	var cached map[string]int64
+	if s.cache != nil && s.cache.GetJSON(ctx, cacheKey, &cached) && cached != nil {
+		return cached, nil
+	}
+	counts, err := s.repo.Media.CountByLibraries(ctx, libraryIDs, filter)
+	if err != nil {
+		return nil, err
+	}
+	if counts == nil {
+		counts = map[string]int64{}
+	}
+	if s.cache != nil {
+		s.cache.SetJSON(ctx, cacheKey, counts, s.derivedReadCacheTTL())
+	}
+	return counts, nil
+}
+
 // ListLibrariesWithPreview returns libraries populated with item counts and latest preview cards.
 func (s *MediaService) ListLibrariesWithPreview(ctx context.Context, libraries []model.Library, visibility MediaVisibility, cardLimit int) ([]LibraryPreviewItem, error) {
+	return s.listLibrariesWithPreview(ctx, libraries, visibility, cardLimit, true)
+}
+
+// ListLibraryPreviews returns only the latest preview cards. The metadata
+// endpoint already returns totals, so preview batches used by the home and
+// library pages can skip an otherwise repeated COUNT(*) over every library.
+func (s *MediaService) ListLibraryPreviews(ctx context.Context, libraries []model.Library, visibility MediaVisibility, cardLimit int) ([]LibraryPreviewItem, error) {
+	return s.listLibrariesWithPreview(ctx, libraries, visibility, cardLimit, false)
+}
+
+func (s *MediaService) listLibrariesWithPreview(ctx context.Context, libraries []model.Library, visibility MediaVisibility, cardLimit int, includeCounts bool) ([]LibraryPreviewItem, error) {
 	if cardLimit <= 0 {
 		cardLimit = 10
 	}
@@ -33,45 +64,65 @@ func (s *MediaService) ListLibrariesWithPreview(ctx context.Context, libraries [
 	if len(libraries) == 0 {
 		return out, nil
 	}
-
 	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
 	filter := repository.MediaQueryFilter{
 		IncludeNSFW:       visibility.IncludeNSFW,
 		AllowedLibraryIDs: visibility.AllowedLibraryIDs,
 		HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
 	}
-	cacheKey := s.libraryPreviewCacheKey(libraries, cardLimit, filter)
-	var cached libraryPreviewCacheValue
-	if s.cache != nil && s.cache.GetJSON(ctx, cacheKey, &cached) {
-		return cached.Items, nil
-	}
-
-	libIDs := make([]string, 0, len(libraries))
+	pending := make([]model.Library, 0, len(libraries))
+	pendingSet := make(map[string]struct{}, len(libraries))
 	for i, lib := range libraries {
 		out[i] = LibraryPreviewItem{
 			Library: lib,
 			Total:   0,
 			Cards:   []SeriesCard{},
 		}
-		libIDs = append(libIDs, lib.ID)
+		itemKey := s.libraryPreviewCacheKey([]model.Library{lib}, cardLimit, filter, includeCounts)
+		if s.cache != nil && s.cache.GetJSON(ctx, itemKey, &out[i]) {
+			continue
+		}
+		pending = append(pending, lib)
+		pendingSet[lib.ID] = struct{}{}
+	}
+	if len(pending) == 0 {
+		return out, nil
 	}
 
-	counts, err := s.repo.Media.CountByLibraries(ctx, libIDs, filter)
-	if err != nil {
-		return nil, err
+	libIDs := make([]string, len(pending))
+	for i := range pending {
+		libIDs[i] = pending[i].ID
 	}
 
-	for i := range out {
-		if total, ok := counts[out[i].ID]; ok {
-			out[i].Total = total
+	if includeCounts {
+		counts, err := s.repo.Media.CountByLibraries(ctx, libIDs, filter)
+		if err != nil {
+			return nil, err
+		}
+		for i := range out {
+			if _, pendingItem := pendingSet[out[i].ID]; !pendingItem {
+				continue
+			}
+			out[i].Total = counts[out[i].ID]
 		}
 	}
 
-	fetchCount := cardLimit * 4
-	if fetchCount < 60 {
-		fetchCount = 60
-	} else if fetchCount > 200 {
-		fetchCount = 200
+	// Preview rows are only an internal candidate window. Keep it bounded so a
+	// library with a very long series cannot turn a homepage request into a full
+	// 50k-row scan merely to find another distinct card.
+	fetchCount := cardLimit * 12
+	minFetchCount := 120
+	if cardLimit <= 2 {
+		minFetchCount = 24
+	} else if cardLimit <= 4 {
+		// 首页/媒体库入口的马赛克只需要少量代表图，没必要为暂时不会
+		// 展示的横向货架扫描一整批 120 行候选。
+		minFetchCount = 48
+	}
+	if fetchCount < minFetchCount {
+		fetchCount = minFetchCount
+	} else if fetchCount > 400 {
+		fetchCount = 400
 	}
 
