diff --git a/docs-developers/architecture/cross-repo-contract.md b/docs-developers/architecture/cross-repo-contract.md
index 3fd337a..3b7811f 100644
--- a/docs-developers/architecture/cross-repo-contract.md
+++ b/docs-developers/architecture/cross-repo-contract.md
@@ -119,8 +119,10 @@ client side in [State & data](../frontend/state-and-data.md#bookmarks-notes-and-
 `<img>`/`<audio>`, so cover and stream GETs accept the session token as a
 `?token=` query param on every platform.
 
-**Server:** `internal/api/middleware.go` - only the cover, stream and community
-cover (`/meta/cover`) routes use `requireMediaAuth`, which calls `bearerToken(r, true)`; all other routes are
+**Server:** `internal/api/middleware.go` - only the cover and stream routes
+(`requireBookMediaAuth`, which also takes a cast token) and the community cover route
+(`/meta/cover`, `requireMediaAuth`) call `bearerToken(r, true)`, both through
+`mediaAuth`; all other routes are
 header-only (`bearerToken(r, false)`), so tokens never ride the query string where
 they could leak into access logs or Referer headers.
 **Frontend:** `client.ts` `mediaTokenQuery()` → `coverUrl()`/`streamUrl()`. Native
@@ -140,9 +142,15 @@ thumbnail of a community `cover_url` that the server fetched, so the web player,
 whose CSP stays `img-src 'self' data: blob:`, never contacts a cover host. Details
 in [§14](#14-community-metadata-a-three-repo-seam).
 
+**Cast tokens** (capability `cast`) ride the same `?token=`, on a book's cover and
+stream only: a player casting to a Chromecast mints one for the book
+(`POST /cast/token`) and builds the receiver's URLs with it, never with its session
+token. Details in [§15](#15-listening-in-the-house-and-casting).
+
 **A change requires:** do **not** "tighten" the server to reject query-param
 tokens on media routes without first removing the web player's dependency on
-them - the web player cannot authenticate media any other way.
+them - the web player cannot authenticate media any other way (and a Cast
+receiver has no other way either).
 
 ## 4. Audio `Content-Type` must be real (byte-sniffed)
 
@@ -263,7 +271,7 @@ version.
 **Server:** `handleServerInfo` advertises `admin_ui`, `web_player`, `upload`,
 `transcode`, `websocket`, `api_keys`, `export`, `metadata`, `meta_bundle`,
 `browse_people`, `cover_sizes`, `next_book` and the flags added after it (the
-latest, `meta_covers`, gates the community cover route), plus the
+latest, `household` and `cast`, gate [§15](#15-listening-in-the-house-and-casting)), plus the
 server version
 (`api.Version`, stamped from the release tag via ldflags). `transcode` reflects
 ffmpeg availability; `web_player` reflects whether `/web` is populated; `api_keys`
@@ -518,6 +526,34 @@ additive, same as every other seam here. A change to `pkg/query` or
 `pkg/release`'s exported API reaches the server through its `go.mod` (and the
 desktop manager, which builds the server).
 
+## 15. Listening in the house and casting
+
+The player redesign's Phase 8, two additive features each behind its own flag
+(seam 8), mirrored in `types.ts` (`HouseholdSettings`, `HouseListeningRow`,
+`HouseListening`, `CastToken`), `client.ts` and `hooks.ts`.
+
+**Listening in the house** (capability `household`): `GET`/`PUT /me/household`
+(`{ share_listening }`) and `GET /household/listening` (`{ sharing, listening: [Row] }`);
+shapes in [the reference](../server/api/reference.md#listening-in-the-house). Every
+privacy rule is the server's alone
+([what other people see](../server/auth-and-security.md#listening-in-the-house-what-other-people-see)):
+the player only decides what to show of the answer and how often to ask. Client side:
+[Listening in the house](../frontend/listening-in-the-house.md).
+
+**Casting** (capability `cast`): `POST /cast/token` `{ library_id, path }` ->
+`201 { token, expires_at }`, a credential for one book accepted only as the
+`?token=` of that book's cover and stream
+([Cast tokens as media auth](../server/api/reference.md#cast-tokens-as-media-auth);
+its lifetime and policy: [Cast tokens](../server/auth-and-security.md#cast-tokens)).
+The web player's CSP admits the Cast Web Sender's three scripts on
+`https://www.gstatic.com` by path in `script-src`, and nothing else. The receiver
+never sees the session token; no flag, no Cast button. Client side, including which
+address the receiver's URLs use: [Chromecast](../frontend/chromecast.md).
+
+**A change requires:** the household rules stay in the server's catalog (a player
+must never filter someone in); any widening of where a cast token is accepted is a
+security-critical change with allowed and denied tests on the server.
+
 ## The wire-change checklist
 
 Every change to the wire format follows the same shape (the worked example in
diff --git a/docs-developers/architecture/invariants.md b/docs-developers/architecture/invariants.md
index 38b4499..a04b814 100644
--- a/docs-developers/architecture/invariants.md
+++ b/docs-developers/architecture/invariants.md
@@ -183,7 +183,8 @@ audiobooks" into "remote file read on your NAS".
   whose `script-src` carries a sha256 hash of that document's inline scripts
   (`web.htmlCSP` in `internal/web/web.go`).
 - **Confined token-in-URL**: the `?token=` media-auth fallback is accepted **only**
-  on cover/stream GETs (`bearerToken(r, true)` via `requireMediaAuth` in
+  on the cover, stream and community cover GETs (`bearerToken(r, true)` via
+  `requireBookMediaAuth` / `requireMediaAuth` in
   `internal/api/middleware.go`); every other route is header-only, so session
   tokens can't leak into logs or Referer headers elsewhere.
 - **Tested both ways**: security-critical code (`SafeJoin`, scope checks, rate
diff --git a/docs-developers/contributing/documentation.md b/docs-developers/contributing/documentation.md
index ef87e40..efa9da3 100644
--- a/docs-developers/contributing/documentation.md
+++ b/docs-developers/contributing/documentation.md
@@ -70,6 +70,11 @@ mappings:
 | Playback engines / native module | [frontend/playback.md](../frontend/playback.md) (+ `/users/listening/playback` for lock-screen and headphone behaviour) |
 | Smart speed, Voice boost, time saved (`effects.ts`, `time-saved.ts`, `effects-settings.tsx`, the Android `effects/` processors, `VoiceBoostTap.swift`, `VoiceBoostDSP.swift`) | [frontend/audio-effects.md](../frontend/audio-effects.md) (+ [frontend/book-page.md](../frontend/book-page.md) for `smartSpeedSaved`) + `/users/listening/full-player` (Smart speed and Voice boost), the Playback settings in `/users/listening/settings`, the Your listening row in `/users/listening/book-page` + the `web-player/phone-speed-sheet.png`, `settings.png` and `phone-settings.png` screenshots |
 | CarPlay, Android Auto (`src/car/`, the module's car code, `plugins/withCarPlay.js`), the after-first-unlock token store, the iOS widgets and Live Activity (`src/widgets/`) | [frontend/native-integrations.md](../frontend/native-integrations.md) (+ [testing.md](../frontend/testing.md#native-checks) for how to run them) + `/users/listening/in-the-car`, `/users/listening/mobile-apps` (Availability, In the car, widgets), `/users/listening/sleep-timer` (the Live Activity). The web can't show these surfaces: device screenshots, when there are any, are added by hand to the manifest |
+| Connection ids, the identity migration (`src/lib/connection-id.ts`, `src/lib/identity-migration.ts`, a new document keyed by a connection id) | [frontend/state-and-data.md](../frontend/state-and-data.md#connection-identity-server_iduser_id) (+ `ID_DOCUMENTS` when a new document is keyed by a connection id) |
+| Profiles, the PIN, Settings > Household (`src/stores/profiles.ts`, `src/lib/profile-pin.ts`, `src/components/profiles/`) | [frontend/profiles.md](../frontend/profiles.md) + `/users/listening/profiles`, the Household and sharing section of `/users/listening/settings` |
+| Kids mode (`src/components/kids/`, the bedtime rule in `auto-sleep-controller.ts`) | [frontend/kids-mode.md](../frontend/kids-mode.md) + `/users/listening/kids-mode` |
+| Listening in the house (`src/components/house/`, the household hooks; server `catalog/household.go`) | [frontend/listening-in-the-house.md](../frontend/listening-in-the-house.md) + the [reference](../server/api/reference.md#listening-in-the-house) + [auth-and-security.md](../server/auth-and-security.md#listening-in-the-house-what-other-people-see) + `/users/listening/in-the-house`, `/users/admin/activity` (what the server records) |
+| Chromecast (`src/cast/`, `plugins/withCast.js`; server `auth/cast.go`, `handlers_cast.go`, the web CSP) | [frontend/chromecast.md](../frontend/chromecast.md) + the [reference](../server/api/reference.md#casting) + [auth-and-security.md](../server/auth-and-security.md#cast-tokens) + [server/web-ui.md](../server/web-ui.md#per-document-csp-htmlcsp) for the web CSP (`castSenderScripts`, the policy `TestHTMLCSPCastSender` pins) + `/users/listening/chromecast`, `/users/listening/playback` (other speakers), `/users/getting-started/remote-access` (the certificate note) |
 | Downloads / PWA, the offline companion (`offline-meta.ts`) | [frontend/offline.md](../frontend/offline.md) + `/users/listening/offline-downloads` |
 | Scanner, detection, metadata | [server/scanner.md](../server/scanner.md) + `/users/getting-started/organizing-your-library` |
 | Community chapters (`internal/chapteralign`, `internal/chaptercheck`, `catalog/communitychapters.go`, the Chapters card's panel) | [server/community-chapters.md](../server/community-chapters.md) + the Community chapters section of `/users/admin/books` (and `/users/admin/health` for the Health rows) |
diff --git a/docs-developers/frontend/book-page.md b/docs-developers/frontend/book-page.md
index 7c37813..b0f67d6 100644
--- a/docs-developers/frontend/book-page.md
+++ b/docs-developers/frontend/book-page.md
@@ -201,7 +201,7 @@ few values (its state, and the bookmark glyph: a bookmark inside the book marks
 
 ## The aside
 
-`BookAside` stacks three cards (a right-hand column from `BODY_COLUMNS_MIN`, see
+`BookAside` stacks up to four cards (a right-hand column from `BODY_COLUMNS_MIN`, see
 [Layout](#layout-by-the-measured-width), else between the hero
 and the tabs):
 
@@ -226,3 +226,6 @@ and the tabs):
   [time saved](audio-effects.md#time-saved-srcplaybacktime-savedts)). Null for a
   book neither started nor finished; the history is only fetched then, and kept fresh
   for ten minutes (`HISTORY_STALE_MS`: a span this device records refreshes it).
+- **In the house** - `InTheHouseCard` (`src/components/house/`), last, only while the
+  listener shares and someone who shares is on this book; see
+  [Listening in the house](listening-in-the-house.md).
diff --git a/docs-developers/frontend/chromecast.md b/docs-developers/frontend/chromecast.md
new file mode 100644
index 0000000..4bd431a
--- /dev/null
+++ b/docs-developers/frontend/chromecast.md
@@ -0,0 +1,246 @@
+---
+title: Chromecast
+description: "Casting in the player (src/cast/): a playback route behind the store's service indirection, cast tokens in the receiver's URLs, the native and web drivers, the Cast button, the withCast config plugin, the Android notification decision, and the known limits."
+---
+
+The player casts a book to a Chromecast or any Google Cast device (a TV with Cast
+built in, a Nest speaker) through the **Default Media Receiver** (app id `CC1AD845`,
+no Cast registration): it plays the book's files as they are. Native uses
+`react-native-google-cast` (4.9.1, pinned exactly) over the Google Cast SDKs for iOS
+and Android; the web uses Google's Cast Web Sender on Chromium. The server side is
+capability `cast` and its cast tokens
+([the reference](../server/api/reference.md#casting)).
+
+## Casting is a playback route, not a second player
+
+`createPlaybackService()` (both `service.native.ts` and `service.web.ts`) returns the
+platform engine wrapped in `routed(...)`, a **`RoutedPlaybackService`**
+(`src/cast/routed-service.ts`): the one `PlaybackService` the store ever gets. It
+forwards every call to the route in use, the device's own engine or, while a Cast
+session is connected, a **`CastPlaybackService`** (`src/cast/cast-service.ts`), and
+forwards only that route's snapshots. So `book-queue.ts` and `progress-sync.ts` drive
+a cast exactly as they drive the phone, and `store.ts` nearly so: saves, the resume
+floor, the stall watchdog and the chapter UI work unchanged. The store asks about the
+route in one place: the download hot-swap (`switchCurrentBookToLocal`) checks
+`isCasting()` and, while casting, only hands the route the phone's local copy
+(`rememberLoad`) instead of reloading, since the receiver streams from the server
+whatever the phone holds; `adoptLoaded` also hands the route the adopted book's queue
+(`rememberLoad`). Both are optional `PlaybackService` members only the route switch
+implements.
+
+Switching routes is a pause on one side and a paused load on the other:
+
+- **`beginCast`** (a session connected): pause the local engine, emit a `paused`
+  snapshot at its place (the store saves it as any pause), unload the local engine,
+  load the book on the receiver there at the same speed, and play it when the phone
+  was playing. A book that can't be cast stays on the device, paused, and
+  `onCastFailed` explains why and ends the session.
+- **`endCast`** (the session ended): the receiver's last place (read once more while
+  the session can still answer) comes back as a `paused` snapshot and is loaded into
+  the local engine there. The device never starts playing by itself when a cast ends.
+
+`CastPlaybackService` implements the engine contract over one session's
+`CastRemote`. `load` sends the receiver a queue with **one item per track**, in the
+store's track order, so a queue index is a track index: each item's `contentId` is
+the stream URL, with its MIME type (`castContentType`), `streamDuration`,
+`musicTrack` metadata and the book's cover, in an `audioBook` container, starting at
+`(startIndex, startTime)` with the store's `playbackRate`. The receiver's status maps
+back into the same per-track snapshot (`castTrackIndex`, `castState`; a `buffering`
+while playing stays `playing`, so the watchdog never calls a normal LAN buffer a dead
+stream). A move nobody here asked for (the TV remote, Google Home, the Cast
+notification) is reported through `onRemoteMove`, as the native engines report the
+lock screen's, so the store lowers its resume floor and saves.
+
+`startCastSync()` (`src/cast/cast-session.ts`, started once by the root layout)
+follows the driver's session events, switches the route and keeps the `useCast`
+store (`supported`, `status`, `deviceName`) current. On native, a session resumed with
+our media playing while the app has no book loaded (it was killed or relaunched
+mid-cast) is adopted the way the Android car adoption works (`adoptLoaded`, so the
+[play rule](profiles.md#switching-and-the-play-rule) applies), then given the queue
+the store built.
+
+Guards that keep a route switch honest:
+
+- **Stale work is dropped.** The router's switches (`beginCast`, the hand-back) and
+  the session sync's event handling each carry a generation: a switch or event that a
+  newer one overtook while it awaited does nothing when it resumes. A receiver status
+  that arrives while a load of ours is in flight is not trusted as the book's place.
+- **Foreign media** is told apart by stream identity (`streamIdentity` in
+  `cast-media.ts`: the URL's route and its `path`/`transcode` parameters, ignoring the
+  address, `token=` and `t=`), or by the book a receiver item names. Another sender's
+  book, or another app's media on the same receiver, is never paused, seeked, re-rated
+  or stopped by the cast route's controls; ours waits, paused, and the next play loads
+  it back. Ending the session is not guarded: a car play (`endCastForCar`) and a book
+  that can't be cast (`onCastFailed`) end it with `endSession(true)`, which stops
+  whatever the receiver plays, another sender's book included.
+- **An early end of the last file** (`isEarlyTranscodeEnd`, the web engine's rule: the
+  receiver says the last file `finished` well before its end, a transcoded stream the
+  server or a proxy closed, or a dropped direct one) is not the book's end: seen
+  playing just now, the queue is loaded again there and plays on; seen long ago, the
+  book comes back paused there and the next play reloads it. A stream that ends again
+  without real progress past the reload is the end after all. On an earlier file a
+  `finished` is the receiver moving on to the next item, so an early end there is not
+  caught: the rest of that file is skipped.
+- **The car wins.** A CarPlay or Android Auto play request while a book is on a
+  receiver ends the cast first (`endCastForCar`: the receiver's place is read, the book
+  comes back paused there, then the session ends), so the car's play starts on this
+  device, never on the TV.
+
+## The receiver never gets the session token
+
+`prepareCast` (`src/cast/cast-prepare.ts`) builds the receiver's queue:
+
+- It resolves the book's client (`resolveClient`) and its capabilities: no `cast`, no
+  casting.
+- The URLs are built on the connection's **address in use now** (`client.baseUrl`,
+  the `effectiveUrl`: the home address when it was picked), by a second `ApiClient`
+  constructed with a **cast token** in place of the session token, so the existing
+  `streamUrl` / `coverUrl` builders put the cast token in the `?token=`. A downloaded
+  book casts from its server too: the receiver can't read this device's files.
+- `castTokens` (`cast-token.ts`) mints a token with `client.castToken(libraryId,
+  path)` and reuses it for that book until an hour before it expires
+  (`CAST_TOKEN_MARGIN_MS`): a receiver still fetches later files and seeks with it.
+  Concurrent asks share one request. In memory only, never persisted; a removed
+  connection's tokens are dropped (`onConnectionRemoved`). What a cast token may read
+  and how long it lives are the server's rules:
+  [Cast tokens](../server/auth-and-security.md#cast-tokens).
+
+The pure rules are `cast-media.ts`:
+
+- **`castBlockReason`** - why a book can't be cast: `unsupported` (no `cast` flag),
+  `local-address` (the address is this device: `localhost`, `*.localhost`, the
+  loopback range, `::1`, `0.0.0.0`; `isReachableByReceiver`), `codec` (it needs the
+  transcoder and the server has none), `no-connection` (its server isn't signed in).
+  The Cast button and the cast engine share it.
+- **`castNeedsTranscode`** - the server's `direct_playable: false`, or a codec the
+  Default Media Receiver doesn't play (`CAST_UNPLAYABLE_CODECS`: ALAC, the AC-3
+  family, DTS, TrueHD, WMA, AMR). Such a book casts with `?transcode=1` when the
+  server has `transcode`. A transcoded stream can't be seeked by the receiver, so a
+  start or seek inside one asks for the stream from that point (`&t=`,
+  `itemStartingAt`). A full transcoder (`503`) makes the receiver report an error,
+  which reaches the store as the engine's `error` state (the player's Retry).
+
+The web player's Remote Playback prompt (`el.remote.prompt()`) was **removed** for
+this reason: it hands the receiver the element's own URL, which carries the session
+token. The web's route picker is now Safari's AirPlay only: `service.web.ts`'s
+`canShowRoutePicker` / `showRoutePicker` answer only where the element has
+`webkitShowPlaybackTargetPicker` (`hasAirPlayPicker`), and the output pill beside the Cast button is labelled "Audio output" on every platform
+(AirPlay on iOS and Safari, the media output panel on Android).
+
+## The drivers
+
+`castDriver` (`driver.native.ts`, `driver.web.ts`, behind the `CastDriver` type)
+reports the session's life (`starting`, `started`, `resumed`, `startFailed`,
+`suspended`, `ending`, `ended`) and gives a connected session's `CastRemote`.
+
+- **Native**: discovery, the device chooser and the session are the SDK's.
+  `supported()` is false when this binary has no Cast module (a store build older
+  than the JS bundle: nothing touches the library then) or, on Android, when Google
+  Play services isn't available. Status comes from the `RemoteMediaClient` events,
+  with reads bounded to 1.5 s (an Android getter can hang).
+- **Web**: Google's Cast Web Sender (`cast_sender.js?loadCastFramework=1` from
+  `https://www.gstatic.com`), only on Chromium on an **https** page
+  (`webCastSupported`: a secure context, `location.protocol` `https:`, and a
+  Chromium brand; never Safari, Firefox or any iOS browser). A secure context alone
+  is not enough: on `http://localhost` the sender loads its framework from
+  scheme-relative URLs that become `http://`, which the CSP refuses (and a receiver
+  couldn't reach a localhost server anyway). It is loaded **lazily** the first time
+  the Cast button shows for a book it can cast (`ensureCastReady`, 15 s timeout),
+  never at startup and never for a button that can only explain a blocked book; a
+  failed load is kept for the page rather than retried. **One tab owns a session**: once
+  loaded, the sender joins any session this origin has, but only the tab that started
+  it follows it (a mark in that tab's `sessionStorage`); any
+  other tab leaves the session it was joined to without stopping the receiver, so two
+  tabs never drive one receiver. Since the sender loads only when the Cast button shows
+  for a loaded book, a reload mid-cast doesn't pick the cast up by itself: nothing is
+  joined until the listener starts a book, and that book is then handed to the
+  receiver at its own place, replacing what the receiver played (the web never adopts
+  the receiver's book). The server's web CSP admits
+  the sender's three scripts by path in `script-src`
+  ([Web UI](../server/web-ui.md#per-document-csp-htmlcsp)).
+
+## The Cast button
+
+`CastButton` (`cast-button.native.tsx`, `cast-button.web.tsx`; the rule is the pure
+`castButtonModel`, read through `useCastButton`) sits in the full player's action row
+and in the docked player (only when the dock has room for all its actions,
+`dockLayout`'s `allActions`). It shows only while a book is loaded, on a device that can cast, and when
+the playing book's server has `cast` (an older server, or flags not known yet: no
+button); while a session is connected it shows whatever the book, so a cast can
+always be stopped. Native renders the SDK's own `CastButton` in a 44 pt frame; the
+web draws our own, which opens Chrome's Cast chooser. When `castBlockReason` blocks
+the book, the button explains why instead (a toast) rather than casting. Strings are
+in the `cast` namespace.
+
+## What doesn't apply while casting
+
+- **Smart speed, Voice boost and auto-rewind**: `configure` keeps the config but the
+  receiver plays plain audio (they are the device engine's).
+- **Volume**: `setVolume` is a no-op. Its only caller is the sleep timer's fade, and
+  the receiver's volume is the TV's own, which a fade and its restore must never
+  touch. The sleep timer still **pauses** the cast (the sender drives it).
+- Skip lengths are the store's own and work as usual.
+
+## Native configuration (`plugins/withCast.js`)
+
+The library's own Expo config plugin with the app's options, plus one Android
+addition. Listed in `app.json` **before** `./plugins/withCarPlay`: mods of one kind
+run in reverse registration order, so withCarPlay's exact match still sees Expo's
+AppDelegate template and the Cast edits land after it (`withCast.test.ts` runs both,
+in that order, over the SDK 56 AppDelegate fixture).
+
+- `receiverAppId: 'CC1AD845'`, `expandedController: false` (the app's own full
+  player is the controller).
+- **iOS**: discovery starts on the first tap of the Cast button
+  (`iosStartDiscoveryAfterFirstTapOnCastButton`), so the local network prompt comes
+  when the listener asks to cast; sessions are suspended in the background
+  (`iosSuspendSessionsWhenBackgrounded`). `NSLocalNetworkUsageDescription` in
+  `app.json` names both uses: "AudioSilo uses your local network to reach your
+  AudioSilo server and to find Cast devices to play on." (localised in
+  `assets/locales`).
+- **Android**: `play-services-cast-framework` is **pinned** (`22.3.1`; the library's
+  default is `+`, a build that changes under us), and the library's expanded
+  controller activity is declared here (not exported), because the Cast notification
+  opens it and the plugin declares it only with `expandedController`, which would also
+  turn on iOS's automatic expanded controls.
+
+### The Android notification
+
+While a book casts, the app's Media3 engine is unloaded, so the **Cast SDK's own
+media notification and media session** are the lock screen's and the notification
+shade's controls for the cast (previous/next step by file when the receiver's queue
+has more than one item, a book in several files; a one-file book gets rewind/forward
+instead: the library's `GoogleCastOptionsProvider` shows the skip actions only when
+`getQueueItemCount() > 1`).
+Its foreground service also keeps the app alive, so the receiver's place keeps being
+saved.
+
+### iOS in the background
+
+iOS suspends an app that plays no audio itself, and the device's engine is unloaded
+while casting (a silent keep-alive wouldn't pass App Review). The TV keeps playing;
+the app saves the receiver's place as it leaves the foreground (`checkpoint`), and
+reads where the TV got to when it comes back (`refresh`).
+
+## Known limits
+
+- **Not yet tested on a real Cast device.** Every rule above is unit-tested, but
+  discovery, a session, seeks, the Android notification, the iOS background
+  behaviour and the web sender have not been run against a Cast device.
+- iOS: the sender is suspended in the background (above), and there are no iOS
+  lock-screen controls for a cast.
+- The receiver shows no chapter list.
+- The native SDK (v4) has no "jump to item": moving to another file reloads the queue
+  from there.
+- The docked player shows the Cast button only when it is wide enough for all its
+  actions; the full player always has it.
+
+## Testing
+
+`cast-media.test.ts` (the pure rules), `cast-token.test.ts`, `cast-prepare.test.ts`,
+`cast-service.test.ts`, `routed-service.test.ts`, `cast-session.test.ts`,
+`cast-store.test.ts`, `cast-button-model.test.ts`, `cast-button.test.tsx`,
+`driver.native.test.ts`, `driver.web.test.ts` (one tab owns a session),
+`sdk-shapes.test.ts` and `web-sender.test.ts` in `src/cast/`;
+`plugins/withCast.test.ts` for the config plugin. A device pass with a Cast device
+is still owed (above).
diff --git a/docs-developers/frontend/connect-and-addresses.md b/docs-developers/frontend/connect-and-addresses.md
index 07175b6..607bad3 100644
--- a/docs-developers/frontend/connect-and-addresses.md
+++ b/docs-developers/frontend/connect-and-addresses.md
@@ -26,8 +26,9 @@ route table is in the [overview](overview.md#route-map). Three steps, counted by
    Native offers **Scan a QR code** (`/connect/scan`, `expo-camera`); web offers **I have
    a pairing link** (pasted, parsed with `parsePairingScan`). A route `token` (a pairing
    link or QR, with `server` on native and `home`/`away` when the server sent them) is
-   exchanged at once. Remembered servers this device isn't signed in to
-   (`knownToOffer`, from `src/lib/known-servers.ts`) are one-tap "Reconnect to
+   exchanged at once. Remembered servers the person listening isn't signed in to
+   (`knownToOffer` over `useProfileConnections`, from `src/lib/known-servers.ts`; for
+   Add someone, `?profile=new`, every remembered server) are one-tap "Reconnect to
    &lt;name&gt;" rows; on native, one with a home address is asked who it is there first
    (`reconnectAddress` → `pickAddress`, the rule below), and a reconnect goes straight to
    sign-in unless the server runs a demo. **The served player** (`servedOrigin()` in
@@ -68,9 +69,13 @@ connection then shows `/connect/ready`; an added server goes straight back with
   addresses): keep its paired `serverUrl` (the reconnect banner signs in through the
   address in use now, which away from home is the away address);
 - a **reset server** (the banner's connection, reached through one of its own addresses,
-  answering with a new `server_id`): store the old connection's `serverUrl`, so the
-  session store retires the dead identity at that URL, and carry its addresses over
-  (the home address is probed against the new id before it is used);
+  answering with a new `server_id`): store the old connection's `serverUrl` and carry
+  its addresses over (the home address is probed against the new id before it is
+  used). `finishConnect` then retires only the **re-pairing person's own** dead identity
+  at that URL (`staleToRetire`, passed to `setSession` as `retire`: the banner's
+  person, else the person listening, nobody for Add someone), and the new connection
+  takes its place in their profile; other people's stay, flagged `server-reset`, for
+  them to sign in again ([Session](state-and-data.md#session-srcstoressessionts));
 - anything else: the address signed in through.
 
 `/connect` decides its "nothing to add" bounce (an authenticated user without `?add=1`, a
diff --git a/docs-developers/frontend/kids-mode.md b/docs-developers/frontend/kids-mode.md
new file mode 100644
index 0000000..471d978
--- /dev/null
+++ b/docs-developers/frontend/kids-mode.md
@@ -0,0 +1,123 @@
+---
+title: Kids mode
+description: "Kids mode (Phase 8): a property of a profile. The /kids route and its guard, which library and stories it shows, the kids player, the Grown-ups hold, and bedtime through the auto sleep controller."
+---
+
+Kids mode is a **property of a [profile](profiles.md)** (`Profile.kids`), set by an
+adult on the device in Settings > Household and sharing. The child's account is an
+ordinary server user whose library access the admin limited: the server's scopes
+(`GET /libraries`) are the truth, and the player never shows a child more than the
+account may open. There is no server change. The user-facing page is
+[Kids mode](/users/listening/kids-mode).
+
+```ts
+kids?: { library?: { connectionId: string; libraryId: number }; bedtime: string /* 'HH:MM', default '19:30' */ }
+```
+
+`setProfileKids(profileId, kids | undefined)` turns it on (an invalid bedtime reads as
+`DEFAULT_BEDTIME`) or off. Turning it on is refused when it would leave no grown-up on
+the device (`mayTurnOnKids`, which the Household pane also reads to disable the
+switch): leaving kids mode is a grown-up's job. `KidsLibraryPicker` offers the libraries the profile's
+connections list, named with their server when the profile has several; no pick means
+the first one listed.
+
+## The route and its guard
+
+Kids mode is the root route `/kids` (`src/app/kids.tsx`, no swipe-back), outside the
+tabs. A kids profile never gets the shell:
+
+- **`AuthGate`** renders none of the shell for a kids profile (no tabs, search,
+  settings, downloads page or web command palette) and holds the screen until it has
+  moved.
+- **`KidsRouteGuard`**, mounted once by the root layout so it covers the root routes
+  too, sends a kids profile to `/kids` from anywhere it may not be. `kidsAllowsPath`
+  allows only `/kids`, `/profiles` (leaving kids mode goes through it, PIN rules
+  included) and `/connect` (the child's own sign-in renewed, or "Add someone" when it is
+  allowed, below); the tabs, the full player,
+  the end credits, the year story and any deep link into them go back. It uses
+  `dismissTo('/kids')`, so a `/kids` already in the root stack is popped back to
+  rather than stacked twice.
+- On Android the back button does nothing on `/kids` while the shell sits under it;
+  with nothing under it, it leaves the app as usual.
+- **Nobody new signs in from kids mode** while a grown-up is on the device
+  (`mayAddPerson`, `src/components/profiles/connect-intent.ts`): `finishConnect` refuses
+  "Add someone", a new server and the demo ("Choose a grown-up before adding someone."),
+  and Who's listening? disables **Add someone** with that hint, so a child can't leave
+  kids mode through a new profile; they choose the grown-up first, PIN and all. A
+  re-pair of a connection the device has (the child's own sign-in renewed, through the
+  reconnect banner on the kids screen) keeps its person and is allowed. With no grown-up
+  left, Add someone stays open, the only way out. Nothing is added while the profiles
+  couldn't be read.
+
+## What it shows (`src/components/kids/`)
+
+`KidsScreen`: "Hi &lt;name&gt;" and the Grown-ups button, the bedtime card (`MoonCard`), the
+story playing now in `KidsPlayer`, and the stories as big cover tiles. Strings are in
+the `kids` namespace.
+
+The rules are pure in `kids-model.ts`, read through `useKidsStories()`:
+
+- **The connection** (`kidsConnectionId`): the picked library's connection while the
+  profile still holds it, else the profile's first.
+- **The library** (`kidsLibrary`): the pick when it is on that connection and still
+  listed by `GET /libraries`, else the first library listed, else none (the account
+  sees no library: an empty state says to ask a grown-up).
+- **The shelf** (`kidsShelf`): the books in progress, most recently played first, then
+  every other book of the library in the server's order, finished ones included.
+- **Offline** (`kidsDownloads`): when the server can't be reached, the finished
+  downloads of that connection, newest first, in the library `kidsOfflineLibraryId`
+  names: the one shown when known, else (`GET /libraries` unreadable) the profile's pick
+  on this connection, else every library, so the grown-ups' downloads of another library
+  on the same account don't show.
+
+The whole page is **one virtualised list** (`KidsStoriesList`, a FlashList with the
+greeting, the [reconnect banner](connect-and-addresses.md), the bedtime card and the
+player as its header), paging through the library as it scrolls. Loading, empty, error
+and offline states each have their own words. A tile starts its story with
+`startBookInPlace` on every layout (kids mode never opens the full player; the story
+already loaded only resumes), and the list scrolls back up to the player
+(`scrollToOffset`).
+
+**`KidsPlayer`** replaces the full player: cover, title, chapter and minutes left, a
+simple progress line through the chapter (no scrubbing; the view's one pink thing), and
+four big controls, previous chapter, back 30 s (`KIDS_BACK_SECONDS`), play/pause and
+next chapter. No speed, sleep, bookmarks, Up next or sharing. It is laid out by the
+measured width (`kidsPlayerLayout`): the cover beside the controls where both fit at
+the big sizes, the big controls under the cover where only they do, else the phone's
+sizes, never under the 64 pt kids minimum.
+
+**`GrownUpsButton`**: press and hold for `HOLD_MS` (2 s) to leave; while it is held the
+label says "Keep holding" and a fill grows, and letting go early empties it. With
+reduced motion there is no fill, and it still takes the full 2 s (the timer decides,
+not the animation). A screen reader gets the hint "Hold to leave kids mode" and the long-press
+action. Holding opens Who's listening?, where the chosen profile's PIN is asked.
+
+## Bedtime (`src/playback/auto-sleep-controller.ts`)
+
+Bedtime reuses the auto sleep controller, made profile-aware:
+
+- `isBedtime(bedtime, now)`: from the profile's bedtime until `KIDS_BEDTIME_UNTIL`
+  (06:00) local time, across midnight.
+- `effectiveAutoSleepConfig()` gives the rule that applies now, and `decideAutoSleep`
+  applies it as it does the setting, with the same session anti-nag memory: inside the
+  window, every story that starts or resumes arms a duration timer of
+  `KIDS_BEDTIME_MINUTES` (20) with the normal fade, unless a timer on that book was
+  cancelled this session.
+- While a kids profile is active, its bedtime rule **replaces** the device-wide auto
+  sleep setting (a grown-up's "end of chapter from 22:00" is not a child's bedtime), and
+  it is always on; the setting is untouched for everyone else. Switching to or from a
+  kids profile, or toggling kids mode, changes which rule applies.
+- Never in a car (`isCarConnected`), like the nightly timer.
+
+`MoonCard` shows "Bedtime is at 7:30 PM" (`formatTimeOfDay`, in the UI language's
+clock: "19:30" in the languages other than English) and what it does; inside the window, "It's
+bedtime" and either that the timer comes on when a story starts or the minutes the
+running timer has left.
+
+## Testing
+
+`kids-model.test.ts` (the rules above), `use-kids.test.tsx`, `kids-screen.test.tsx`,
+`kids-player.test.tsx`, `grown-ups-button.test.tsx`, `kids-route-guard.test.tsx` and
+`kids-gate.test.tsx` in `src/components/kids/`; the bedtime rule's regression tests in
+`src/playback/auto-sleep-controller.test.ts`. That a tapped story starts in place and
+never opens the full player is in `kids-screen.test.tsx`.
diff --git a/docs-developers/frontend/listening-in-the-house.md b/docs-developers/frontend/listening-in-the-house.md
new file mode 100644
index 0000000..26f984c
--- /dev/null
+++ b/docs-developers/frontend/listening-in-the-house.md
@@ -0,0 +1,125 @@
+---
+title: Listening in the house
+description: "The player side of Listening in the house: the household hooks and their polling rules, the pure house model, and the Home row, the book page's In the house card and the sharing switch in src/components/house/."
+---
+
+Listening in the house is an opt-in server feature (capability `household`): people
+on one server who choose to share see what the others who share are listening to.
+The server owns every privacy rule
+([what other people see](../server/auth-and-security.md#listening-in-the-house-what-other-people-see);
+the wire is in [the reference](../server/api/reference.md#listening-in-the-house)). The
+player only decides what to show of the answer, where, and how often to ask.
+
+## The wire and the hooks (`src/api/`)
+
+Types `HouseholdSettings`, `HouseListeningState`, `HouseListeningRow` and
+`HouseListening` in `types.ts`; `client.household(signal?)`,
+`client.setHousehold(share)` and `client.houseListening(signal?)` (which reads a
+missing `listening` as `[]`) in `client.ts`. The hooks in `hooks.ts`, each gated on
+`household` (`useCapabilityQuery` / `useCapabilityMutation`, so a server without the
+flag is never asked):
+
+- `useHousehold(cid?)` - the caller's own `{ share_listening }`, `qk.household(cid)`,
+  with `staleTime: Infinity`: it never goes stale by time, since this device only
+  changes it through `useSetHousehold` (which stores the server's answer). The
+  foreground refresh (`refreshAfterResume`) and a reconnect still refetch it, like
+  every active query, so a change made on another device shows the next time the app
+  (or the web tab) comes back to the foreground.
+- `useSetHousehold(cid?)` - the switch. Rejects with `CapabilityError` (sending
+  nothing) while the flag is off or unknown; never hand that to `noteError`. It stores
+  the server's answer under `qk.household(cid)` and invalidates
+  `qk.houseListening(cid)`, since a change of the caller's own choice opens or
+  empties the house (it is reciprocal). A demo account's `PUT` is a `403`.
+- `useHouseListening(cid?, { enabled })` - the house, `qk.houseListening(cid)`.
+  `enabled: false` sends no request at all.
+
+### When the house is asked
+
+Polling only; there is no realtime channel.
+
+- **Every minute while the app is in the foreground** (`HOUSE_POLL_MS`, 60 s).
+  `housePollInterval()` answers `false` unless `AppState` is `active`, so a suspended
+  or hidden native app asks nothing (React Query's own focus check covers a hidden
+  web tab); the foreground refresh reads it again on return, which restarts the
+  interval. `useCapabilityQuery` gained a `refetchInterval` option for this.
+- **Only while the listener shares.** `useHouseRows(cid, active)`
+  (`src/components/house/use-house-rows.ts`) asks `useHousehold` first and enables
+  `useHouseListening` only when `share_listening` is `true`: most listeners never
+  turn sharing on, and they never poll.
+- **Only while the surface is on screen.** `active` is `useIsFocused()` of the Home
+  screen or the book page, so a Home kept mounted under another tab stops asking.
+
+Loading, an error and "not sharing" all read as no rows: the house is an extra,
+never an empty section or an error banner.
+
+## The house model (`house-model.ts`)
+
+Pure and tested (`house-model.test.ts`):
+
+- `visibleRows(house, sharing)` - nothing while the caller doesn't share (a cached
+  answer can outlive turning sharing off), one row per person (the first, newest,
+  wins), in the server's newest-first order.
+- `rowsForBook(rows, libraryId, path)` - the housemates on one book (path is the
+  identity).
+- `houseWhen(row, today)` - `playing` and `paused` as the server says; for `recent`,
+  the **local calendar day** of the newest save, as of `today` (the local day's start
+  from `useToday()`, which ticks over just after midnight), worked out by hand (Hermes
+  has no `Intl.RelativeTimeFormat`): `today`, `yesterday`, or `earlier` for a clock
+  that disagrees with the server's 24 hours. A save in the future or one that doesn't
+  parse counts as today.
+- `chapterName(row, t)` - the chapter's title, else "Chapter N" from
+  `chapter_index` (a chapter titled "Track 01"), else nothing.
+- `houseCopy(row, today, t)` - the title (the server's, else the path's last segment),
+  the state line ("Listening now · Chapter 4") and one sentence for a screen reader
+  ("sam is listening to Unsouled, Chapter 4").
+- `houseCardWidth(width, layout)` and `HOUSE_GAP` - the Home grid (a `HOUSE_GRID`
+  spec for the shared `gridMetrics`): cards at least 250 wide, 12 apart, laid out by
+  the row's **measured** width (the Up next drawer can take part of the window), one
+  per row on a phone.
+
+Strings live in the `house` i18n namespace.
+
+## The components (`src/components/house/`)
+
+- **`HouseRow({ connections })`** - Home's "Listening in the house", placed after
+  "Next in your series" and before the smart shelves (`home-screen.tsx`). One
+  `HomeSection` per connection whose server has `household`, where the listener
+  shares and someone else who shares listened in the last day; it renders nothing
+  otherwise. The section's sub is "`<server name>` · shared by choice" and its action
+  "Sharing settings" opens Settings at the household pane
+  (`openSettings('household')`). Each `HouseCard` is the person's avatar and name (a
+  static green dot after the name while they are listening now), the book's title, the
+  state line and its cover; tapping it opens the book on that connection (`openBook`).
+- **`InTheHouseCard({ connectionId, libraryId, path })`** - the book page's "In the
+  house" card, last in the aside (`book-aside.tsx`): the housemates on **this** book,
+  each an avatar, the name and the state line, read from the same cached answer as
+  Home. Renders nothing when nobody is.
+- **`HouseSharingRow({ connectionId, first? })`** - "Share what I'm listening to with
+  the house" for one connection, with the privacy sentence "Your current book shows on
+  the Home page of other people on `<server>` who share theirs too. Off by default."
+  Hidden when the connection is gone; it does not check `household` itself (the
+  Household pane renders it only for servers that advertise the flag, below). The switch
+  moves at once (optimistic) and settles on the server's answer; a refusal puts it
+  back with a toast (a demo account gets its own words); while it loads or saves the
+  switch waits disabled, and a failed load offers Retry.
+- **The avatars** are `Portrait` with `kind="user"` (`src/components/series/portrait.tsx`):
+  a gradient disc with white initials, coloured from the name (the account page's own
+  portrait, so a person looks the same everywhere). Decorative: the name is always
+  written beside it or in the control's label. Pass `ring` (true or false) wherever the
+  pink "who is listening on this device" ring can show: the portrait then keeps
+  `RING_ROOM` (4 pt) around itself and draws the ring in it, so ringing one never moves
+  the layout. Leave `ring` out where no ring ever shows.
+
+**Whose connections.** Everything here is the person listening's: Home hands
+`HouseRow` the active profile's connections (`useProfileConnections`), and
+Settings > Household and sharing renders one `HouseSharingRow` per connection of the
+active profile whose server has `household`, under a "Listening in the house" heading
+(a note when none of them offers it, once every server has answered). See
+[Profiles](profiles.md#visible-and-background-connections).
+
+## Testing
+
+`house-model.test.ts` (the rules above), `house-row.test.tsx`,
+`in-the-house-card.test.tsx` and `house-sharing-row.test.tsx` beside the components;
+the avatar and its ring in `src/components/series/portrait.test.tsx`; the hooks' gating and polling in
+`src/api/hooks-household.test.tsx`; the client calls in `client.test.ts`.
diff --git a/docs-developers/frontend/native-integrations.md b/docs-developers/frontend/native-integrations.md
index abfb8a6..7f0e1ea 100644
--- a/docs-developers/frontend/native-integrations.md
+++ b/docs-developers/frontend/native-integrations.md
@@ -13,9 +13,10 @@ device, the DHU or the Simulator is under [Testing](testing.md#native-checks).
 