 	recentByLibrary, err := s.repo.Media.ListRecentByLibraries(ctx, libIDs, fetchCount, filter)
@@ -81,7 +132,7 @@ func (s *MediaService) ListLibrariesWithPreview(ctx context.Context, libraries [
 
 	allPreviewItems := make([]model.Media, 0, len(libIDs)*fetchCount)
 	for i := range out {
-		if out[i].Total == 0 {
+		if _, pendingItem := pendingSet[out[i].ID]; !pendingItem {
 			continue
 		}
 		items := recentByLibrary[out[i].ID]
@@ -93,32 +144,29 @@ func (s *MediaService) ListLibrariesWithPreview(ctx context.Context, libraries [
 	s.attachLibraryMetadata(ctx, allPreviewItems)
 
 	for i := range out {
-		if out[i].Total == 0 {
+		if _, pendingItem := pendingSet[out[i].ID]; !pendingItem {
 			continue
 		}
 		items := recentByLibrary[out[i].ID]
 		if len(items) == 0 {
+			if s.cache != nil {
+				itemKey := s.libraryPreviewCacheKey([]model.Library{out[i].Library}, cardLimit, filter, includeCounts)
+				s.cache.SetJSON(ctx, itemKey, out[i], s.derivedReadCacheTTL())
+			}
 			continue
 		}
-			cards := groupMediaSeriesCards(items)
-			// 如果折叠后的作品部数不足 cardLimit，且该库总记录数大于当前提取的条目数，
-			// 说明多集剧集折叠占满了提取窗口，调用 ListLibrarySeriesCards 补齐完整的影视部数。
-			if len(cards) < cardLimit && out[i].Total > int64(len(items)) {
-				if fullCards, _, err := s.ListLibrarySeriesCards(ctx, out[i].ID, visibility); err == nil && len(fullCards) > 0 {
-					cards = fullCards
-				}
-			}
-			if len(cards) > cardLimit {
-				cards = cards[:cardLimit]
-			}
-			if cards == nil {
-				cards = []SeriesCard{}
-			}
-			out[i].Cards = cards
-	}
-
-	if s.cache != nil {
-		s.cache.SetJSON(ctx, cacheKey, libraryPreviewCacheValue{Items: out}, time.Duration(s.mediaCacheTTLSeconds())*time.Second)
+		cards := groupMediaSeriesCards(items)
+		if len(cards) > cardLimit {
+			cards = cards[:cardLimit]
+		}
+		if cards == nil {
+			cards = []SeriesCard{}
+		}
+		out[i].Cards = cards
+		if s.cache != nil {
+			itemKey := s.libraryPreviewCacheKey([]model.Library{out[i].Library}, cardLimit, filter, includeCounts)
+			s.cache.SetJSON(ctx, itemKey, out[i], s.derivedReadCacheTTL())
+		}
 	}
 
 	return out, nil

internal/service/media_library_test.go

@@ -155,3 +155,57 @@ func TestListLibrariesWithPreviewLongSeriesCompletion(t *testing.T) {
 		t.Fatalf("previews[0].Cards count = %d, want 2", len(previews[0].Cards))
 	}
 }
+
+func TestListLibraryPreviewsSkipsTotals(t *testing.T) {
+	db := newServiceTestDB(t, &model.Library{}, &model.Media{})
+	repos := repository.New(db)
+	lib := model.Library{Name: "电影", Path: "/media/movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatal(err)
+	}
+	if err := repos.DB.Create(&model.Media{
+		LibraryID: lib.ID,
+		Title:     "预览电影",
+		Path:      "/media/movies/预览电影.mkv",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	svc := NewMediaService(&config.Config{}, zap.NewNop(), repos)
+	previews, err := svc.ListLibraryPreviews(t.Context(), []model.Library{lib}, MediaVisibility{IncludeNSFW: true}, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(previews) != 1 || previews[0].Total != 0 || len(previews[0].Cards) != 1 {
+		t.Fatalf("preview-only result = %#v, want one card and no count", previews)
+	}
+}
+
+func TestListLibraryPreviewsCachesEachLibraryIndependently(t *testing.T) {
+	db := newServiceTestDB(t, &model.Library{}, &model.Media{})
+	repos := repository.New(db)
+	lib := model.Library{Name: "电影", Path: "/media/movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatal(err)
+	}
+	if err := repos.DB.Create(&model.Media{
+		LibraryID: lib.ID,
+		Title:     "预览电影",
+		Path:      "/media/movies/预览电影.mkv",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	svc := NewMediaService(&config.Config{}, zap.NewNop(), repos).
+		SetRuntimeCache(NewRuntimeCacheService(&config.Config{}, zap.NewNop()))
+	visibility := MediaVisibility{IncludeNSFW: true}
+	if _, err := svc.ListLibraryPreviews(t.Context(), []model.Library{lib}, visibility, 10); err != nil {
+		t.Fatal(err)
+	}
+	filter := repository.MediaQueryFilter{IncludeNSFW: true}
+	key := svc.libraryPreviewCacheKey([]model.Library{lib}, 10, filter, false)
+	var cached LibraryPreviewItem
+	if !svc.cache.GetJSON(t.Context(), key, &cached) || len(cached.Cards) != 1 {
+		t.Fatalf("per-library preview cache = %#v, want one cached card", cached)
+	}
+}

internal/service/media_listing.go

@@ -2,7 +2,6 @@ package service
 
 import (
 	"context"
-	"sort"
 	"strings"
 	"time"
 