 **Status.** Android Auto ships in every build (listing it through Google Play has a step of
 its own: [Releasing](../contributing/releasing.md#the-app-store-track-ios--android)).
-CarPlay's code ships too, but iOS connects a
-CarPlay scene only in a build prebuilt with `AUDIOSILO_CARPLAY=1` (the entitlement Apple has
-to grant; [below](#the-uiscene-life-cycle-pluginswithcarplayjs)). A store build with the
+CarPlay ships too and is on by default: the
+`com.apple.developer.carplay-audio` entitlement (granted by Apple on 2026-10-09; both App IDs
+carry the capability) is added at prebuild unless `AUDIOSILO_CARPLAY=0`
+([below](#the-uiscene-life-cycle-pluginswithcarplayjs)). A store build with the
 widgets and the Live Activity needs the App Group and the extension provisioned first
 ([below](#widgets-and-the-live-activity-ios)). Which store release has each of these is on
 the users' [Availability](/users/listening/mobile-apps#availability).
@@ -44,23 +45,34 @@ protection), so a car shows its lists at once, before or without JS.
 
 `car-model.ts` builds it, pure (`buildCarSnapshot`):
 
+- Every tab is built from the **person listening's** connections only
+  ([Profiles](profiles.md#visible-and-background-connections)), the
+  Downloads tab included (no play spec is written for another person's book), and
+  none while nobody is chosen. The snapshot is rebuilt when the active profile
+  changes. A play request (`handleCarPlayRequest`) and the Android service-book
+  adoption quietly refuse another person's book, or any book while nobody is chosen
+  (an item of an older snapshot); a connection no profile holds still plays (a
+  CarPlay launch before the session could be read).
 - `version: 1`, `generatedAt`, `signedIn`, the localized `labels` (`carLabels(t)`, the
   `car.*` keys: `continue`, `chapters`, `bookmark`, `bookmarkSaved`, `empty`, `signedOut`,
   `unavailable`) and up to four `tabs`, each carrying its own localized `title`:
-  - `continue` - Home's rule (`isInProgress`, newest first, every signed-in server), the
+  - `continue` - Home's rule (`isInProgress`, newest first, every server of the person listening), the
     loaded book first (`continueRefs`), at most 20;
   - `upnext` - the queue the app's Up next shows (`queueConnectionId`: the loaded book's
     connection, else the default, else the first; see
     [Overview](overview.md#up-next-drawer-and-sheet)), left out when that server has no
     `queue` capability, at most 20;
-  - `downloads` - every downloaded book, newest download first, at most 50;
+  - `downloads` - the person listening's downloaded books, newest download first, at most 50;
   - `library` - the library the Library tab shows (`resolveLibrarySelection`, as in
     [State and data](state-and-data.md#library-selection-srcstoreslibrary-selectionts)),
     `sort: 'recent'`, at most 50 (`CAR_TAB_LIMITS`; Android Auto doesn't page, and
     CarPlay trims further to its own `maximumItemCount`).
 - Each `CarItem` has an `id` (`carItemId(ref)`: `book:` plus the URI-encoded connection id,
   library id and path joined by `:`; path is the identity, scoped by connection, never a
-  database id; `parseCarItemId` reverses it), the `book` itself (a `BookRef`, so native compares
+  database id; `parseCarItemId` reverses it, mapping a connection id from before the
+  [identity migration](state-and-data.md#connection-identity-server_iduser_id) to its new
+  one through `resolveConnectionId`, so an item of a snapshot written by an older build
+  still plays), the `book` itself (a `BookRef`, so native compares
   its fields instead of decoding the id), `title`, `subtitle` (the author, then the time
   left at the book's own speed once started), `progress` (0..1 or null), `finished`,
   `downloaded`, `artwork` and, **only for a downloaded book**, a `play` spec.
@@ -226,8 +238,9 @@ On the JS side, `index.ts` (the `package.json` `main`) imports
 `AudiosiloCar` with `AppRegistry.registerHeadlessTask` (the task's code loads only when it
 runs); elsewhere the file is empty. `runCarTask` (`car-task.ts`) runs
 `bootstrapPlayback()` (the root layout's launch steps as one memoised run: storage
-migration, the downloads wipe after a reset, hydrating session, settings, downloads, series
-orderings and library selection, and the listener's language for the snapshot's labels),
+migration, the connection identity migration included, the downloads wipe after a reset,
+hydrating session, settings, downloads, series orderings, library selection and profiles,
+and the listener's language for the snapshot's labels),
 starts the two app-lifetime controllers the root layout would (address routing, so a server
 paired at home is reached through its away address from the car, and the place reconcile;
 both shared starts), starts the car sync, and resolves once **no car is connected** and the
@@ -272,10 +285,10 @@ and starts React Native in `didFinishLaunching`, so the config plugin:
    screen). Mods of one kind run in reverse registration order, so no plugin that rewrites
    the AppDelegate may be listed after it (that plugin's edit would run first and break the
    match);
-3. adds `com.apple.developer.carplay-audio` to the entitlements **only with
-   `AUDIOSILO_CARPLAY=1`** at prebuild. A device build carrying it can't be signed unless Apple
-   has granted the entitlement; without it iOS never connects a CarPlay scene, while the scene
-   code always ships.
+3. adds `com.apple.developer.carplay-audio` to the entitlements **by default**.
+   `AUDIOSILO_CARPLAY=0` at prebuild leaves it out, for a signing identity without the grant (a
+   build carrying it can't be signed without one); without the entitlement iOS never connects a
+   CarPlay scene, while the scene code always ships.
 
 `AudiosiloScenes` starts React Native in whichever scene connects first: the phone scene into
 its own window, with launch options rebuilt from `connectionOptions` (the cold-start pairing
diff --git a/docs-developers/frontend/offline.md b/docs-developers/frontend/offline.md
index b28bdb7..e2f55bd 100644
--- a/docs-developers/frontend/offline.md
+++ b/docs-developers/frontend/offline.md
@@ -431,6 +431,17 @@ just plans nothing this time.
 `src/components/downloads/downloads-screen.tsx` (the `/downloads` route
 re-exports it) renders what the pure `src/downloads/downloads-view.ts` returns:
 
+- `visibleDownloads` - only the **person listening's** downloads (the active
+  profile's connections, [Profiles](profiles.md#visible-and-background-connections)).
+  The device keeps everyone's, and they keep playing for their owner; the car's
+  Downloads tab and kids mode's offline stories read them the same way.
+- `orphanDownloads` - downloads **no connection in the session** holds (every
+  person's connections count), left by a connection that went without its purge (a
+  token that couldn't be read, an identity the key migration couldn't move). Nothing
+  else would ever list them, so their room would be taken for good: the page lists
+  them under **Not signed in**, newest first, with Remove only; signing in to that
+  account again shows them in their place. Only once the session was read (before
+  that, or after a failed read, every download would look orphaned).
 - `splitDownloads` - **In progress** (running, then waiting in the order asked, then
   failed) and **Ready offline** (newest first); `groupByServer` groups the ready ones
   in connection order (unknown connections last).
diff --git a/docs-developers/frontend/overview.md b/docs-developers/frontend/overview.md
index 4331666..6536196 100644
--- a/docs-developers/frontend/overview.md
+++ b/docs-developers/frontend/overview.md
@@ -60,12 +60,18 @@ src/components/     ui/ (the Stacks primitives - Text, Icon, Button, Card, Input
                     Journal and its export), you/ (the You hub; stats/, year/),
                     settings/ (the Settings panes), account/ (a server's Account
                     page), connect/ (onboarding), home/, search/, upnext/, downloads/
-                    (the Downloads tab), brand/
+                    (the Downloads tab), house/ (Listening in the house), profiles/
+                    (Who's listening?, the PIN dialog, Settings > Household), kids/
+                    (kids mode), brand/
 src/car/            CarPlay + Android Auto, the JS side: the car snapshot (car-model),
                     car covers, the car controller, the AudiosiloCar headless task
+src/cast/           Chromecast: the route switch (routed-service), the cast engine
+                    (cast-service), cast tokens, the native and web drivers, the
+                    Cast button (see Chromecast)
 src/widgets/        iOS widget + sleep timer Live Activity ('widget' functions) and
                     their sync (widget-model, widget-sync.ios)
-src/stores/         Zustand: session (connections + tokens), settings, search
+src/stores/         Zustand: session (connections + tokens), profiles (people on this
+                    device), settings, search
                     (+ recent searches), series-orderings, library-selection
 src/i18n/           i18next init, LanguageProvider, locale catalogs (locales/*.json)
 src/theme/          tokens.json (the colour source) -> generated tokens.ts,
@@ -75,11 +81,13 @@ src/lib/            storage, secure-store, paths, format, hhmm (wall-clock "HH:M
                     ticker (one start/stop interval), pairing, known-servers, device,
                     base-url, layout (the three form factors), utils (cn),
                     storage-migration (the one launch-time storage migration),
+                    connection-id + identity-migration (connection ids,
+                    <server_id>.<user_id>, and their one-time key migration),
                     bootstrap (the launch steps, shared with the car task),
                     register-sw, and other pure helpers
 modules/audiosilo-player/  the local Expo module (Swift + Kotlin + TS bridge)
-plugins/            config plugins (CarPlay scenes, the Xcode 26 and widget fixes);
-                    withCarPlay and withWidgetsNoPush have jest tests
+plugins/            config plugins (CarPlay scenes, Cast, the Xcode 26 and widget
+                    fixes); withCarPlay, withCast and withWidgetsNoPush have jest tests
 index.ts            the app entry (package.json main): registers the car's headless
                     task, then expo-router/entry
 public/             sw.js (service worker) + manifest.json (PWA), copied verbatim
@@ -119,36 +127,38 @@ URLs, so every URL below is the same as before the groups existed.
 
 | Route | File | Purpose |
 |---|---|---|
-| - (root layout) | `src/app/_layout.tsx` | Mounts the provider tree (`GestureHandlerRootView` → `SafeAreaProvider` → `RootInsetsProvider` → `LanguageProvider` → `ThemeProvider` → `ApiProvider`), runs the launch steps through `bootstrapPlayback()` (`src/lib/bootstrap.ts`, one memoised run shared with the car's headless task: the memoised launch migration `migrateStorage()` (`src/lib/storage-migration.ts`: the theme default, then `resetStaleStorage`), the downloads wipe after a reset, then hydrating the session/settings/downloads/series-orderings/library-selection stores; see [Native integrations](native-integrations.md#booting-js-without-an-activity)), imports `@/lib/register-sw` for its side effect, mounts the headless `BookEndedListener` (drives the end-of-book flow, see [The end of a book](end-of-book.md#ending-a-book)), `CompanionRevealListener` (the "New in Who's who" toast, see [Player UI](player-ui.md#the-companion-companion)) and `ShakeToExtendListener`, starts the framework-free `startAutoSleep()` controller (arms the nightly sleep timer, see [The sleep timer](sleep-timer.md#auto-sleep-timer-auto-sleepts--auto-sleep-controllerts)), `startDriftWatch()` (the Fell asleep bookmark and the jump back, see [The sleep timer](sleep-timer.md#fell-asleep-drift-controllerts)), `startJumpUndo()` (see [Player UI](player-ui.md#undo-a-jump-jump-undots)), `startKeepAhead()` (downloads the next books when the listener opted in, see [Offline](offline.md#keep-the-next-books-ready-keep-aheadts--keep-ahead-controllerts)), `startAddressRouting()` (native only: picks each server's home or away address, see [Connect and home/away addresses](connect-and-addresses.md#the-runner-srcapiaddress-runnerts)), `startPlaceReconcile()` (a loaded book picks up a newer place from another device, see [Playback](playback.md#picking-up-another-devices-place-place-reconcilets)), `startChapterRefresh()` (a downloaded book takes its server's changed chapters, see [Offline](offline.md#lifecycle)), `startWidgetSync()` (iOS only: the widget and the sleep timer Live Activity, see [Native integrations](native-integrations.md#widgets-and-the-live-activity-ios)) and `startCarSync()` (CarPlay and Android Auto, never stopped, see [Native integrations](native-integrations.md#the-car-snapshot-srccar)), and runs `useAppResume` (foreground refresh + the Android swipe-from-recents reset). Declares the `(app)` stack (the root stack's `anchor`, so it always sits at the bottom) and the `player`/`finished`/`year` screens as `fullScreenModal`s. Mounts `<PortalHost />` and `<ShellToastHost />` **last**, inside the providers, so portaled overlays and toasts stack above every screen (see [toasts](#toasts)). |
+| - (root layout) | `src/app/_layout.tsx` | Mounts the provider tree (`GestureHandlerRootView` → `SafeAreaProvider` → `RootInsetsProvider` → `LanguageProvider` → `ThemeProvider` → `ApiProvider`), runs the launch steps through `bootstrapPlayback()` (`src/lib/bootstrap.ts`, one memoised run shared with the car's headless task: the memoised launch migration `migrateStorage()` (`src/lib/storage-migration.ts`: the theme default, `resetStaleStorage`, then the connection identity migration, see [State and data](state-and-data.md#connection-identity-server_iduser_id)), the downloads wipe after a reset, then hydrating the session/settings/downloads/series-orderings/library-selection/profiles stores; see [Native integrations](native-integrations.md#booting-js-without-an-activity)), imports `@/lib/register-sw` for its side effect, mounts the headless `BookEndedListener` (drives the end-of-book flow, see [The end of a book](end-of-book.md#ending-a-book)), `CompanionRevealListener` (the "New in Who's who" toast, see [Player UI](player-ui.md#the-companion-companion)) and `ShakeToExtendListener`, starts the framework-free `startAutoSleep()` controller (arms the nightly sleep timer, see [The sleep timer](sleep-timer.md#auto-sleep-timer-auto-sleepts--auto-sleep-controllerts)), `startDriftWatch()` (the Fell asleep bookmark and the jump back, see [The sleep timer](sleep-timer.md#fell-asleep-drift-controllerts)), `startJumpUndo()` (see [Player UI](player-ui.md#undo-a-jump-jump-undots)), `startKeepAhead()` (downloads the next books when the listener opted in, see [Offline](offline.md#keep-the-next-books-ready-keep-aheadts--keep-ahead-controllerts)), `startAddressRouting()` (native only: picks each server's home or away address, see [Connect and home/away addresses](connect-and-addresses.md#the-runner-srcapiaddress-runnerts)), `startPlaceReconcile()` (a loaded book picks up a newer place from another device, see [Playback](playback.md#picking-up-another-devices-place-place-reconcilets)), `startChapterRefresh()` (a downloaded book takes its server's changed chapters, see [Offline](offline.md#lifecycle)), `startWidgetSync()` (iOS only: the widget and the sleep timer Live Activity, see [Native integrations](native-integrations.md#widgets-and-the-live-activity-ios)) `startCarSync()` (CarPlay and Android Auto, never stopped, see [Native integrations](native-integrations.md#the-car-snapshot-srccar)) and `startCastSync()` (Cast sessions switch the player's route, see [Chromecast](chromecast.md)), mounts `KidsRouteGuard` (a kids profile stays on `/kids`, see [Kids mode](kids-mode.md#the-route-and-its-guard)), and runs `useAppResume` (foreground refresh + the Android swipe-from-recents reset). Declares the `(app)` stack (the root stack's `anchor`, so it always sits at the bottom), the `player`/`finished`/`year` screens as `fullScreenModal`s, and `profiles` as one with `gestureEnabled: false`. Mounts `<PortalHost />` and `<ShellToastHost />` **last**, inside the providers, so portaled overlays and toasts stack above every screen (see [toasts](#toasts)). |
 | - (incoming app links, native) | `src/app/+native-intent.tsx` | Expo Router's `redirectSystemPath`: an `audiosilo://` link (the pairing link, the iOS widget and Live Activity) becomes a plain path before routing, so its query keeps its encoding (`appLinkPath`, `src/lib/native-intent.ts`; see [Native integrations](native-integrations.md#widgets-and-the-live-activity-ios)). |
 | - (web HTML shell) | `src/app/+html.tsx` | The static HTML wrapper for every exported web route: PWA manifest/favicon links (base-prefixed), the CSS cascade-layer order, and a backdrop in the OS colour scheme's background (light, or dark under `prefers-color-scheme: dark`) painted before React mounts so there is no flash. |
 | `(app)` layout, native | `src/app/(app)/_layout.tsx` | `AuthGate` (`src/components/shell/auth-gate.tsx`: `loading` → spinner, `unauthenticated` → `<Redirect href="/connect" />`; also backfills `has_password`/`has_recovery` on sessions persisted before those flags existed), then **`NativeTabs`** with one trigger per destination (SF Symbols on iOS, Material Symbols on Android) and, on iOS 26, the mini player as the tab bar's `BottomAccessory`. On tablet/desktop the native tab bar is `hidden` and the shell's own top bar, sub-nav and docked player take over; `ShellFrame` (`shell-frame.tsx`) draws that chrome around the navigator in both `(app)` layouts. On a phone without the iOS 26 accessory it also renders the one `FloatingMiniPlayer` as the frame's `phoneBottom`, over NativeTabs. |
 | `(app)` layout, web | `src/app/(app)/_layout.web.tsx` | `AuthGate`, then **headless `expo-router/ui` `Tabs`** over the same route groups: a hidden `TabList` registers the five tab routes, one `<TabSlot />` renders the page, and `ShellFrame` surrounds it with our chrome (phone: `MiniPlayer`, sitting on the tab bar through a `100%` bottom offset, + `PhoneTabBar`; tablet/desktop: top bar, sub-nav, banners, `DockedPlayer`). Also mounts the web-only `CommandPalette` and its keyboard shortcut (`usePaletteShortcut`). |
 | tab stacks | `(app)/(home,library,search,offline,me)/_layout.tsx` | ONE layout file that becomes each tab's `Stack`. Its group-keyed `unstable_settings` (`TAB_STACK_SETTINGS`) give each stack its root route; `screenListeners` is `tabStackListeners`. On a phone each page's Stack `header` is `PhoneHeader`; tablet/desktop hide it. |
 | - (browser tab title, web) | `src/components/shell/document-title{,.web}.tsx`, `src/lib/use-page-title{,.web}.ts`, `src/lib/document-title.ts` | Expo Router turns React Navigation's document-title sync off, so the app names the tab itself. A pushed page or root modal calls `usePageTitle(title)` (a no-op on native; `undefined` while its data loads), which claims the title while the screen is **focused**, so Back names the page under it again. `DocumentTitle`, mounted once in the root layout, is the only writer of `document.title`: `▶ <book> · AudioSilo` while a book plays, else `<page> · AudioSilo`, else the active tab's name. `StaticDocumentTitle` puts `AudioSilo` in the exported HTML (a `<title>` in `+html.tsx` would sit behind Expo's own). A new page calls `usePageTitle` too. |
-| `/` | `(app)/(home)/index.tsx` → `src/components/home/home-screen.tsx` | Home, aggregated **across every connected server**: the greeting and sync pill, the Now card, This week (`user_stats`), Continue listening, Next in your series (`next_book`), smart shelves, Recently added, Favourites, Recently finished. The rules are `home-model.ts` (which book leads, the shelves, the `/next` candidates) and `listening.ts` (streak, bars and pace in **server** time); see [Home](state-and-data.md#home). |
+| `/` | `(app)/(home)/index.tsx` → `src/components/home/home-screen.tsx` | Home, aggregated across **the person listening's** servers (`useProfileConnections`; the `use*All` hooks read `useApis()`, the active profile's connections, see [Profiles](profiles.md#visible-and-background-connections)): the greeting and sync pill, the Now card, This week (`user_stats`), Continue listening, Next in your series (`next_book`), Listening in the house (`HouseRow`, see [Listening in the house](listening-in-the-house.md)), smart shelves, Recently added, Favourites, Recently finished. The rules are `home-model.ts` (which book leads, the shelves, the `/next` candidates) and `listening.ts` (streak, bars and pace in **server** time); see [Home](state-and-data.md#home). |
 | `/browse?type=recent\|finished` | `(app)/(home,library,search,offline,me)/browse.tsx` → `src/components/library/books/see-all-screen.tsx` | The "See all" cover grid behind Home's Recently finished shelf (Recently added's See all opens the Library's Books mode with `sort=recent` instead). |
-| `/search` | `(app)/(search)/search.tsx` → `src/components/search/search-screen.tsx` | Search across all connections: books (de-duplicated), series, people and met characters, in groups with their own loading/error states (`useSearch`, shared with the palette; see [Search](state-and-data.md#search-and-the-spoiler-model)). Empty, it shows the recent searches and Browse cards. The query lives in `useSearchStore`, so it survives the screen remounting. On a **native tablet** the top bar's search field jumps here and bumps the store's `focusRequest`, which re-keys the input so it takes focus; on web the same field opens the [command palette](#command-palette-web) instead. Leaving the Search tab clears the query (`useShellEffects`). |
+| `/search` | `(app)/(search)/search.tsx` → `src/components/search/search-screen.tsx` | Search across the person listening's connections: books (de-duplicated), series, people and met characters, in groups with their own loading/error states (`useSearch`, shared with the palette; see [Search](state-and-data.md#search-and-the-spoiler-model)). Empty, it shows the recent searches and Browse cards. The query lives in `useSearchStore`, so it survives the screen remounting. On a **native tablet** the top bar's search field jumps here and bumps the store's `focusRequest`, which re-keys the input so it takes focus; on web the same field opens the [command palette](#command-palette-web) instead. Leaving the Search tab clears the query (`useShellEffects`). |
 | `/library?mode=…` | `(app)/(library)/library/index.tsx` → `src/components/library/library-screen.tsx` | The Library tab root: the browse modes `books` (absent = books), `authors`, `series`, `narrators`, `collections`, `folders` - see [The Library modes](#the-library-modes). Books mode also reads `sort` (`recent\|title\|author\|length`), `status` (`new\|progress\|finished`), `dl=1` and `len` (`short\|mid\|long`), which Home's links set. |
 | `/series?connection=…&library=…&name=…&work=…` | `(app)/(home,library,search,offline,me)/series.tsx` → `src/components/library/series-screen.tsx` | The series bookcase. `name` is a **local** series (the exact `Book.series` value, the `series=` filter of `GET /books`); `work` is a community work id whose rails to show (how a series the listener owns nothing of is reached). At least one; with both, `name` lists the owned books and `work` supplies the reading orders and ghosts. |
 | `/author?connection=…&library=…&name=…`, `/narrator?…` | `author.tsx` / `narrator.tsx` (same group) → `src/components/library/person-screen.tsx` | A person page: the books whose `Book.author` / `Book.narrator` is **exactly** `name` (a joint credit is one name, as the server lists it), series shelves, other books, Read by / Books by chips. A narrator filter needs `browse_people`; an older server shows a "can't list books by narrator yet" state. |
 | `/collection?connection=…&id=…` | `collection.tsx` (same group) → `src/components/library/collection-screen.tsx` | A collection (per server, not per library: its items can span libraries). Owner: Edit, Share, Delete, Move up / Move down / Remove in the list view; viewer (`owned: false`): Leave. A `404` reads as deleted or no longer shared. |
-| `/library/favourites` | `(app)/(home,library,search,offline,me)/library/favourites.tsx` → `src/components/library/collections/favourites-screen.tsx` | The hearted books (cover grid) and folders of every server. |
+| `/library/favourites` | `(app)/(home,library,search,offline,me)/library/favourites.tsx` → `src/components/library/collections/favourites-screen.tsx` | The hearted books (cover grid) and folders of every server of the person listening. |
 | `/library/[libraryId]?connection=…&path=…` | `(app)/(home,library,search,offline,me)/library/[libraryId].tsx` | Library browse, root and nested folders alike - a two-line re-export of `src/components/library/browse-screen.tsx`. Content routes are **flat**: the connection id and the library-relative folder `path` ride as query params, never as nested route segments (an in-app `router.push` cannot resolve a route nested under a dynamic layout segment - it lands on the group's first child; rationale and helpers in `src/lib/paths.ts`). Each content screen scopes itself to its own `?connection=` with `<ContentScope>`, and the content hooks read that scope via `useScopedCid()`. |
 | `/book/[libraryId]?connection=…&path=…&tab=…` | `(app)/(home,library,search,offline,me)/book/[libraryId].tsx` → `src/components/book/book-page.tsx` | The book page, opened on `tab` when that tab exists (`parseBookTab`): see [The book page](book-page.md). |
 | `/downloads` | `(app)/(offline)/downloads.tsx` → `src/components/downloads/downloads-screen.tsx` | The Downloads page: storage per server, the automatic-download rules (including keep-ahead), in-progress and failed downloads, and the books ready offline by server ([Offline](offline.md#the-downloads-page)). The group is `(offline)`, not `(downloads)`, on purpose - see [cold deep links](#the-shell-tabs-and-navigation). |
 | `/you?section=stats\|year\|journal\|settings\|account` | `(app)/(me)/you.tsx` → `src/components/you/you-hub.tsx` | The root of the **Me** tab, the **You** hub: Your listening, Year in listening, the Journal, Settings and Account on a phone (a scrolling segmented control); Stats, Year in listening and Journal in the sub-nav on tablet/desktop (Settings is the gear, Account the profile menu). `section` and the Journal's `tab` are its `rootParams`. See [You, Settings and Account](you-and-settings.md#the-hub-and-its-routes). |
 | `/settings?section=…` | `(app)/(home,library,search,offline,me)/settings.tsx` → `src/components/settings/settings-content.tsx` | Every app setting, each in one pane (Listening, App, Servers groups), pushed on the current tab by the gear, the profile menu and the palette (`openSettings`). The phone hub's Settings section renders the same `SettingsContent`. See [Settings](you-and-settings.md#settings-srccomponentssettings). |
-| `/journal?tab=diary\|bookmarks\|notes` | `(app)/(home,library,search,offline,me)/journal.tsx` → `src/components/journal/journal-screen.tsx` | The Journal, on every signed-in server, for links made before the hub; entry points open the hub's Journal section (`openJournal`). See [The Journal](journal.md). |
+| `/journal?tab=diary\|bookmarks\|notes` | `(app)/(home,library,search,offline,me)/journal.tsx` → `src/components/journal/journal-screen.tsx` | The Journal, on every server of the person listening, for links made before the hub; entry points open the hub's Journal section (`openJournal`). See [The Journal](journal.md). |
 | `/account?connection=…` | `(app)/(home,library,search,offline,me)/account.tsx` → `src/components/account/account-section.tsx` | One server's account (`AccountSection`): password, pairing another device, the At home and away card, signed-in devices, personal API keys and sign-out, each gated on its capability, with a breadcrumb back to Settings or the You section it was opened from (`accountParentKey`; from anywhere else the chrome's own Back). Reached from Settings' Accounts and devices pane and the profile menu; the phone hub's Account section renders the same body for the default server. See [Account](you-and-settings.md#account-srccomponentsaccount). |
 | `/player` | `src/app/player.tsx` | The full player ([Player UI](player-ui.md#the-full-player)), presented as a full-screen modal above the tabs on every form factor (opened from the mini player, the iOS accessory player, the docked player bar, or a phone's Listen button). Accepts `libraryId`/`path` (+ optional `position`/`track`) params and gates playback start on the chapters query settling. |
 | `/finished` | `src/app/finished.tsx` | The end-credits screen shown when a book finishes (or from the player's menu). A root modal sibling of the player; `connection`/`libraryId`/`path` params, plus `auto=1` when the book ended (or was marked finished) rather than being opened early. Renders `EndCredits`: the year shelf, listening stats, a rating, and the book `resolveUpNext` says plays next. See [The end of a book](end-of-book.md#ending-a-book). |
 | `/year?year=…&connection=…&card=…` | `src/app/year.tsx` → `src/components/you/year/year-story-screen.tsx` | The phone's full-screen Year in listening story, a root modal like the player (`yearHref`): close, pull down, Escape on the web. See [Year in listening](you-and-settings.md#year-in-listening-srccomponentsyouyear). |
 | `/connect` layout | `src/app/connect/_layout.tsx` | Onboarding stack (a spinner while the session hydrates). It deliberately does not decide redirects: on a link arriving while the app runs, the child's params only reach the layout after the child mounts. |
-| `/connect` | `connect/index.tsx` → `src/components/connect/connect-start.tsx` | The first onboarding step: the server address with its probe ("Found &lt;name&gt;", Sign in, Try the demo), Scan a QR code (native) or a pasted pairing link (web), a pairing `token` arriving by deep link or QR `web_url` exchanged at once, and one-tap **Reconnect** rows for remembered servers this device isn't signed in to (`src/lib/known-servers.ts`). An **authenticated** user is bounced home from here, from this route's own params, unless they are adding another server (`?add=1`, a pairing `?token=`, or a sign-in mid-flow via `pendingServerUrl`); decided when it opens and when it is back on top. Onboarding returns to the app through `leaveOnboarding()` (`src/components/shell/leave-onboarding.tsx`, which calls `router.dismissTo('/')`; `<LeaveOnboarding />` when the decision is made at render time), never `replace` or `<Redirect href="/">` (also a replace): `(app)` already sits under `/connect` as the root stack's anchor, so a replace stacked a second `(app)`. See [Connect and home/away addresses](connect-and-addresses.md#connect-and-onboarding). |
+| `/connect` | `connect/index.tsx` → `src/components/connect/connect-start.tsx` | The first onboarding step: the server address with its probe ("Found &lt;name&gt;", Sign in, Try the demo), Scan a QR code (native) or a pasted pairing link (web), a pairing `token` arriving by deep link or QR `web_url` exchanged at once, and one-tap **Reconnect** rows for remembered servers the person listening isn't signed in to (`knownToOffer` over `useProfileConnections`; for Add someone, `?profile=new`, every remembered server) (`src/lib/known-servers.ts`). An **authenticated** user is bounced home from here, from this route's own params, unless they are adding another server (`?add=1`, a pairing `?token=`, or a sign-in mid-flow via `pendingServerUrl`); decided when it opens and when it is back on top. Onboarding returns to the app through `leaveOnboarding()` (`src/components/shell/leave-onboarding.tsx`, which calls `router.dismissTo('/')`; `<LeaveOnboarding />` when the decision is made at render time), never `replace` or `<Redirect href="/">` (also a replace): `(app)` already sits under `/connect` as the root stack's anchor, so a replace stacked a second `(app)`. See [Connect and home/away addresses](connect-and-addresses.md#connect-and-onboarding). |
 | `/connect/scan` | `connect/scan.tsx` | Camera QR scanner (`expo-camera`) for the pairing QR. |
 | `/connect/sign-in` | `connect/sign-in.tsx` → `src/components/connect/sign-in-step.tsx` | Invite code **or** username and password against the pending server (`pendingServerUrl`, read once). Reached from the first step, a **Reconnect** row, or the dead-token `ReconnectBanner` (`src/components/layout/reconnect-banner.tsx`, which passes `reconnect=<cid>` and the address in use now). The code field redeems invite codes (legacy recovery codes still redeem server-side, but the app no longer mints them). Every sign-in ends in `finishConnect`. |
 | `/connect/ready?connection=…` | `connect/ready.tsx` → `src/components/connect/ready-screen.tsx` | "Your library is ready.", after the device's **first** connection only (no swipe back to the spent sign-in). |
+| `/profiles` | `src/app/profiles.tsx` → `src/components/profiles/profiles-screen.tsx` | Who's listening?: a root full-screen modal with no swipe-back (`ProfilesScreen`); see [Profiles](profiles.md#whos-listening-profiles). |
+| `/kids` | `src/app/kids.tsx` → `src/components/kids/kids-screen.tsx` | Kids mode, a root route outside the tabs with no swipe-back (`KidsScreen`); `KidsRouteGuard` keeps a kids profile here; see [Kids mode](kids-mode.md). |
 | `/demo` | `src/app/demo.tsx` | Public demo landing: mints a throwaway session on a demo-mode server and shows the pairing QR so the same demo user opens on a phone. |
 