@@ -56,14 +55,56 @@ func (s *MediaService) ListMediaVisible(ctx context.Context, libraryID string, p
 
 func (s *MediaService) ListMediaVisibleGrouped(ctx context.Context, libraryID string, page, pageSize int, visibility MediaVisibility) ([]MediaItem, int64, error) {
 	page, pageSize = normalizeGroupedMediaPage(page, pageSize)
-	items, err := s.listMediaVisibleForGrouping(ctx, libraryID, visibility)
+	grouped, err := s.GroupedMediaVisible(ctx, libraryID, visibility)
 	if err != nil {
 		return nil, 0, err
 	}
-	grouped := groupMediaVersions(items)
 	return paginateMediaItems(grouped, page, pageSize), int64(len(grouped)), nil
 }
 
+// GroupedMediaVisible returns the complete version-grouped media list before pagination.
+// The result is cached as an immutable slice; sort/pagination callers must copy it before mutating.
+func (s *MediaService) GroupedMediaVisible(ctx context.Context, libraryID string, visibility MediaVisibility) ([]MediaItem, error) {
+	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
+	libraryIDs, err := MergedLibraryIDsForLibrary(ctx, s.repo, libraryID)
+	if err != nil {
+		return nil, err
+	}
+	filter := repository.MediaQueryFilter{
+		IncludeNSFW:       visibility.IncludeNSFW,
+		AllowedLibraryIDs: visibility.AllowedLibraryIDs,
+		HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
+	}
+	itemsCacheKey := s.groupedItemsCacheKey(libraryID, libraryIDs, filter)
+	value, err, _ := s.groupedMediaFlight.Do(itemsCacheKey, func() (any, error) {
+		if s.cache != nil {
+			if cachedObj, ok := s.cache.GetObject(itemsCacheKey); ok {
+				if cached, ok := cachedObj.([]MediaItem); ok {
+					return cached, nil
+				}
+			}
+		}
+		loadCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 2*time.Minute)
+		defer cancel()
+		items, err := s.listMediaVisibleForGrouping(loadCtx, libraryID, visibility)
+		if err != nil {
+			return nil, err
+		}
+		grouped := groupMediaVersions(items)
+		if s.cache != nil && len(grouped) > 0 {
+			s.cache.SetObject(itemsCacheKey, grouped, s.mediaObjectTTL())
+		}
+		return grouped, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if grouped, ok := value.([]MediaItem); ok {
+		return grouped, nil
+	}
+	return nil, nil
+}
+
 func (s *MediaService) listMediaVisibleForGrouping(ctx context.Context, libraryID string, visibility MediaVisibility) ([]model.Media, error) {
 	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
 	libraryIDs, err := MergedLibraryIDsForLibrary(ctx, s.repo, libraryID)
@@ -75,30 +116,19 @@ func (s *MediaService) listMediaVisibleForGrouping(ctx context.Context, libraryI
 		AllowedLibraryIDs: visibility.AllowedLibraryIDs,
 		HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
 	}
-	cacheKey := s.mediaGroupedRowsCacheKey(libraryID, libraryIDs, filter)
-	if s.cache != nil {
-		if cachedObj, ok := s.cache.GetObject(cacheKey); ok {
-			if cached, ok := cachedObj.([]model.Media); ok {
-				// 对象缓存中的切片视为不可变；attachLibraryMetadata 会在填充时
-				// 执行过，命中路径直接返回副本即可（调用方只读）。
-				return cached, nil
-			}
-		}
-	}
-	items, total, err := s.repo.Media.ListByLibrariesFiltered(ctx, libraryIDs, 0, maxMediaSearchLimit, filter)
+	// 版本分组的 URL 分页发生在 Go 进程内，响应里的 total 是分组后的数量，
+	// 不需要数据库再为原始行做一次 COUNT(*)。全量 COUNT 在超大媒体库上
+	// 会重复扫描整个 library_id 范围，而这里只关心是否存在截断风险。
+	items, err := s.repo.Media.ListByLibrariesFilteredNoCount(ctx, libraryIDs, 0, maxMediaSearchLimit, filter)
 	if err != nil {
 		return nil, err
 	}
-	if total > int64(len(items)) && s.log != nil {
-		s.log.Warn("media version grouping truncated by safety limit",
+	if len(items) >= maxMediaSearchLimit && s.log != nil {
+		s.log.Warn("media version grouping may be truncated by safety limit",
 			zap.String("library_id", libraryID),
-			zap.Int64("total", total),
 			zap.Int("limit", maxMediaSearchLimit))
 	}
 	s.attachLibraryMetadata(ctx, items)
-	if s.cache != nil {
-		s.cache.SetObject(cacheKey, items, s.mediaObjectTTL())
-	}
 	return items, nil
 }
 