 ## The shell: tabs and navigation
@@ -314,8 +324,11 @@ the book that starts from it and the finished book leave it through `dropFromQue
 ### Profile menu
 
 `ProfileMenu` (`src/components/shell/profile-menu.tsx`) is the top bar's profile
-button (the user's initial, plus the name on desktop) and a `DropdownMenu`: every
-connected server with its state - the pure `serverStatus()`
+button (the person listening's initial, plus their name on desktop) and a `DropdownMenu`:
+"Listening as" the active [profile](profiles.md), an item per other person on the device
+(their name, with "Switch to &lt;name&gt;" as its accessibility label; through
+`useChooseProfile`, PIN included) and **Who's listening?** (`openProfiles()`); every
+server of the person listening with its state - the pure `serverStatus()`
 (`src/api/reachability.ts`), where "needs signing in again" (the reconnect flag)
 wins over "offline", else "Signed in as &lt;user&gt;" - each opening that server's account screen; **Add a server**
 (`/connect?add=1`; hidden, as in Settings' accounts pane, when the served web player is signed in only to its own server, `onlyOwnServer(servedOrigin(), ...)`); **Journal** (`openJournal()`); **Settings** (`openSettings()`); **Account on &lt;default server&gt;**; and a light/dark
diff --git a/docs-developers/frontend/playback.md b/docs-developers/frontend/playback.md
index fa3b255..52d8c4e 100644
--- a/docs-developers/frontend/playback.md
+++ b/docs-developers/frontend/playback.md
@@ -70,7 +70,11 @@ identically.
 
 Metro resolves the implementation per platform: `service.web.ts` on web,
 `service.native.ts` on iOS/Android. `service.ts` is a **throwing fallback that
-exists only so `tsc` can resolve the import** - it is never executed.
+exists only so `tsc` can resolve the import** - it is never executed. Both
+`createPlaybackService()`s return their engine wrapped in the Cast route switch
+(`routed`, `src/cast/routed-service.ts`), which hands playback to a Cast receiver
+while a session is connected and back after it, behind the same interface: see
+[Chromecast](chromecast.md#casting-is-a-playback-route-not-a-second-player).
 
 ### Web engine (`service.web.ts`)
 
diff --git a/docs-developers/frontend/player-ui.md b/docs-developers/frontend/player-ui.md
index 59ae88c..f3421f8 100644
--- a/docs-developers/frontend/player-ui.md
+++ b/docs-developers/frontend/player-ui.md
@@ -37,7 +37,8 @@ timer have their own pages ([End of a book](end-of-book.md),
   `TransportControls size="sm"` over the dock's `ChapterScrubber`, which takes the
   playing book's `bookmarks` and draws their ticks in the segment
   (`usePlayingSegment`); and on the right the `UndoChip`, speed, sleep, bookmark,
-  output (only when `canRoutePick`), Up next and expand. What fits is decided by
+  output (only when `canRoutePick`), Cast (`CastButton`, only when the bar has room for
+  all its actions; see [Chromecast](chromecast.md#the-cast-button)), Up next and expand. What fits is decided by
   the bar's **measured** width (`dockLayout`), not the window class; everything it
   drops is in the full player. While the Undo chip shows (`useUndoVisible`), its
   measured width comes off first and the right cluster stops growing, so the book
diff --git a/docs-developers/frontend/profiles.md b/docs-developers/frontend/profiles.md
new file mode 100644
index 0000000..4f55662
--- /dev/null
+++ b/docs-developers/frontend/profiles.md
@@ -0,0 +1,247 @@
+---
+title: Profiles
+description: "Profiles (Phase 8): a person on this device as a group of connections. The profiles store and document, the consistency rules, visible versus background connections, switching and the play rule, Who's listening?, the device-local PIN, links to another person's book, and Settings > Household."
+---
+
+A **profile is a person on this device**: a device-local group of connections, at
+most **one connection per server** (`serverIdOf`). Each connection is already one
+user on one server ([Connection identity](state-and-data.md#connection-identity-server_iduser_id)),
+so every person keeps their own place in every book, queue, bookmarks and stats on
+the server; the profile only says which of the device's connections belong to whom,
+so the screens show one person's at a time. Nothing about profiles is sent to a
+server: there is no wire change.
+
+The user-facing side is
+[Sharing a device with your household](/users/listening/profiles) and
+[Kids mode](/users/listening/kids-mode); kids mode's code is
+[its own page](kids-mode.md).
+
+## The store (`src/stores/profiles.ts`)
+
+One persisted document, `audiosilo.profiles`, hydrated in `bootstrapPlayback()`:
+
+```ts
+interface Profile {
+  id: string;              // local, random (a UUID); never sent anywhere
+  name: string;            // defaults to a connection's username; editable here
+  connectionIds: string[]; // at most one per server
+  kids?: { library?: { connectionId: string; libraryId: number }; bedtime: string /* 'HH:MM' */ };
+  hasPin?: boolean;        // mirrors the secure store; the hash lives there
+}
+interface ProfilesDoc {
+  version: 1;
+  profiles: Profile[];
+  activeProfileId: string | null;
+  askAtLaunch: boolean;    // "Ask who's listening when the app opens"
+}
+```
+
+**The first document** (`initialProfiles`) is written by the
+[identity migration](state-and-data.md#connection-identity-server_iduser_id), in the
+same `setMany` as its re-keyed documents (an existing document is only re-keyed). It
+puts every connection in one profile, except that a profile holds at most one
+connection per server: a second user on a server (signed in before the migration ran)
+gets a profile of their own. Each profile is named after its first connection's user
+(the one holding the default connection after the default connection's user), the
+profile holding the default connection is active, and `askAtLaunch` is off. When
+the document is missing on an install with connections (the migration aborted, or an
+install from before profiles signed in again), the store builds it from the session's
+connections with the same rule.
+
+**Reading it.** A read that **fails** is never taken as a missing document (reconciling
+an empty one would replace every profile: new ids, no PIN, no kids settings). The store
+tries the read up to `HYDRATE_ATTEMPTS` (5) times in all, a second apart (`hydrationFailed`
+while it does), then stops holding the launch (`giveUpOnRead`), decided once the session has
+settled:
+
+- **Someone is signed in**: they may have a PIN or a kids profile this run can't know,
+  so the store stays `hydrationFailed` (nothing of anyone shows or plays, nobody new
+  signs in) and reads again whenever the app comes to the front.
+- **Nobody is** (the web with site data blocked, where the session couldn't read its
+  list either): the store runs `unread`, in memory only, and never writes over the
+  stored document; whoever signs in now gets a profile of their own.
+
+Only a document that **reads but doesn't parse** counts as missing (waiting can't fix
+it) and is rebuilt from the session. A parsed document is validated
+(`parseProfilesDoc`): an `activeProfileId` naming nobody reads as `null`, never as the
+first person (that person may have a PIN, and nobody gave it).
+
+Reads: `useActiveProfile()`, `useProfileConnections()` (the active profile's
+connections, in session order), and the framework-free `activeProfile()`,
+`profileOf(connectionId)`, `profileConnections()` and `profileConnectionIds()`.
+Changes: `switchProfile`, `renameProfile`, `setProfileKids`, `setProfileHasPin`,
+`setAskAtLaunch`, `deleteProfile`, `placeConnection`.
+
+### Consistency with the session
+
+`reconcileProfiles` keeps the document consistent with the session's connections. It
+runs on every change of the session's list once the session has **settled** (never
+while it is loading or its hydrate failed, when an empty list doesn't mean empty), and
+on `onConnectionRemoved`:
+
+1. Ids the session no longer has leave their profiles.
+2. A profile keeps one connection per server.
+3. A profile with no connections is deleted (its PIN with it).
+4. An unplaced connection goes into the active profile when it has no connection to
+   that server, else the first profile without one, else a profile of its own (not
+   made active: nobody chose to switch).
+5. When the active profile is gone and others are left, **nobody** is active
+   (`mustChoose`). A second profile appearing turns `askAtLaunch` on.
+
+A connection the connect flow just signed in is placed by `placeConnection` instead:
+into the active profile, unless that profile already has a connection to this server
+(another user there is another person) or the flow was **Add someone**
+(`/connect?add=1&profile=new`); then into a new profile, which becomes active. A
+re-pair keeps the person it had, and "Add someone" signing in as a person already on
+the device switches to them.
+
+### Visible and background connections
+
+The rule that keeps one person's state from leaking into another's view without
+breaking their background work:
+
+- **Every list a person sees uses the active profile's connections**
+  (`useProfileConnections`, `profileConnections`, and the cross-connection hooks'
+  `useApis()`): Home, the Library and its picker, Search and the command palette, the
+  Downloads page, Up next, You (stats, Year, Journal), Settings and the profile menu,
+  [Listening in the house](listening-in-the-house.md), the car snapshot and the
+  widget. Never `useSession((s) => s.connections)` for a list someone sees.
+- **Background work keeps using every connection**: the offline save queue, the
+  downloads engine, car bookmarks waiting to be sent, address routing, reachability. A
+  switch must never make another person's queued saves unroutable (the queue flush
+  drops unroutable groups).
+- **While nobody is chosen** (`mustChoose`), the visible set is empty: the auth gate
+  holds the shell, every person-facing list is empty, the car lists nothing, the
+  widget clears, and a link to anyone's book meets the gate below. With no profiles at
+  all (not hydrated yet, or nobody signed in) every connection is visible, as before
+  profiles.
+
+## Switching, and the play rule
+
+`switchProfile(id)` (the caller has asked for the PIN):
+
+- **The play rule**: a book that belongs to a connection outside the new profile is
+  stopped (paused, its place saved by the store's normal persist, unloaded), so the
+  next person finds no mini player with someone else's book. A book of the new
+  person's own plays on.
+- The session's default connection moves to the new profile's first unless it is
+  already one of theirs.
+- The car snapshot is rebuilt and the iOS widget clears; both follow
+  `activeProfileId`.
+- The UI then resets every tab to its root and goes Home (or `/kids` for a kids
+  profile).
+
+**Who may start a book** is one rule, `mayActFor(connectionId)`, and the **playback
+store** enforces it at every start (`playBook`, `startBookInPlace`, `adoptLoaded`), so it
+covers the player route, a car play request, the Android service's book adoption and a
+resumed Cast session alike: never another person's book (playing it would save to their
+account without their PIN), never any book while nobody is chosen (an item of an older
+snapshot). A connection no profile holds still plays (a CarPlay launch before the
+session could be read). While the store's read failed (`hydrationFailed`) nothing plays;
+while it runs `unread`, only the connections of the people who signed in this run.
+Screens never decide this themselves: they only offer the switch (`OtherPersonGate`,
+below). See also [Native integrations](native-integrations.md#the-car-snapshot-srccar).
+
+## Who's listening? (`/profiles`)
+
+A full-screen root route (`src/app/profiles.tsx`, no swipe-back) rendering
+`ProfilesScreen` (`src/components/profiles/`): every person as a large avatar
+(`Portrait` with `kind="user"`, the active one ringed) with a one-line status (kids mode and its
+bedtime, else "Listening now" for the active person, else their servers), and **Add
+someone**. Choosing the active person goes back; choosing someone with a PIN asks for
+it; anyone else is switched to. Strings are in the `profiles` i18n namespace.
+
+- **Ways in**: the profile menu (tablet and desktop top bar), the Me tab's "Listening
+  as" card on a phone, Settings > Household and sharing, and leaving kids mode.
+- **At a cold launch** the auth gate opens it once per launch when there are two or
+  more people and `askAtLaunch` is on.
+- **Forced** while someone must be chosen (`mustChoose`): the gate opens it, and it has
+  no Close and ignores Android's back. The shell is never mounted for a moment as the
+  wrong person: the gate also waits for the profiles to hydrate.
+- `useChooseProfile()` is the one way to choose someone (the picker, the profile menu,
+  the Household pane, the gate below); `openProfiles()` the one way in.
+
+## The PIN (`src/lib/profile-pin.ts`)
+
+Optional, device-local, off by default, 4 digits (`PIN_LENGTH`). Asked when switching
+**into** a profile that has one, and so when leaving kids mode. Changing or removing
+one asks for the current PIN; removing the **person** never does (the way out of a
+forgotten PIN). It keeps a person's place from a sibling's taps, not from an attacker:
+anyone with the device and a browser's developer tools can read a session token anyway.
+
+- **Storage**: only a salted, iterated hash, in the secure store under
+  `audiosilo.profilePin.<profileId>` as JSON `{ v: 1, salt, iterations, hash }`. `salt`
+  is 16 random bytes; `hash` is SHA-256 over salt + PIN, then over salt + the previous
+  digest, **10,000** digests in all (`PIN_ITERATIONS`), compared in constant time. The
+  profile mirrors `hasPin`, so screens know without reading the secure store.
+- **The secure store decides whenever it can be read** (`readPin` first, in
+  `useChooseProfile` and the Household pane's **Set a PIN**): the mirror is written best
+  effort with the whole profiles document, which a failed write or a second web tab
+  holding an older document can leave behind. A stored hash the mirror lost still asks
+  (and repairs the mirror); a mirror whose hash is gone (an install restored without its
+  secure store) counts as no PIN and is cleared when someone switches to that person.
+  **When the secure store can't be read, the mirror decides**: a person marked as having
+  a PIN is still asked (the prompt says it couldn't check), a person not marked is
+  switched to without one, and **Set a PIN** goes straight to choosing a new one. **Set a
+  PIN** over a hash the secure store can read asks for the current one first. The pane's
+  **Change** and **Remove** are offered from the mirror alone and check against the
+  secure store, so with the hash gone no PIN matches there ("That PIN doesn't match")
+  until a switch to that person, or removing them, clears the mirror.
+- **SHA-256 in plain JS** (`src/lib/sha256.ts`, synchronous, checked against the
+  standard's vectors): 10,000 rounds through `expo-crypto` would be 10,000 asynchronous
+  native calls, and on the web `crypto.subtle` exists only in a secure context, so a
+  player served over plain HTTP on the LAN would have none. The salt comes from
+  `expo-crypto`'s random bytes.
+- **Wrong tries**: `PinDialog` shakes the field and says "That PIN doesn't match" (with
+  reduced motion only the words); the fifth wrong try in a row (`PIN_MAX_TRIES`) makes it
+  wait 30 s (`PIN_LOCK_MS`), counted per profile in memory, so closing the prompt doesn't
+  reset it (a relaunch does).
+- A deleted profile takes its PIN hash with it when its mirror says it has one (best
+  effort; a leftover hash names a profile id nothing uses again).
+
+## Links to another person's book
+
+Every route that carries `?connection=` (the widget, the Live Activity, web history, a
+shared link) follows one rule, `useRouteConnection(connection)`
+(`src/components/layout/content-scope.tsx`): the content screens through `ContentScope`,
+and the root modals outside any scope (the player, the end credits, the Year in
+listening story, the connect flow's ready page) directly. It reads the param through
+`connectionParam` (an old id resolves) and returns the gate to show instead of the
+screen:
+
+- a connection of **another person** on this device gets `OtherPersonGate`: "This
+  belongs to &lt;name&gt;", with **Switch to &lt;name&gt;** (their PIN rules apply; after the switch
+  the page opens where it is) and **Go back**;
+- an **unknown** connection, one this device isn't signed in to (a stale link to a
+  removed server or a removed person's book), gets the not-found state "Not signed in to
+  that server" with a way back, never the page and never a redirect (a redirect inside a
+  tab stack fired again on every focus of the tab).
+
+The gate only offers the switch; refusing the play itself is the playback store's job
+(`mayActFor`, [above](#switching-and-the-play-rule)).
+
+## Settings > Household and sharing
+
+`HouseholdPane` (`src/components/profiles/household-pane.tsx`), the App group's
+`household` pane: a card per person (switch, rename, PIN set/change/remove, kids mode
+with `KidsLibraryPicker` and the bedtime, **Remove from this device**), **Who's
+listening?** and **Add someone**, the **Ask who's listening when the app opens**
+switch, and the per-server house sharing switches
+([Listening in the house](listening-in-the-house.md)).
+
+**Remove from this device** (`useRemovePerson`) signs the device out of each of the
+person's servers through the same sign-out as an Account page (their book stops with
+its place saved, queued saves land, the token is revoked, their downloads here go),
+then drops their PIN and profile. It warns first where they have no password on a
+server (they would need a new invite). Removing the person listening leaves nobody
+chosen.
+
+## Testing
+
+`src/stores/profiles.test.ts` (parsing, `reconcileProfiles`, placement, `mustChoose`,
+switching), `src/lib/profile-pin.test.ts`, `sha256.test.ts`, `random.test.ts`, and in
+`src/components/profiles/`: `profiles-model.test.ts`, `profiles-screen.test.tsx`,
+`pin-dialog.test.tsx`, `household-pane.test.tsx`; the gate in
+`src/components/shell/auth-gate.test.tsx` and the menu in `profile-menu.test.tsx`; the
+"no screen lists another person's servers" checks beside each screen that reads
+connections.
diff --git a/docs-developers/frontend/sleep-timer.md b/docs-developers/frontend/sleep-timer.md
index a5a0c13..424a4d8 100644
--- a/docs-developers/frontend/sleep-timer.md
+++ b/docs-developers/frontend/sleep-timer.md
@@ -382,8 +382,11 @@ jump back; it never invents one.
 The nightly auto-arm is split into a pure decision function and a framework-free
 controller, so all the policy is unit-tested and none of it lives in a component.
 