@@ -148,28 +178,44 @@ func (s *MediaService) listVersionSiblings(ctx context.Context, media *model.Med
 		libraryIDs = []string{media.LibraryID}
 	}
 	filter := repository.MediaQueryFilter{IncludeNSFW: true}
-	candidates, err := s.repo.Media.ListByLibrariesFilteredNoCount(ctx, libraryIDs, 0, 5000, filter)
-	if err != nil {
-		return nil, err
+	// 成人条目按番号分组，而番号常常只存在于路径/标题里：本地 NFO 来源的分片
+	// 没有 douban_id/thetvdb_id（MetaTube 刮削出来的那几个才有）。若仍按外部
+	// ID 预先收窄候选集，同番号的其它分片会被 SQL 直接排除，表现就是库里折叠
+	// 出了 N 个版本、详情页却只列出带 ID 的那几个。因此成人条目不预先收窄，
+	// 直接在该库范围内比对版本键。未刮削但文件名带番号的分片同理：同一部片的
+	// 各分片元数据来源不一致（刮削 vs pending），收窄后标题也对不上。
+	var candidates []model.Media
+	narrowed := false
+	hasAdultCode := mediaAdultGroupCode(*media) != "" ||
+		canonicalAdultGroupCode(AdultCodeFromMediaPath(media.Path)) != ""
+	if !hasAdultCode {
+		candidates, narrowed, err = s.repo.Media.ListVersionCandidates(ctx, libraryIDs, *media, 5000)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if !narrowed {
+		candidates, err = s.repo.Media.ListByLibrariesFilteredNoCount(ctx, libraryIDs, 0, 5000, filter)
+		if err != nil {
+			return nil, err
+		}
 	}
 	s.attachLibraryMetadata(ctx, candidates)
+	// 同番号只要有一个分片被确认为成人内容，尚未刮削的分片也按番号折叠，
+	// 与列表页的分组结果保持一致。
+	vouched := adultCodesVouchedByNSFW(candidates)
+	if vouchKey := adultVouchedGroupKey(*media, vouched); vouchKey != "" {
+		key = vouchKey
+	}
 	matched := make([]model.Media, 0, 4)
 	for _, row := range candidates {
-		if mediaVersionGroupKey(row) == key {
+		if mediaVersionGroupKeyWithAdultVouch(row, vouched) == key {
 			matched = append(matched, row)
 		}
 	}
 	if len(matched) == 0 {
 		return []model.Media{*media}, nil
 	}
-	sort.SliceStable(matched, func(i, j int) bool {
-		if matched[i].ID == media.ID {
-			return true
-		}
-		if matched[j].ID == media.ID {
-			return false
-		}
-		return betterMediaVersion(matched[i], matched[j])
-	})
+	sortMediaVersionsForDisplay(matched)
 	return matched, nil
 }

internal/service/media_series.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
 )
 
 type seriesCardsCacheValue struct {
@@ -24,6 +25,7 @@ type libraryRowsCacheValue struct {
 	Rows     []model.Media
 	Resolver mediaSeriesKeyResolver
 	Episodes map[string][]model.Media
+	Cards    []SeriesCard
 }
 
 type SeriesCard struct {
@@ -31,9 +33,41 @@ type SeriesCard struct {
 	Rep         model.Media `json:"rep"`
 	LinkMedia   model.Media `json:"linkMedia"`
 	Count       int         `json:"count"`
+	IsSeries    bool        `json:"is_series,omitempty"`
 	LastAddedAt *time.Time  `json:"last_added_at,omitempty"`
 }
 
+// SeriesCardView is the compact payload used by homepage and library preview
+// endpoints. LinkMedia is only needed to resolve the target library ID, so
+// sending the full media row twice roughly doubles the preview JSON for no UI
+// benefit.
+type SeriesCardView struct {
+	Key           string      `json:"key"`
+	Rep           model.Media `json:"rep"`
+	LinkLibraryID string      `json:"linkLibraryId,omitempty"`
+	Count         int         `json:"count"`
+	IsSeries      bool        `json:"is_series,omitempty"`
+	LastAddedAt   *time.Time  `json:"last_added_at,omitempty"`
+}
+
+func NewSeriesCardViews(cards []SeriesCard) []SeriesCardView {
+	if len(cards) == 0 {
+		return []SeriesCardView{}
+	}
+	out := make([]SeriesCardView, len(cards))
+	for i, card := range cards {
+		out[i] = SeriesCardView{
+			Key:           card.Key,
+			Rep:           card.Rep,
+			LinkLibraryID: mediaTargetLibraryID(card.LinkMedia),
+			Count:         card.Count,
+			IsSeries:      card.IsSeries,
+			LastAddedAt:   card.LastAddedAt,
+		}
+	}
+	return out
+}
+
 type seriesCardGroup struct {
 	card   SeriesCard
 	latest time.Time
@@ -41,38 +75,50 @@ type seriesCardGroup struct {
 
 // libraryRowsWithIndex 返回整库行与预计算剧集索引（带对象缓存）。
 func (s *MediaService) libraryRowsWithIndex(ctx context.Context, libraryID string, visibility MediaVisibility) (*libraryRowsCacheValue, error) {
+	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
 	cacheKey := s.libraryRowsCacheKey(libraryID, visibility)
-	if s.cache != nil {
-		if obj, ok := s.cache.GetObject(cacheKey); ok {
-			if cached, ok := obj.(*libraryRowsCacheValue); ok {
-				return cached, nil
+	value, err, _ := s.libraryRowsFlight.Do(cacheKey, func() (any, error) {
+		if s.cache != nil {
+			if obj, ok := s.cache.GetObject(cacheKey); ok {
+				if cached, ok := obj.(*libraryRowsCacheValue); ok {
+					return cached, nil
+				}
 			}
 		}
-	}
-	rows, _, err := s.listAllMediaVisible(ctx, libraryID, visibility)
+		loadCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 2*time.Minute)
+		defer cancel()
+		rows, _, err := s.listAllMediaVisible(loadCtx, libraryID, visibility)
+		if err != nil {
+			return nil, err
+		}
+		// listAllMediaVisible 走 ListMediaVisible，行已带库元数据（resolver 的
+		// key 计算依赖 DisplayLibraryPath/ID）。
+		resolver, keys := resolveMediaSeriesKeys(rows)
+		episodes := make(map[string][]model.Media, len(rows)/4+1)
+		for i, row := range rows {
+			k := keys[i]
+			if k == "" {
+				continue
+			}
+			episodes[k] = append(episodes[k], row)
+		}
+		cards := groupMediaSeriesCardsByKeys(rows, keys)
+		value := &libraryRowsCacheValue{Rows: rows, Resolver: resolver, Episodes: episodes, Cards: cards}
+		if s.cache != nil {
+			s.cache.SetObject(cacheKey, value, s.derivedReadCacheTTL())
+		}
+		return value, nil
+	})
 	if err != nil {
 		return nil, err
 	}
-	// listAllMediaVisible 走 ListMediaVisible，行已带库元数据（resolver 的
-	// key 计算依赖 DisplayLibraryPath/ID）。
-	resolver := newMediaSeriesKeyResolver(rows)
-	episodes := make(map[string][]model.Media, len(rows)/4+1)
-	for _, row := range rows {
-		k := resolver.key(row)
-		if k == "" {
-			continue
-		}
-		episodes[k] = append(episodes[k], row)
+	if cached, ok := value.(*libraryRowsCacheValue); ok {
+		return cached, nil
 	}
-	value := &libraryRowsCacheValue{Rows: rows, Resolver: resolver, Episodes: episodes}
-	if s.cache != nil {
-		s.cache.SetObject(cacheKey, value, s.mediaObjectTTL())
-	}
-	return value, nil
+	return nil, nil
 }
 
 func (s *MediaService) ListLibrarySeriesCards(ctx context.Context, libraryID string, visibility MediaVisibility) ([]SeriesCard, int64, error) {
-	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
 	cacheKey := s.libraryCardsObjectKey(libraryID, visibility)
 	if s.cache != nil {
 		if obj, ok := s.cache.GetObject(cacheKey); ok {
@@ -85,13 +131,18 @@ func (s *MediaService) ListLibrarySeriesCards(ctx context.Context, libraryID str
 	if err != nil {
 		return nil, 0, err
 	}
-	cards := groupMediaSeriesCards(rows.Rows)
+	cards := rows.Cards
+	if cards == nil && len(rows.Rows) > 0 {
+		// Fallback keeps rolling-cache compatibility if an older runtime cache
+		// value was created before Cards was added.
+		cards = groupMediaSeriesCards(rows.Rows)
+	}
 	if cards == nil {
 		cards = []SeriesCard{}
 	}
 	total := int64(len(cards))
 	if s.cache != nil {
-		s.cache.SetObject(cacheKey, &seriesCardsCacheValue{Cards: cards, Total: total}, s.mediaObjectTTL())
+		s.cache.SetObject(cacheKey, &seriesCardsCacheValue{Cards: cards, Total: total}, s.derivedReadCacheTTL())
 	}
 	return cards, total, nil
 }
@@ -171,6 +222,30 @@ func (s *MediaService) ListMediaEpisodes(ctx context.Context, mediaID string, vi
 	if target.LibraryID == "" {
 		return []model.Media{*target}, nil
 	}
+	// 电影、音乐等单条目库不需要为了返回自身而加载整库。详情页会并行
+	// 请求 /media/:id/episodes，未短路时每次冷缓存都会触发一次全库分组。
+	if lib, err := s.repo.Library.FindByID(ctx, target.LibraryID); err == nil && lib != nil &&
+		libraryUsesSingleMediaRows(lib.Type) &&
+		strings.TrimSpace(target.SeriesID) == "" &&
+		!mediaLooksEpisodicForGrouping(*target) {
+		return []model.Media{*target}, nil
+	}
+	if seriesID := strings.TrimSpace(target.SeriesID); seriesID != "" {
+		libraryIDs, err := MergedLibraryIDsForLibrary(ctx, s.repo, target.LibraryID)
+		if err == nil && len(libraryIDs) > 0 {
+			rows, queryErr := s.repo.Media.ListByLibrariesFilteredNoCount(ctx, libraryIDs, 0, maxMediaSearchLimit, repository.MediaQueryFilter{
+				IncludeNSFW:       visibility.IncludeNSFW,
+				AllowedLibraryIDs: visibility.AllowedLibraryIDs,
+				HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
+				SeriesID:          seriesID,
+			})
+			if queryErr == nil && len(rows) > 1 {
+				s.attachLibraryMetadata(ctx, rows)
+				sortEpisodesForDisplay(rows)
+				return rows, nil
+			}
+		}
+	}
 	cache, err := s.libraryRowsWithIndex(ctx, target.LibraryID, visibility)
 	if err != nil {
 		return nil, err
@@ -190,40 +265,40 @@ func (s *MediaService) ListMediaEpisodes(ctx context.Context, mediaID string, vi
 		}
 	}
 