-- **`decideAutoSleep(input)`** takes the four `autoSleep*` settings, `now`, the
-  `bookKey` and the per-book memory, and returns
+- **`decideAutoSleep(input)`** takes the rule that applies (`AutoSleepConfig`:
+  `enabled`, `from`, `until`, `type`; the controller's `effectiveAutoSleepConfig()`
+  passes the four `autoSleep*` settings, or a kids profile's bedtime rule while one is
+  active, see [Kids mode](kids-mode.md#bedtime-srcplaybackauto-sleep-controllerts)),
+  `now`, the `bookKey` and the per-book memory, and returns
   `{arm:'none'} | {arm:'chapter'} | {arm:'duration', minutes}`. It bails when the
   feature is off, when the memory says this book is blocked (`canAutoSleepArm`),
   and when the clock is outside the window. A persisted `autoSleepType` that isn't
@@ -439,9 +442,11 @@ controller, so all the policy is unit-tested and none of it lives in a component
   context rather than as long as a mounted component. It must run whether or not the
   player modal is open: the timer has to arm for a book started from the mini player,
   the library, or a lock-screen play.
-  It listens to three things: the **setting** (which attaches and detaches everything
-  else - `autoSleepTimer` defaults to off, and the player subscription would otherwise
-  run on every progress write for a feature nobody switched on); the **player**, for
+  It listens to four things: the **setting** and the **profiles** store (together they
+  decide whether any rule is on, `autoSleepOn()`, which attaches and detaches everything
+  else - `autoSleepTimer` defaults to off, a kids profile's bedtime is always on, and
+  the player subscription would otherwise run on every progress write for a feature
+  nobody switched on); the **player**, for
   the transition edge into `playing` (one look per resume, not one per progress tick);
   and **`onSleepTimerEnded`**, which is installed for the whole session because a
   cancellation counts even if auto sleep is enabled later. The 60s poll
diff --git a/docs-developers/frontend/state-and-data.md b/docs-developers/frontend/state-and-data.md
index aa98576..d0838d5 100644
--- a/docs-developers/frontend/state-and-data.md
+++ b/docs-developers/frontend/state-and-data.md
@@ -128,7 +128,9 @@ Patterns to copy when adding an endpoint:
 once. `ApiProvider` builds an `ApiClient` per connection (memoized on the
 connection list, so switching the active server doesn't recreate clients) and
 exposes them via `useApi(connectionId?)` (active by default, throws if none),
-`useOptionalApi`, and `useApis` (all of them). The `use*All` hooks
+`useOptionalApi`, and `useApis` (the person listening's: the active profile's
+connections, none while someone must be chosen; see
+[Profiles](profiles.md#visible-and-background-connections)). The `use*All` hooks
 (`useLibrariesAll`, `useSearchAll`, `useRecentAll`, `useFavouritesAll`,
 `useAllProgressAll`, `useBookCopies`) fan out with `useQueries` + `combine`,
 tag results with their connection, and de-duplicate books via `src/lib/dedup.ts`
@@ -256,6 +258,8 @@ Cross-server screens ask per connection (`useCapabilitiesAll` /
 | `user_stats` (You) | Your listening (`StatsSection`: `useMyListening('1y')`, `useMyStats('year')`, the goal hooks) and Year in listening (`useYearStory`: `useMyStats(range)`, past years probed by `useStoryYears`); see [You, Settings and Account](you-and-settings.md) |
 | `my_devices` | the Account page's signed-in devices and the identity card's device count (`useMyDevices`, `useRevokeMyDevice`, never on the current device) |
 | `addresses` | the Account page's At home and away card (`useServerAddresses`) and the native address runner's refresh (`addressesQuery`); see [Connect and home/away addresses](connect-and-addresses.md#home-and-away-addresses) |
+| `household` | Home's Listening in the house row, the book page's In the house card and the sharing switch (`useHousehold`, `useSetHousehold`, `useHouseListening`); see [Listening in the house](listening-in-the-house.md) |
+| `cast` | the Cast button and `prepareCast` (no flag, or flags not known yet: no button, and a cast is refused); see [Chromecast](chromecast.md) |
 
 Writes from screens follow the [1b write rules](#the-listeners-own-state-player-redesign-phase-1b)
 (positioned adds, exact-path removes): Up next's drag/keys and a collection's Move
@@ -603,7 +607,7 @@ is shared by the Search screen and the palette. Each group carries its own
 `GroupState` (`supported`, `isLoading`, `isError`, `retry`), so a failing group never
 hides the others:
 
-- **Books**: `useSearchAll` across every connection, de-duplicated (`src/lib/dedup.ts`),
+- **Books**: `useSearchAll` across the person listening's connections, de-duplicated (`src/lib/dedup.ts`),
   "Also on" for the other servers.
 - **Series and people** (`usePeopleSources`): every library's `seriesList`,
   `authors` and `narrators` lists on every `browse_people` server (sharing the
@@ -635,9 +639,11 @@ book that hasn't reached it. The counted remainder is the `hidden` number behind
 
 ### Session (`src/stores/session.ts`)
 
-Multi-connection: a `Connection` is `{ id, serverUrl, name, token, user,
-needsReconnect?, addresses? }`. The `id` is the server-minted `server_id`, so it keys
-every per-server store. `serverUrl` is the address the listener paired with or typed,
+Multi-connection: a `Connection` is `{ id, serverId?, serverUrl, name, token, user,
+needsReconnect?, addresses? }`, **one user signed in to one server**. The `id` is the
+connection id, `<server_id>.<user_id>` ([below](#connection-identity-server_iduser_id)),
+so it keys every per-connection store; `serverId` is the server's `server_id`, read
+through `serverIdOf(conn)`. `serverUrl` is the address the listener paired with or typed,
 never rewritten; `addresses` is the server's home and away addresses (capability
 `addresses`), and which one requests go to right now is an in-memory pick, never stored
 (see [Connect and home/away addresses](connect-and-addresses.md#home-and-away-addresses)).
@@ -646,13 +652,30 @@ Connection **metadata** persists to AsyncStorage (`audiosilo.connections` +
 connection's **token** lives in secure-store under `audiosilo.token.<id>` - tokens are
 stripped before the metadata is persisted. `hydrate()` restores the connections whose
 token is still there (it runs after the launch reset, below, so it never reads
-wrongly-keyed records). `setSession` refuses an empty `server_id`, then adds or updates
-**by `server_id`** (re-pairing the same server at another URL updates its connection
-instead of adding one), merges the addresses it is given with what the device knew
-(`mergeAddresses`), makes it the default, remembers the server durably without its
-token (`src/lib/known-servers.ts`, the connect screen's Reconnect rows), and drops any
-**other** connection at the same URL: a rebuilt server mints a new `server_id` at the
-same address, so that one is a dead identity, whose token and scoped state go.
+wrongly-keyed records), filling `serverId` on a connection persisted before it
+existed. `setSession({ serverId, user, ... })` refuses an empty `server_id`, then adds
+or updates **by server and user**: the prior connection is the one with
+`serverIdOf(c) === serverId` and the same `user.id` (a legacy one saved without a
+usable user id counts as this user, since it was the server's one connection), so
+re-pairing the same account at another URL updates its connection instead of adding
+one, while **another user on the same server is another connection**. A prior
+connection keeps its id (a legacy id stays until the key migration moves it, so its
+downloads and saves stay reachable); a new one gets `connectionIdOf(serverId,
+user.id)`, and `setSession` returns the id it used. It merges the addresses it is
+given with what the device knew (the prior connection's, else another user's
+connection to the same server, else the remembered server's; `mergeAddresses`), makes
+it the default, remembers the server durably without its token
+(`src/lib/known-servers.ts`, the connect screen's Reconnect rows, keyed by `server_id`
+with no user). A connection at the same URL **whose `server_id` differs**
+(`staleIdentities`: a rebuilt server mints a new `server_id` at the same address) is a
+dead identity, but only the ones named in `retire` go, with their token and scoped
+state: `finishConnect` names the **re-pairing person's own** (`staleToRetire`: the
+profile holding the reconnect banner's connection, else the person listening; nobody's
+for **Add someone**), and the new connection takes the retired one's place in that
+person's profile (`onConnectionReplaced`). Every other stale identity is another
+person's: it stays, flagged `needsReconnect: 'server-reset'`, for them to sign in again
+(dropping it would delete their profile, PIN and kids settings). A different user is
+never a reason to drop one.
 `learnAddresses` merges a `GET /addresses` answer into a connection's addresses
 (`mergeAddresses`, so a known `home` survives; the address runner calls it). `removeConnection` (and `logout`,
 which removes the active one) deletes its token **and purges the connection's
@@ -680,6 +703,104 @@ retries every `LOCKED_RETRY_MS` (5 s) and when the app comes to the front. Any o
 is surfaced as `unauthenticated` (never stuck on `loading`) and retried on the next
 foreground.
 
+### Connection identity: `<server_id>.<user_id>`
+
+A connection is one user on one server, so its id is `connectionIdOf(serverId,
+userId)` = `<server_id>.<user_id>` (`src/lib/connection-id.ts`): two people signed in
+to the same server on one device are two connections, each with its own token,
+downloads, progress and query cache. The server's `server_id` is base64url
+(`[A-Za-z0-9_-]`, never `.`) and `user.id` a positive integer, so the `.` is an
+unambiguous separator, and the id stays inside expo-secure-store's key alphabet
+(`audiosilo.token.<id>`, `[\w.-]`), a file name and a URL path segment. It never holds
+`:` (`contentKey` joins on it, and is unchanged: `${connectionId}:${libraryId}:${path}`),
+`/`, `%`, `#` or `?`.
+
+Before the player redesign's Phase 8 the id was the bare `server_id`, a **legacy** id
+(`isLegacyConnectionId`). A legacy connection keeps working everywhere, forever: one
+the migration can't move (no usable `user.id`) or hasn't moved yet (a locked keychain)
+keeps its id. So:
+
+- **Compare servers only through `serverIdOf(conn)`** (its `serverId`, else what the
+  id says), never `conn.id`: the server-reset check (a `/server` answer whose
+  `server_id` differs, `serverResetCid`), the home-address probe and pick, the connect
+  flow's repair and Reconnect rows, `learnAddresses` (which remembers addresses under
+  the server's id).
+- `parseConnectionId(id)` gives `{ serverId, userId? }` and `usableUserId(user)` the
+  user id an id can carry; never split an id by hand.
+
+**The one-time key migration** (`migrateConnectionIdentity`,
+`src/lib/identity-migration.ts`) moves every legacy connection to its new id without
+signing anyone out. `migrateStorage()` runs it after `resetStaleStorage` and before any
+store hydrates or any lazy reader runs. Until the plan is stored, a crash, a locked
+keychain or a failed write leaves the legacy data usable and the run waits for the next
+launch. Once the plan is stored the run only goes **forward**: `migrateStorage()` runs
+it up to `RECOVERY_ATTEMPTS` (5) times in all, a second apart, with every reader held, so no store
+ever sees half-moved documents. When it still fails it gives up for this launch and sets
+`identityMovePending()`: the downloads store and the offline queue's replay keep what
+names an id no connection has yet instead of pruning it as gone, and a later launch
+finishes the plan.
+
+1. **Read and plan** `{ legacyId: newId }` for each legacy connection with a usable
+   `user.id` whose new id no other connection already has (plus the plan a run cut
+   short left, `audiosilo.identityPlan`). Nothing moves while the Android playback
+   service holds a book of a connection being moved (its tracks are files under the
+   old download folder); when the service doesn't answer within 3 s, the run waits for
+   a later launch.
+2. **Tokens first.** Copy each `audiosilo.token.<old>` to `audiosilo.token.<new>` and
+   read it back. Any failure, a locked keychain included (a CarPlay launch with the
+   phone locked), aborts with nothing else changed. Old tokens are never deleted here,
+   and a copy is never undone.
+3. **Record the plan, then move the files**: native `downloads/<old>` to
+   `downloads/<new>` (`engine.native`'s `moveConnection`). Moves are idempotent and
+   **never reversed** (a retry can't tell which moves an earlier process made, and the
+   documents may already name the new ids); a failure keeps the plan and the next try
+   goes on from there. The web moves **no** files: `engine.web` has no `moveConnection`
+   and keeps a moved connection's Cache API entries under the legacy id
+   (`/_offline/<legacyId>/`), which the registry's new ids reach through the aliases
+   (`legacyIdOf`).
+4. **Rewrite every document naming a connection id in one `setMany`**: the
+   connections (new `id`, `serverId` added), the default connection, the downloads
+   registry (keys and each `connectionId`), the progress mirror (keys and values) and
+   queue, `offlineServers`, the car bookmarks waiting to be sent, the library
+   selection, Smart speed's time saved, the drift-offs, plus the aliases and the first
+   profiles document. A failed write (iOS and the web write key by key) keeps the plan,
+   and the next try finishes it. `audiosilo.carSnapshotWritten` is removed, so the next car snapshot is built fresh
+   (even offline).
+5. **Mark it done**: `audiosilo.identityVersion` = `2`.
+6. **Delete the old tokens, then the plan**, best effort. A plan still stored (the app was
+   killed first, or its removal failed) is replayed by a later launch, which deletes the old
+   tokens again; a token delete that fails while the plan's removal succeeds is not
+   retried, so that old copy stays in the secure store.
+
+Every rewrite maps ids through the stored plan, so it is idempotent: a run cut short
+mid-write (`setMany` is not atomic on iOS or the web) is finished by the next one with
+the same plan. A legacy list written back after the mark (a web tab still running the
+old code) is moved by the next launch the same way. A new document keyed by a
+connection id must be added to `ID_DOCUMENTS` or it is left behind. In-memory state
+(scroll memory, the React Query cache) needs no migration.
+
+The same `setMany` writes the **first profiles document** (`audiosilo.profiles`); how
+it groups the connections is on [Profiles](profiles.md#the-store-srcstoresprofilests).
+
+**Aliases.** The migration records `{ [old]: new }` under `audiosilo.connectionAliases`.
+Every launch loads them into memory with the migration's own first read
+(`migrateConnectionIdentity`, together with the landed moves of a run cut short);
+`bootstrapPlayback` reads them itself (`loadConnectionAliases`) only when that read
+failed.
+`resolveConnectionId(id)` maps an old id to its new one (else returns it) at every
+entry point JS can't rewrite first: a route's `?connection=` (`connectionParam`: web
+history, widget and Live Activity deep links), a car item id from an old snapshot
+(`parseCarItemId`), the book the Android service loaded (`getLoadedBook`,
+`adoptLoaded`), bookmarks the service queued (`onRemoteBookmark`,
+`consumePendingBookmarks`), the iOS widget's last props, and `resolveClient` as a
+safety net.
+
+**Why `AUTH_STORAGE_VERSION` is never bumped for it.** Bumping the auth axis wipes
+every connection and token, signing everyone out (below). That was right for v2, when
+the old ids could not be re-keyed; the Phase 8 ids can, so the migration re-keys them
+instead and nobody re-pairs. Bump the auth axis only for an identity change that
+genuinely can't be migrated.
+
 ### Settings (`src/stores/settings.ts`)
 
 Playback tunables persisted as one JSON blob (`audiosilo.settings`):
@@ -818,13 +939,17 @@ The offline-safe write path for listening progress:
   (`src/stores/session.ts`), which reconciles storage along two independent version
   axes. The **auth** axis (`audiosilo.storageVersion`, now `2`) wipes the connections,
   their tokens, the pre-multi-server single-session keys and, with them, the scoped
-  cache; bump it only when the connection identity scheme itself changes, because it
-  signs everyone out. The **cache** axis (`audiosilo.cacheVersion`) wipes only the
+  cache; bump it only for a connection identity change that can't be migrated, because
+  it signs everyone out (one that can be re-keyed gets a key migration instead, as Phase
+  8's did: [Connection identity](#connection-identity-server_iduser_id)). The **cache** axis (`audiosilo.cacheVersion`) wipes only the
   scoped cache (`audiosilo.downloads`, `audiosilo.progressMirror`,
   `audiosilo.progressQueue`, `audiosilo.offlineServers`) and keeps every login: it is
   the knob for any change to how that cache is keyed (a pre-split install adopts the
   version without a wipe). Either reset makes `bootstrapPlayback` wipe the on-disk
-  downloads too. An `onConnectionRemoved` handler drops a removed connection's mirror
+  downloads too. After both axes, the same `migrateStorage()` run moves legacy
+  connection ids to `<server_id>.<user_id>`
+  ([Connection identity](#connection-identity-server_iduser_id)), keeping every login.
+  An `onConnectionRemoved` handler drops a removed connection's mirror
   records and queued saves.
 