-		// 如果没有聚合到多集，尝试同父目录匹配（排除合集目录和公共分类目录，且同目录文件不能是互不相同的独立电影）
-		if len(out) <= 1 && target.Path != "" {
-			targetDir := filepath.Dir(strings.ReplaceAll(target.Path, "\\", "/"))
-			parentBase := filepath.Base(targetDir)
-			if !mediaParentLooksLikeCollection(target.Path) && !seriesTitleIsGenericContainer(parentBase, *target) {
-				targetTitleNorm := normalizeSeriesTitle(target.Title)
-				targetDirNorm := normalizeSeriesTitle(parentBase)
-				dirMatches := make([]model.Media, 0)
-				for _, row := range rows {
-					if row.Path == "" || filepath.Dir(strings.ReplaceAll(row.Path, "\\", "/")) != targetDir {
-						continue
-					}
-					if row.ID == target.ID {
-						dirMatches = append(dirMatches, row)
-						continue
-					}
-					rowTitleNorm := normalizeSeriesTitle(row.Title)
-					allowMatch := false
-					if isGenericMovieTitle(rowTitleNorm) || isGenericMovieTitle(targetTitleNorm) {
-						allowMatch = true
-					} else if rowTitleNorm != "" && rowTitleNorm == targetTitleNorm {
-						allowMatch = true
-					} else if rowTitleNorm != "" && targetDirNorm != "" && rowTitleNorm == targetDirNorm {
-						allowMatch = true
-					}
-					if allowMatch {
-						dirMatches = append(dirMatches, row)
-					}
+	// 如果没有聚合到多集，尝试同父目录匹配（排除合集目录和公共分类目录，且同目录文件不能是互不相同的独立电影）
+	if len(out) <= 1 && target.Path != "" {
+		targetDir := filepath.Dir(strings.ReplaceAll(target.Path, "\\", "/"))
+		parentBase := filepath.Base(targetDir)
+		if !mediaParentLooksLikeCollection(target.Path) && !seriesTitleIsGenericContainer(parentBase, *target) {
+			targetTitleNorm := normalizeSeriesTitle(target.Title)
+			targetDirNorm := normalizeSeriesTitle(parentBase)
+			dirMatches := make([]model.Media, 0)
+			for _, row := range rows {
+				if row.Path == "" || filepath.Dir(strings.ReplaceAll(row.Path, "\\", "/")) != targetDir {
+					continue
 				}
-				if len(dirMatches) > 1 {
-					out = dirMatches
+				if row.ID == target.ID {
+					dirMatches = append(dirMatches, row)
+					continue
+				}
+				rowTitleNorm := normalizeSeriesTitle(row.Title)
+				allowMatch := false
+				if isGenericMovieTitle(rowTitleNorm) || isGenericMovieTitle(targetTitleNorm) {
+					allowMatch = true
+				} else if rowTitleNorm != "" && rowTitleNorm == targetTitleNorm {
+					allowMatch = true
+				} else if rowTitleNorm != "" && targetDirNorm != "" && rowTitleNorm == targetDirNorm {
+					allowMatch = true
+				}
+				if allowMatch {
+					dirMatches = append(dirMatches, row)
 				}
 			}
+			if len(dirMatches) > 1 {
+				out = dirMatches
+			}
 		}
+	}
 
 	if len(out) == 0 {
 		out = []model.Media{*target}
@@ -245,36 +320,57 @@ func (s *MediaService) ListMediaEpisodes(ctx context.Context, mediaID string, vi
 	return out, nil
 }
 