 :::note No realtime sync
diff --git a/docs-developers/frontend/testing.md b/docs-developers/frontend/testing.md
index 0f8b9d8..6d283ac 100644
--- a/docs-developers/frontend/testing.md
+++ b/docs-developers/frontend/testing.md
@@ -323,7 +323,12 @@ Co-located suites exist for:
 | Playback | `src/playback/book-queue.test.ts`, `progress-sync.test.ts`, `store.test.ts`, `service.web.test.ts`, `sleep-timer.test.ts`, `auto-sleep.test.ts`, `auto-sleep-controller.test.ts`, `rate.test.ts`, `next-book.test.ts`, `prettify-title.test.ts`, `types.test.ts`, `transcode.test.ts` (the web negotiation rules), `up-next-resolver.test.ts` (what plays next), `up-next-sources.test.ts`, `jump-undo.test.ts`, `time-left.test.ts`, `drift.test.ts`, `drift-controller.test.ts`, `last-interaction.test.ts`, `use-shake-to-extend.test.ts` (the burst detector and sensitivity tunings), `place-reconcile.test.ts` (a loaded book picks up another device's place), `engine-ticks.test.ts` (`engineTicker`), `service.native.test.ts` (the native bridge: the newer events, `load`'s `book` only on a binary that takes it), `store-adopt.test.ts` (`adoptLoaded`: no engine reload, saves under the adopted book, the floor is the adopted place), `effects.test.ts` (where Smart speed and Voice boost apply), `time-saved.test.ts`, `book-source.test.ts` (where a book plays and resumes from), `store-race.test.ts` (the bridge created once however many callers race; a remote move while a book loads is ignored) |
 | Downloads | `src/downloads/store.test.ts`, `offline-meta.test.ts`, `offline-companion.test.tsx` (a downloaded book's community data end to end, offline), `keep-ahead.test.ts`, `keep-ahead-controller.test.ts`, `failure.test.ts`, `downloads-view.test.ts`, `use-download-controls.test.ts`; `src/components/downloads/downloads-screen.test.tsx` |
 | Car and widgets | `src/car/car-model.test.ts` (the snapshot, item ids, play specs), `car-artwork.test.ts`, `car-controller.test.ts` (writes, play requests, bookmarks, adopting), `car-task.test.ts`; `src/widgets/widget-model.test.ts`, `widget-sync.ios.test.ts`; `src/lib/bootstrap.test.ts` (the shared launch steps) |
-| Config plugins | `plugins/withCarPlay.test.ts` (the scene manifest, the AppDelegate rewrite over an SDK 56 fixture, the opt-in entitlement), `plugins/withWidgetsNoPush.test.ts` |
+| Config plugins | `plugins/withCarPlay.test.ts` (the scene manifest, the AppDelegate rewrite over an SDK 56 fixture, the default-on entitlement and its `AUDIOSILO_CARPLAY=0` opt-out), `plugins/withCast.test.ts` (the Cast options, the Android expanded controller, both plugins in `app.json` order over the SDK 56 AppDelegate), `plugins/withWidgetsNoPush.test.ts` |
+| Cast | `src/cast/cast-media.test.ts` (the pure casting rules), `cast-token.test.ts`, `cast-prepare.test.ts`, `cast-service.test.ts`, `routed-service.test.ts` (the route switch), `cast-session.test.ts`, `cast-store.test.ts`, `cast-button-model.test.ts`, `cast-button.test.tsx`, `driver.native.test.ts`, `driver.web.test.ts` (one tab owns a session), `sdk-shapes.test.ts`, `web-sender.test.ts` |
+| Listening in the house | `src/components/house/house-model.test.ts`, `house-row.test.tsx`, `in-the-house-card.test.tsx`, `house-sharing-row.test.tsx`; `src/components/series/portrait.test.tsx` (the avatar and its ring); `src/api/hooks-household.test.tsx` (gating and polling) |
+| Profiles | `src/stores/profiles.test.ts`, `src/lib/profile-pin.test.ts`, `sha256.test.ts`, `random.test.ts`; `src/components/profiles/profiles-model.test.ts`, `profiles-screen.test.tsx`, `pin-dialog.test.tsx`, `household-pane.test.tsx`; `src/components/shell/auth-gate.test.tsx`, `profile-menu.test.tsx` |
+| Kids mode | `src/components/kids/kids-model.test.ts`, `use-kids.test.tsx`, `kids-screen.test.tsx`, `kids-player.test.tsx`, `grown-ups-button.test.tsx`, `kids-route-guard.test.tsx`, `kids-gate.test.tsx`; the bedtime rule in `src/playback/auto-sleep-controller.test.ts` |
+| Connection identity | `src/lib/connection-id.test.ts`, `src/lib/identity-migration.test.ts` (every store before and after, the abort paths before the plan, forward-only recovery after it (a failed file move or document write finished by the next try, never reversed), resumption, idempotency, the native file moves, the web keeping its files under the legacy id), `src/lib/storage-migration.test.ts` (readers held while a stored plan is retried, and released after the five tries) |
 | Stores | `src/stores/session.test.ts`, `settings.test.ts`, `series-orderings.test.ts`, `library-selection.test.ts`, `search.test.ts` |
 | Home | `src/components/home/home-model.test.ts`, `previously-on-model.test.ts`, `previously-on.test.tsx`, `listening.test.ts`, `now-card-model.test.ts`, `now-card.test.tsx`, `home-screen.test.tsx` |
 | Search | `src/components/search/search-model.test.ts` (the spoiler rules), `use-search-sources.test.tsx`, `search-screen.test.tsx` |
@@ -439,10 +444,10 @@ bitmap.
 
 ### CarPlay in the iOS Simulator
 
-1. Prebuild with the CarPlay entitlement:
+1. Prebuild (the CarPlay entitlement is on by default; `AUDIOSILO_CARPLAY=0` would leave it out):
 
    ```sh
-   AUDIOSILO_CARPLAY=1 CI=1 LANG=en_US.UTF-8 npx expo prebuild -p ios --clean
+   CI=1 LANG=en_US.UTF-8 npx expo prebuild -p ios --clean
    ```
 
 2. Build for the Simulator (no signing needed there):
diff --git a/docs-developers/frontend/you-and-settings.md b/docs-developers/frontend/you-and-settings.md
index b149ec8..5c1f4f1 100644
--- a/docs-developers/frontend/you-and-settings.md
+++ b/docs-developers/frontend/you-and-settings.md
@@ -174,8 +174,8 @@ shortcuts, never a second copy. The rules are the pure `settings-model.ts`:
   `support`). `settingsGroups(supportAvailable)` drops Support where
   `isSupportAvailable()` says the build can't link to it (Apple builds). There is no
   Accessibility pane: the app has no setting of its own for it, and the style guide says
-  not to show a switch that does nothing. Household is a flagged notice until profiles
-  ship.
+  not to show a switch that does nothing. Household is `HouseholdPane`, the people on
+  this device and the house sharing switches (see [Profiles](profiles.md#settings--household-and-sharing)).
 - `parseSettingsSection`: `preferences`, absent, unknown or a hidden pane is the first
   pane (`playback`); `accounts` is the signed-in servers. `sectionParam` writes the bare
   page for the first pane.
diff --git a/docs-developers/server/api/index.md b/docs-developers/server/api/index.md
index 24c513f..61c1470 100644
--- a/docs-developers/server/api/index.md
+++ b/docs-developers/server/api/index.md
@@ -88,7 +88,7 @@ key satisfies the admin-role check, a regular user's does not. Pairing tokens
 are never accepted as a bearer credential, and an API key is never valid for
 `/auth/exchange`. It also **cannot mint a fresh durable credential** - an API-key
 caller is refused (403) on the credential-minting routes (create key, recovery,
-pair, set password), so revoking a leaked key cuts off everything it could reach.
+pair, set password, cast token), so revoking a leaked key cuts off everything it could reach.
 See the [reference](reference.md#personal-api-keys).
 
 ### Media requests: `?token=` - media GETs only
@@ -98,10 +98,15 @@ See the [reference](reference.md#personal-api-keys).
 session token **either** as the bearer header **or** as a `?token=` query
 parameter. This exists because browser `<img>` and `<audio>` elements cannot set
 an `Authorization` header. The query fallback is deliberately confined to these
-three routes (`requireMediaAuth` in `internal/api/middleware.go`): a token in a query
+three routes (`requireBookMediaAuth` for cover and stream, `requireMediaAuth` for
+`/meta/cover`, both `mediaAuth` in `internal/api/middleware.go`): a token in a query
 string can leak into access logs and `Referer` headers, so no other route
 accepts it. Native clients should keep using the header even for media.
 
+A book's cover and stream also accept a **cast token** (capability `cast`) as the
+`?token=`, which a player mints for the Chromecast receiver so it never sees the
+session token: see [Cast tokens as media auth](reference.md#cast-tokens-as-media-auth).
+
 ### Client identification: `X-AudioSilo-Client`
 
 A client names itself on each request with an optional header:
@@ -199,7 +204,7 @@ Status mapping is consistent across handlers:
 |---|---|
 | `400` | malformed body / unknown JSON field, missing or invalid parameter (`path is required`, `invalid cursor`, non-integer `{id}`), path escaping the library root, domain validation (`mode must be "book" or "collection"`, admin needs a password, password too short) |
 | `401` | missing/invalid/expired token, bad credentials, invalid auth code, wrong `current_password` |
-| `403` | authenticated but not allowed: no share grants the library or path, `admin only`, demo accounts on the self-service routes (password/recovery/API keys), an API key on a credential-minting route (create key/recovery/pair/password), bad setup token |
+| `403` | authenticated but not allowed: no share grants the library or path, `admin only`, demo accounts on the self-service routes (password/recovery/API keys), an API key on a credential-minting route (create key/recovery/pair/password/cast token), bad setup token |
 | `404` | library/user/share/invite not found, another user's (or an unknown) bookmark or note on an edit, `no book at that path`, feature not configured (demo mode off, well-known files unset) |
 | `409` | conflicts: `name already taken` (library/share), last-enabled-admin guard, signing out the device making the request, starting someone's progress on a book they can't see, setup already completed |
 | `413` | a request body over an endpoint's size cap (a custom cover over 5 MiB) |
@@ -315,7 +320,9 @@ single-shot with a `limit` and no pagination.
     "user_stats": true,
     "my_devices": true,
     "annotations": true,
-    "addresses": true
+    "addresses": true,
+    "household": true,
+    "cast": true
   },
   "auth": { "methods": ["auth_code", "password"] },
   "demo": { "enabled": false }
@@ -367,6 +374,13 @@ each always `true` on a server that has it:
 | `annotations` | a bookmark's `label` (on [`POST …/bookmarks`](reference.md#get-apiv1librariesidbookmarks--post-apiv1librariesidbookmarks) and every bookmark answer), the owner's edits [`PATCH /bookmarks/{id}`](reference.md#patch-apiv1bookmarksid) and [`PATCH /notes/{id}`](reference.md#patch-apiv1notesid), the all-books lists [`/me/bookmarks`](reference.md#get-apiv1mebookmarks) and [`/me/notes`](reference.md#get-apiv1menotes), and `cursor` paging plus each row's `book` on [`/me/history`](reference.md#get-apiv1mehistory) |
 | `addresses` | the server's [home and away addresses](reference.md#home-and-away-addresses) on every pairing payload and its links, on the exchange, login and demo answers, and [`GET /addresses`](reference.md#get-apiv1addresses) |
 
+The player redesign's Phase 8 added two, each always `true` on a server that has it:
+
+| Flag | Gates |
+|---|---|
+| `household` | [Listening in the house](reference.md#listening-in-the-house): the caller's opt-in at [`/me/household`](reference.md#get-apiv1mehousehold--put-apiv1mehousehold) and [`GET /household/listening`](reference.md#get-apiv1householdlistening). Without it the player hides the sharing switch and the Home row |
+| `cast` | [`POST /cast/token`](reference.md#post-apiv1casttoken) and a cast token as the `?token=` of a book's cover and stream. Without it the player shows no Cast button |
+
 Gate on the flag rather than on the server version: an older server answers
 `size=` and `narrator=` by ignoring them (full art, the unfiltered list) and the
 new routes with a `404`. Request bodies are decoded strictly, so a field added to an
@@ -384,7 +398,7 @@ with an error envelope.
 | Limiter | Scope | Policy |
 |---|---|---|
 | General token bucket | every request except static files and media | ~50 requests/second, burst 200, per IP (`rate limit exceeded`) |
-| Media token bucket | `GET /libraries/{id}/cover`, `GET /libraries/{id}/stream` | ~200 requests/second, burst 2000, per credential; a failed authentication counts against the general bucket ([details](../auth-and-security.md#rate-limiting)) |
+| Media token bucket | `GET /libraries/{id}/cover`, `GET /libraries/{id}/stream`, `GET /libraries/{id}/meta/cover` | ~200 requests/second, burst 2000, per credential (a cast token has a bucket of its own); a failed authentication counts against the general bucket ([details](../auth-and-security.md#rate-limiting)) |
 | Login lockout | `POST /auth/login` | 10 *failed* attempts per 15 min per IP; a success resets the counter |
 | Redeem lockout | `POST /auth/redeem` | 10 *failed* attempts per 15 min per IP; a success resets |
 | Demo cap | `POST /demo/session` | at most 5 demo sessions per IP per 15 min, metered at admission (failures count too) |
diff --git a/docs-developers/server/api/reference.md b/docs-developers/server/api/reference.md
index 5a30a15..b01ff6a 100644
--- a/docs-developers/server/api/reference.md
+++ b/docs-developers/server/api/reference.md
@@ -8,7 +8,9 @@ The complete HTTP surface, derived from the route table in
 in the [API conventions](index.md) page and are not repeated per endpoint.
 
 **Auth legend** - *Public*: no token. *Session*: bearer session token.
-*Session (media)*: session token via header **or** `?token=` query parameter.
+*Session (media)*: session token via header **or** `?token=` query parameter
+(a book's cover and stream also take a [cast token](#cast-tokens-as-media-auth)
+as the `?token=`).
 *Admin*: session token + `admin` role. A personal **API key** authenticates as
 its owner anywhere a *Session* token does - so an admin's key also satisfies
 *Admin* - with one carve-out: it is refused on the credential-minting routes (see
@@ -53,7 +55,9 @@ else and gate features on the flags.
     "user_stats": true,
     "my_devices": true,
     "annotations": true,
-    "addresses": true
+    "addresses": true,
+    "household": true,
+    "cast": true
   },
   "auth": { "methods": ["auth_code", "password"] },
   "demo": { "enabled": false }
@@ -65,8 +69,10 @@ admin sets in the console's Settings > General (it can change while the server
 runs); `"AudioSilo"` when unset.
 `server_id` is a stable, per-install identity minted once and persisted in
 `config.yaml` (so it survives a database rebuild). It never changes for the life of
-the install; clients use it as the identity for a paired server and key their
-per-server state (downloads, progress, cache) on it. It is also returned by the
+the install; clients use it as the identity for a paired server. The player keys its
+per-connection state (token, downloads, progress, cache) on `<server_id>.<user_id>`, one
+user on one server, so two people signed in to one server stay apart (see
+[Connection identity](../../frontend/state-and-data.md#connection-identity-server_iduser_id)). It is also returned by the
 pairing exchange (`POST /auth/exchange`) and login/demo responses, so a client has
 it the moment it pairs. `version` is stamped from the release tag (`"dev"` for local builds).
 `transcode` is true only when ffmpeg is configured; `web_player` only when the
@@ -118,6 +124,14 @@ its links, on the exchange, login and demo answers, and at
 serves the community covers a book's `/meta` envelope hands out, as thumbnails at
 [`GET /libraries/{id}/meta/cover`](#get-apiv1librariesidmetacover).
 
+The player redesign's Phase 8 adds two more, both always `true` on a server that
+has them and absent on an older one:
+
+| Flag | Value | Gates |
+|---|---|---|
+| `household` | always `true` | [Listening in the house](#listening-in-the-house): `GET`/`PUT /me/household` and `GET /household/listening` |
+| `cast` | always `true` | [Casting](#casting): `POST /cast/token`, and a cast token as the `?token=` of a book's [cover](#get-apiv1librariesidcover) and [stream](#get-apiv1librariesidstream) |
+
 ### `GET /healthz` · `GET /api/v1/healthz`
 
 *Public.* Liveness/readiness probe: checks database read-reachability under a
@@ -261,8 +275,9 @@ Response `200`:
 }
 ```
 
-`server_id` is the paired server's stable identity (see `GET /server`); the client
-adopts it as the connection's id. On a server with `addresses`, the answer also carries
+`server_id` is the paired server's stable identity (see `GET /server`); the player's
+connection id is `<server_id>.<user_id>` with the answer's `user`
+([Connection identity](../../frontend/state-and-data.md#connection-identity-server_iduser_id)). On a server with `addresses`, the answer also carries
 `addresses` (`{ "home"?, "away"? }`, omitted when neither is known; see
 [Home and away addresses](#home-and-away-addresses)).
 
@@ -421,9 +436,10 @@ limit (10 attempts per IP per 15 minutes) and are **refused for demo accounts**
 (403).
 
 **Containment.** A key cannot mint a *fresh durable credential*. A request that
-authenticates with an API key is refused (**403**) on the four credential-minting
+authenticates with an API key is refused (**403**) on the five credential-minting
 routes - `POST /auth/tokens` (another key), `POST /auth/recovery`,
-`POST /auth/pair`, and `POST /auth/password` - so revoking a leaked key cuts off
+`POST /auth/pair`, `POST /auth/password`, and [`POST /cast/token`](#post-apiv1casttoken)
+(refused although a cast token would die with the key) - so revoking a leaked key cuts off
 everything it could reach: it can't spawn a key, recovery code, pairing token, or
 password that would outlive its own revocation (mirrors GitHub's "a token cannot
 create tokens"). It may still **list and revoke** keys and clear a recovery code,
@@ -1639,7 +1655,9 @@ book (`matched`, `recording`, `series`, `web_url`) are **not** returned here.
 ## Streaming & media
 
 Both routes take *media auth* (header **or** `?token=`) and are exempt from the
-30 s request timeout. See [Media](../media.md) for serving internals.
+30 s request timeout. Both also take a [cast token](#cast-tokens-as-media-auth) as
+the `?token=` (capability `cast`), for the book it was minted for. See
+[Media](../media.md) for serving internals.
 
 ### `GET /api/v1/libraries/{id}/stream`
 
@@ -1653,7 +1671,7 @@ path.
 | `download` | `1` | - | sets `Content-Disposition: attachment` so browsers save the file |
 | `transcode` | `1` | - | re-encode to MP3 via ffmpeg for codecs browsers can't decode |
 | `t` | float | `0` | with `transcode=1`: start the transcode this many seconds in |
-| `token` | string | - | session token (media-auth fallback) |
+| `token` | string | - | session token (media-auth fallback), or a [cast token](#cast-tokens-as-media-auth) for this file's book |
 
 Direct serving (default) supports HTTP **Range** (`206 Partial Content`) and
 sets the audio `Content-Type` from the file. Transcoded output is MP3 and **not
@@ -1668,7 +1686,7 @@ kills it.
 | `401` | missing/invalid token |
 | `403` | path outside the caller's scope |
 | `404` | file does not exist |
-| `503` | `transcode=1` but ffmpeg is not configured (check the `transcode` capability) |
+| `503` | `transcode=1` but ffmpeg is not configured (check the `transcode` capability), or every transcode slot is busy (`server busy transcoding; try again shortly`, with `Retry-After: 5`) |
 
 ### `GET /api/v1/libraries/{id}/cover`
 
@@ -1701,7 +1719,7 @@ three is tried, custom covers included.
 | `path` | string | yes | |
 | `size` | int | no | `160`, `320` or `640`: a JPEG thumbnail instead of the full art (`cover_sizes` capability; below) |
 | `v` | string | no | ignored by the server; clients append the book's `cover_version` as a cache buster |
-| `token` | string | no | media-auth fallback |
+| `token` | string | no | media-auth fallback: a session token, or a [cast token](#cast-tokens-as-media-auth) for this book |
 
 Response `200`: image bytes with the appropriate `Content-Type`; `404`
 (`no cover`) when there is no custom cover, no cover file and no embedded art.
@@ -1747,6 +1765,44 @@ so a cover replaced since the last fetch is a new URL to its image cache.
 | `404` | `no cover`: no art at all, no book at the path, or (with `size`) art that cannot be decoded or is over 40 megapixels |
 | `500` | `could not load cover` - the art could not be read (an unreadable network mount) or a database failure; not cached, so the next request tries again |
 
+### Cast tokens as media auth
+
+A Chromecast receiver plays a book from URLs the player hands it, so the player
+never hands over its session token: it mints a **cast token** for the book with
+[`POST /cast/token`](#post-apiv1casttoken) and builds the receiver's URLs with that
+instead. The two routes above accept one as the `?token=` (the middleware
+`requireBookMediaAuth`; `auth.ResolveCastRequest`, one token lookup that decides
+session, API key or cast) only when **all** of these hold:
+
+- the request carries **no** `Authorization` header (a cast token is never a bearer
+  credential, nor accepted beside one);
+- the token is live (not revoked or expired, its user enabled, and the session that
+  minted it still signed in; see [Cast tokens](../auth-and-security.md#cast-tokens));
+- the request's library is the token's, and its `?path=` (cleaned first, so `..`
+  can't climb out) is the token's book or a file or folder inside it on a segment
+  boundary: a token for `Author/Book` reaches `Author/Book/01.mp3`, never
+  `Author/Book 2/01.mp3`;
+- the path addresses the token's **own** book in the index (`api.castOwnBook`): a
+  folder book's folder can hold other books (`Series` holding `Series/Book 2`), and
+  a cast token for `Series` never reaches them; a path the index places in no book is
+  refused too.
+
+Any refusal is the same `401` as a bad session token. The handler then checks the
+person's **current** share scope as for every request, so a book whose share was
+taken away since the mint is a `403`. A cast token is never accepted on any other
+route, [`/meta/cover`](#get-apiv1librariesidmetacover) included.
+
+An answer authenticated by a cast token carries
+`Cross-Origin-Resource-Policy: cross-origin` in place of the server's usual
+`same-site`: the receiver is a web app served from another site (`gstatic.com`)
+that loads the files as `<audio>` and `<img>`, which the browser would otherwise
+block. Only these answers opt out. A cast token authenticates `?transcode=1&t=`
+like a session (the player asks for it for codecs a Cast receiver can't play);
+each such stream holds one of the transcoder's slots while the receiver reads it,
+and it marks the **sending device's** listening session as transcoded (the sender's
+own progress saves make the session). The media rate limiter keys a cast token by its
+token id like any credential, so it has a bucket of its own.
+
 ## Listening state
 
 Per-user durable state, addressed by `(library, path)` - the **book** path.
@@ -2445,7 +2501,10 @@ with: every enabled, non-demo account other than the caller, by username.
 { "users": [ { "id": 6, "username": "alex" }, { "id": 9, "username": "robin" } ] }
 ```
 