-func (s *MediaService) listAllMediaVisible(ctx context.Context, libraryID string, visibility MediaVisibility) ([]model.Media, int64, error) {
-	const pageSize = 2000
-	var all []model.Media
-	var total int64
-	for page := 1; ; page++ {
-		rows, n, err := s.ListMediaVisible(ctx, libraryID, page, pageSize, visibility)
-		if err != nil {
-			return nil, 0, err
-		}
-		if page == 1 {
-			total = n
-			all = make([]model.Media, 0, minInt64(n, pageSize))
-		}
-		all = append(all, rows...)
-		if int64(len(all)) >= n || len(rows) < pageSize {
-			break
-		}
+func libraryUsesSingleMediaRows(libraryType string) bool {
+	switch strings.ToLower(strings.TrimSpace(libraryType)) {
+	case "movie", "movies", "music", "adult":
+		return true
+	default:
+		return false
 	}
-	return all, total, nil
+}
+
+func (s *MediaService) listAllMediaVisible(ctx context.Context, libraryID string, visibility MediaVisibility) ([]model.Media, int64, error) {
+	visibility = ExpandMediaVisibilityForMergedCloudLibraries(ctx, s.repo, visibility)
+	libraryIDs, err := MergedLibraryIDsForLibrary(ctx, s.repo, libraryID)
+	if err != nil {
+		return nil, 0, err
+	}
+	filter := repository.MediaQueryFilter{
+		IncludeNSFW:       visibility.IncludeNSFW,
+		AllowedLibraryIDs: visibility.AllowedLibraryIDs,
+		HiddenLibraryIDs:  visibility.HiddenLibraryIDs,
+	}
+	rows, err := s.repo.Media.ListAllByLibrariesFilteredNoCount(ctx, libraryIDs, filter)
+	if err != nil {
+		return nil, 0, err
+	}
+	s.attachLibraryMetadata(ctx, rows)
+	return rows, int64(len(rows)), nil
 }
 
 func groupMediaSeriesCards(items []model.Media) []SeriesCard {
 	if len(items) == 0 {
 		return nil
 	}
+	_, keys := resolveMediaSeriesKeys(items)
+	return groupMediaSeriesCardsByKeys(items, keys)
+}
+
+// groupMediaSeriesCardsByKeys performs the card fold using already-resolved
+// keys. Full-library caches need the same keys for the episode index and the
+// series-card list; resolving them once avoids several regex-heavy passes over
+// every episode row.
+func groupMediaSeriesCardsByKeys(items []model.Media, keys []string) []SeriesCard {
+	if len(items) == 0 {
+		return nil
+	}
+	if len(keys) != len(items) {
+		return groupMediaSeriesCards(items)
+	}
 	groups := make([]seriesCardGroup, 0)
 	byKey := make(map[string]int, len(items))
-	resolver := newMediaSeriesKeyResolver(items)
-	for _, item := range items {
-		key := resolver.key(item)
+	for i, item := range items {
+		key := keys[i]
 		if key == "" {
 			continue
 		}

internal/service/media_series_resolver.go

@@ -14,75 +14,123 @@ type mediaSeriesKeyResolver struct {
 	pathTitles     map[string]string
 }
 
+// mediaSeriesKeyInputs 保存单条媒体解析剧集 key 所需的派生字段。剧集卡片、
+// 剧集索引和分页分组需要反复读取同一批行；提前计算一次可以避免对每行执行
+// 多轮正则匹配、路径解析和标题规范化。
+type mediaSeriesKeyInputs struct {
+	episodic    bool
+	pathKey     string
+	externalKey string
+	titleKey    string
+}
+
+func analyzeMediaSeriesKey(item model.Media) mediaSeriesKeyInputs {
+	if !mediaLooksEpisodicForGrouping(item) {
+		return mediaSeriesKeyInputs{}
+	}
+	return mediaSeriesKeyInputs{
+		episodic:    true,
+		pathKey:     mediaSeriesRawKey(item),
+		externalKey: repeatedSeriesExternalKey(item),
+		titleKey:    repeatedSeriesTitleKey(item),
+	}
+}
+
+func analyzeMediaSeriesKeys(items []model.Media) []mediaSeriesKeyInputs {
+	inputs := make([]mediaSeriesKeyInputs, len(items))
+	for i := range items {
+		inputs[i] = analyzeMediaSeriesKey(items[i])
+	}
+	return inputs
+}
+
 func newMediaSeriesKeyResolver(items []model.Media) mediaSeriesKeyResolver {
+	return newMediaSeriesKeyResolverFromInputs(analyzeMediaSeriesKeys(items))
+}
+
+func newMediaSeriesKeyResolverFromInputs(inputs []mediaSeriesKeyInputs) mediaSeriesKeyResolver {
 	resolver := mediaSeriesKeyResolver{
 		pathCounts:     make(map[string]int),
 		externalCounts: make(map[string]int),
 		titleCounts:    make(map[string]int),
 		pathTitles:     make(map[string]string),
 	}
-	for _, item := range items {
-		if !mediaLooksEpisodicForGrouping(item) {
+	pathTitleCandidates := make(map[string]map[string]struct{})
+	for _, input := range inputs {
+		if !input.episodic {
 			continue
 		}
-		if key := mediaSeriesRawKey(item); strings.HasPrefix(key, "library-path") {
-			resolver.pathCounts[key]++
+		if strings.HasPrefix(input.pathKey, "library-path") {
+			resolver.pathCounts[input.pathKey]++
+			if input.titleKey != "" {
+				if pathTitleCandidates[input.pathKey] == nil {
+					pathTitleCandidates[input.pathKey] = make(map[string]struct{})
+				}
+				pathTitleCandidates[input.pathKey][input.titleKey] = struct{}{}
+			}
 		}
-		if key := repeatedSeriesExternalKey(item); key != "" {
-			resolver.externalCounts[key]++
+		if input.externalKey != "" {
+			resolver.externalCounts[input.externalKey]++
 		}
-		if key := repeatedSeriesTitleKey(item); key != "" {
-			resolver.titleCounts[key]++
+		if input.titleKey != "" {
+			resolver.titleCounts[input.titleKey]++
 		}
 	}
 	// A scraper can normalize the same show to one title while the source
 	// release folders still contain different tags (1080p/2160p, uploader
 	// names, etc.). Remember an unambiguous title alias for each path group so
 	// those folders are bridged instead of rendered as separate collections.
-	pathTitleCandidates := make(map[string]map[string]struct{})
-	for _, item := range items {
-		if !mediaLooksEpisodicForGrouping(item) {
-			continue
-		}
-		pathKey := mediaSeriesRawKey(item)
-		titleKey := repeatedSeriesTitleKey(item)
-		if !strings.HasPrefix(pathKey, "library-path") || titleKey == "" || resolver.titleCounts[titleKey] < 2 {
-			continue
-		}
-		if pathTitleCandidates[pathKey] == nil {
-			pathTitleCandidates[pathKey] = make(map[string]struct{})
-		}
-		pathTitleCandidates[pathKey][titleKey] = struct{}{}
-	}
 	for pathKey, candidates := range pathTitleCandidates {
-		if len(candidates) != 1 {
-			continue
-		}
+		repeatedTitle := ""
+		repeatedCount := 0
 		for titleKey := range candidates {
-			resolver.pathTitles[pathKey] = titleKey
+			if resolver.titleCounts[titleKey] < 2 {
+				continue
+			}
+			repeatedTitle = titleKey
+			repeatedCount++
+		}
+		if repeatedCount == 1 {
+			resolver.pathTitles[pathKey] = repeatedTitle
 		}
 	}
 	return resolver
 }
 
+// resolveMediaSeriesKeys 对输入只做一轮派生字段计算，返回可供后续 O(1) 解析的
+// resolver 以及每条记录对应的 key。这是整库剧集加载的快速路径。
+func resolveMediaSeriesKeys(items []model.Media) (mediaSeriesKeyResolver, []string) {
+	inputs := analyzeMediaSeriesKeys(items)
+	resolver := newMediaSeriesKeyResolverFromInputs(inputs)
+	keys := make([]string, len(items))
+	for i := range items {
+		keys[i] = resolver.keyFromInputs(items[i], inputs[i])
+	}
+	return resolver, keys
+}
+
 func (r mediaSeriesKeyResolver) key(media model.Media) string {
-	if mediaLooksEpisodicForGrouping(media) {
-		if pathKey := mediaSeriesRawKey(media); strings.HasPrefix(pathKey, "library-path") {
-			if titleKey := r.pathTitles[pathKey]; titleKey != "" {
+	return r.keyFromInputs(media, analyzeMediaSeriesKey(media))
+}
+
+func (r mediaSeriesKeyResolver) keyFromInputs(media model.Media, input mediaSeriesKeyInputs) string {
+	if input.episodic {
+		if strings.HasPrefix(input.pathKey, "library-path") {
+			if titleKey := r.pathTitles[input.pathKey]; titleKey != "" {
 				return compactSeriesKey(titleKey)
 			}
 			// A series directory is the strongest identity for mixed rows:
 			// main episodes and specials (CM/NCOP/PV/OVA) may be scraped to
 			// slightly different titles, but they still belong to one show.
-			if r.pathCounts[pathKey] > 1 {
-				return compactSeriesKey(pathKey)
+			if r.pathCounts[input.pathKey] > 1 {
+				return compactSeriesKey(input.pathKey)
 			}
 		}
-		if key := repeatedSeriesTitleKey(media); key != "" && r.titleCounts[key] > 1 {
-			return compactSeriesKey(key)
+		if input.titleKey != "" && r.titleCounts[input.titleKey] > 1 {
+			return compactSeriesKey(input.titleKey)
 		}
-		if key := repeatedSeriesExternalKey(media); key != "" && r.externalCounts[key] > 1 {
-			return compactSeriesKey(key)
+		if input.externalKey != "" && r.externalCounts[input.externalKey] > 1 {
+			return compactSeriesKey(input.externalKey)
 		}
 	}
 	return mediaSeriesKey(media)