-This is the one place a non-admin sees other accounts' usernames. A demo
+This is the one place a non-admin can list every other account's username (a
+shared collection also shows its owner, and
+[`GET /household/listening`](#get-apiv1householdlistening) the other people who
+share). A demo
 account gets `403` `not available for demo accounts`, so a public demo can't
 list the server's usernames.
 
@@ -2638,6 +2697,116 @@ open), there whether or not a goal is set.
 `invalid request` for a malformed body or an unknown field. `DELETE` clears it:
 `204 No Content`, idempotent.
 
+## Listening in the house
+
+*Session.* Capability `household`. People on one server who choose to share see
+what the others who share are listening to (the player's Home row and the book
+page's "In the house" card). The rules live in `catalog.HouseListening`
+(`internal/catalog/household.go`): opt-in and reciprocal (a caller who doesn't
+share gets an empty `listening` list), with every privacy rule in
+[what other people see](../auth-and-security.md#listening-in-the-house-what-other-people-see).
+
+Polling only: there is no realtime channel (the player asks every minute while it
+is in the foreground). No admin route reads or changes anyone's choice.
+
+### `GET /api/v1/me/household` · `PUT /api/v1/me/household`
+
+*Session.* The caller's own choice.
+
+```json
+{ "share_listening": false }
+```
+
+`PUT` takes the same shape, `{ "share_listening": true }`, and answers `200` as
+`GET`. The field is required and the body is decoded strictly: a missing field
+(`{}`), an unknown field or a wrong type is `400` `invalid request`. A demo account's
+`PUT` is `403` (`not available for demo accounts`; its `GET` works and reads
+`false`), so a public demo never shows up in anyone's house. A personal API key may
+set it: it is the person's own credential and mints nothing.
+
+### `GET /api/v1/household/listening`
+
+*Session.* What the other people who share are listening to, newest first.
+
+```json
+{
+  "sharing": true,
+  "listening": [
+    {
+      "user_id": 3,
+      "username": "sam",
+      "library_id": 1,
+      "path": "Will Wight/Cradle/Unsouled",
+      "title": "Unsouled",
+      "author": "Will Wight",
+      "state": "playing",
+      "position": 5123.4,
+      "duration": 36120.5,
+      "chapter": "Chapter 4",
+      "chapter_index": 3,
+      "updated_at": "2026-10-09T19:59:30.000Z"
+    }
+  ]
+}
+```
+
+- `sharing` - whether the caller shares. While it is `false`, `listening` is `[]`.
+- `state` - from the age of the person's newest save: `playing` within 60 seconds,
+  `paused` within 10 minutes (the session gap), else `recent`.
+- `title` - the index's title, else the path's last segment (a book no longer
+  indexed); `author` and `duration` are `null` when unknown (`duration` falls back
+  to the session's own).
+- `position` - seconds into the whole book; `chapter` and `chapter_index` (0-based)
+  are the chapter at that position, as the admin's live sessions show it: both
+  `null` for a book with one chapter or none, and `chapter` alone `null` for a
+  chapter whose title names nothing (`Track 01`), where `chapter_index` still says
+  which.
+- `updated_at` - the newest save, fixed-width millisecond UTC.
+
+## Casting
+
+*Session.* Capability `cast`. A Chromecast receiver plays a book from URLs the
+player hands it; those URLs carry a short-lived, book-scoped, media-only **cast
+token** instead of the player's session token (`internal/auth/cast.go`,
+`internal/api/handlers_cast.go`). Where the token is accepted is
+[Cast tokens as media auth](#cast-tokens-as-media-auth). For the web player to
+cast, the per-document CSP of `/web` admits Google's Cast Web Sender:
+`script-src` names its three scripts on `https://www.gstatic.com` by path, the only
+remote sources in the policy (see [Web UI](../web-ui.md#per-document-csp-htmlcsp)).
+
+### `POST /api/v1/cast/token`
+
+*Session.* Mints a cast token for one book.
+
+```json
+{ "library_id": 1, "path": "Will Wight/Cradle/Unsouled" }
+```
+
+Response `201`:
+
+```json
+{
+  "token": "q3Xb0m…",
+  "expires_at": "2026-10-10T20:00:00.000Z"
+}
+```
+
+The path resolves exactly as on the media routes, and a part path (one file, or a
+disc folder) resolves to its book: the token then covers every file of that book.
+The secret is returned once. `expires_at` falls on a whole second. A demo account
+may mint (it can play); an API key may not. How long a cast token lives, how many a
+person keeps, what ends it and how dead ones are pruned:
+[Cast tokens](../auth-and-security.md#cast-tokens).
+
+| Status | Meaning |
+|---|---|
+| `201` | `{ token, expires_at }` |
+| `400` | `invalid request` (a malformed body or an unknown field), `path is required` |
+| `401` | no session (a cast token can't mint another: it is never a bearer credential) |
+| `403` | the library or the path is outside the caller's access; or `not available when authenticating with an API key` (a key never mints another credential) |
+| `404` | `book not found` (no book at the path), or `library not found` (an admin naming an unknown library; anyone else gets the `403`) |
+| `500` | `could not start casting`; `access check failed`, `could not load library` or `could not load book` on a database failure |
+
 ## Admin: users & auth codes
 
 All *Admin*. Plaintext codes/passwords are never retrievable after creation -
diff --git a/docs-developers/server/auth-and-security.md b/docs-developers/server/auth-and-security.md
index 215b1d7..9abb9e1 100644
--- a/docs-developers/server/auth-and-security.md
+++ b/docs-developers/server/auth-and-security.md
@@ -40,8 +40,9 @@ codes/tokens in the response body and store only the hash.
 
 ## Tokens: session, pairing, and API keys
 
-`tokens.kind` distinguishes three kinds (`auth.KindSession`, `auth.KindPairing`,
-`auth.KindAPI`):
+`tokens.kind` distinguishes three kinds of credential a client holds
+(`auth.KindSession`, `auth.KindPairing`, `auth.KindAPI`), plus the
+[cast tokens](#cast-tokens) a player hands a Chromecast receiver (`auth.KindCast`):
 
 - **Session tokens** are the durable bearer credential (`Authorization: Bearer
   …`). Issued by `POST /auth/login` and `POST /auth/exchange` with **no
@@ -70,13 +71,58 @@ codes/tokens in the response body and store only the hash.
   `gateSelfService`, so they share the `accountLimiter` and are refused for demo
   accounts, exactly like the password/recovery routes. **Containment:** an API-key
   caller is additionally barred (403, via `denyAPIKey` in
-  `internal/api/handlers_auth.go`) from the four credential-minting routes
-  (`POST /auth/{tokens,recovery,pair,password}`), so a leaked key can never spawn a
-  fresh durable credential - another key, recovery code, pairing token, or
-  password - that would outlive its own revocation (mirrors GitHub's "a token
-  cannot create tokens"). It can still list/revoke keys and clear a recovery code,
+  `internal/api/handlers_auth.go`, also called by `handlers_cast.go`) from the five
+  credential-minting routes (`POST /auth/{tokens,recovery,pair,password}` and
+  `POST /cast/token`), so a leaked key can never spawn a fresh credential - another
+  key, recovery code, pairing token, or password that would outlive its own
+  revocation, or even a [cast token](#cast-tokens), which would die with it (mirrors
+  GitHub's "a token cannot create tokens"). It can still list/revoke keys and clear a recovery code,
   which only reduce access.
 
+### Cast tokens
+
+A **cast token** (capability `cast`, `internal/auth/cast.go`) is a fourth kind of
+`tokens` row, `kind = 'cast'` (`auth.KindCast`), with a `cast_grants` row that says
+what it may read. A player mints one (`POST /cast/token`, `auth.IssueCastToken`) for
+the book it is about to play on a Chromecast, and the receiver's stream and cover
+URLs carry it instead of the session token: a receiver is a device the listener
+doesn't control, and its URLs can surface in its logs or a debugger. It is narrow on
+every axis:
+
+- **One book.** Its grant reaches only the `(library, path)` it was minted for, or a
+  file or folder inside it on a segment boundary (`relpath.Within`: `Book` never
+  reaches `Book 2`; the path is cleaned first, so `Book/../Book 2` doesn't either).
+  A mint for a part path stores its book's path. And because a folder book's folder
+  can hold other books (`Series` holding `Series/Book 2`), `api.castOwnBook` also
+  requires the requested path to address the token's **own** book in the index
+  (`catalog.BookPathAt`); a path the index places in no book is refused.
+- **Media only.** `auth.ResolveRequest` never accepts a cast token;
+  `auth.ResolveCastRequest` does, and the api calls it only for the `?token=` of
+  `GET /libraries/{id}/cover` and `/stream` with **no** `Authorization` header. It
+  is never a bearer credential, so it can't reach any other route, mint another cast
+  token, or reach `/meta/cover`.
+- **Tied to the sending device.** The grant's `parent_token_id` is the session that
+  minted it. Validity is `lookupToken`'s one check (unknown, revoked, expired,
+  disabled user) plus, for a cast token, a grant and a live parent, so **signing out
+  the device that minted it** (logout, My devices, the console) ends it.
+- **Short-lived.** 24 hours; a person keeps at most 20, and each mint deletes every
+  dead cast token (expired, no grant, or its parent gone, signed out or expired). The
+  daily retention job runs the same prune (`auth.PruneCastTokens`), so a dead token's
+  row (the receiver's `last_ip`) and grant (which book was cast) never outlive it by
+  more than a day.
+- **Still the person's.** Deleting the account deletes it with the account's other
+  tokens. Disabling the account only **suspends** it, as it does every token
+  (`SetDisabled` revokes nothing; `lookupToken` checks the user on every request): it
+  is refused while the account is disabled and works again if the account is enabled
+  before it expires, so signing out the device that minted it is what ends it for
+  good. The media handlers check the person's **current** share scope, so a revoked
+  share is a `403` (and a restored one works again).
+
+Only the SHA-256 hash is stored. Any refusal is the uniform `401`. An API key may
+not mint one (`denyAPIKey`, the containment rule above: a key never mints another
+credential); a demo account may (it can play). A cast token is never a **device**:
+`ListDevices` and the device sign-outs take only session and API-key tokens.
+
 `auth.ResolveRequest` (which `ResolveToken` wraps for a single kind) validates a presented secret for the accepted kinds: it hashes
 the secret, looks up the row, and rejects revoked tokens, expired tokens, and
 tokens whose user is disabled. On success it bumps `tokens.last_seen` - which
@@ -109,12 +155,17 @@ The middleware wrappers in `internal/api/middleware.go`:
   token is never accepted here, so a QR/pairing secret can't be used as a durable
   credential.
 - `requireMediaAuth` - additionally accepts `?token=` as a query parameter,
-  used **only** for the media GETs (`/cover`, `/stream`, and `/meta/cover` for a
-  community cover) because browser
+  used **only** for the media GETs (`/meta/cover` for a community cover; a book's
+  `/cover` and `/stream` use `requireBookMediaAuth`, below) because browser
   `<img>`/`<audio>` elements cannot set headers. `bearerToken(r, allowQuery)`
   confines the fallback deliberately: a token in a query string can leak into
   access logs and `Referer` headers, so no other route accepts it. An API key
   works here too, since it authenticates wherever a session does.
+- `requireBookMediaAuth` - `requireMediaAuth` whose one token lookup also accepts a
+  [cast token](#cast-tokens) (`ResolveCastRequest`, then `castOwnBook`). Only a
+  book's own cover and stream use it; `/meta/cover` keeps `requireMediaAuth`.
+  A cast-authenticated answer sets `Cross-Origin-Resource-Policy: cross-origin`
+  (below).
 - `requireAdmin` - `requireAuth` plus a role check; every `/admin/*` route uses
   it. The baked-in admin HTML is unprivileged - the API enforces the role.
 
@@ -203,6 +254,10 @@ Three fences keep a demo session from becoming a durable login:
   (`GET /me/share-targets` and `PUT /me/collections/{id}/shares` are `403`; see
   [the listener's own state](#the-listeners-own-state-me)), and demo accounts are
   never offered as share targets.
+- A demo account can't share its listening with the house (`PUT /me/household`
+  is `403`, `nonDemoAccount`), and demo accounts never appear in anyone's
+  `GET /household/listening`, so a public demo never shows up in a household. It
+  may mint a cast token, since it can play.
 - A background reaper (`launcher.demoReaper`, every 15 minutes) deletes demo
   accounts idle past `demo.idle_ttl` - by the `is_demo` flag, never by username
   prefix. Deletion cascades all their state.
@@ -313,13 +368,16 @@ its owner. They follow a few rules on top of share scope:
   owner's `shared_with` list is never sent to a viewer.
 - **The share picker shows usernames, so demo accounts are kept out.**
   `GET /me/share-targets` lists every enabled, non-demo account other than the
-  caller (id and username): the one way a non-admin learns other accounts'
-  usernames. A demo account is refused it (`403 not available for demo
+  caller (id and username): the one way a non-admin can list every account's
+  username (a shared collection also shows its owner's, and
+  [listening in the house](#listening-in-the-house-what-other-people-see) the
+  usernames of the other people who share). A demo account is refused it (`403 not available for demo
   accounts`), so a public demo can't enumerate the server's users, and can't
   share a collection either (the same `403`, checked before the collection id, so
   a demo caller learns nothing about whose collection an id is). Disabled and
-  demo accounts are never share targets. These two are the only `/me/*` routes
-  with a demo refusal; none has its own rate-limit class.
+  demo accounts are never share targets. These two, and `PUT /me/household`
+  ([below](#listening-in-the-house-what-other-people-see)), are the only `/me/*`
+  routes with a demo refusal; none has its own rate-limit class.
 - **Stats never cross users.** `/me/stats` and `/me/listening` are computed for
   the caller alone (the admin Activity code with its accumulator limited to the
   caller): no other listener, username, `by_user`, `top_users`, funnel,
@@ -362,6 +420,34 @@ its owner. They follow a few rules on top of share scope:
 Each of these routes has a denied test (another user's data refused or
 invisible) beside its allowed one.
 
+### Listening in the house: what other people see
+
+`GET /household/listening` (capability `household`) is the one route that shows a
+listener what **other** people are listening to, so its rules sit in
+`catalog.HouseListening` rather than the handler, each with an allowed and a
+denied test:
+
+- **Opt-in on both sides.** `household_sharing` has no row until a person sets
+  `PUT /me/household` (no row reads as off), and a caller who doesn't share gets
+  `listening: []`: you see housemates only while you share too. Only the choice is
+  mutual, not the view: each list passes its own caller's scopes and each other
+  person's 24-hour window, so visibility can be one-way (a housemate whose newest book
+  you can't open doesn't show for you, though you may show for them; a sharer who
+  hasn't listened in 24 hours sees others without showing up for them).
+- **Who can appear.** Other users only (never the caller), enabled, not demo, with
+  sharing on.
+- **What of them.** One row per person: their newest session recorded on this
+  server (`import_id = 0`, not backfilled, listened > 0) within 24 hours.
+- **Only books the caller may open.** That newest book passes the **caller's**
+  current scopes (`ScopesAllow`) or the person is dropped; an older in-scope book
+  never stands in for it.
+- **No device fields.** `HouseListeningRow` has no field for a device, address,
+  app or token, unlike the admin-only `LiveSessions`, which must never be reused
+  for anything a non-admin sees.
+
+There is no admin route over these choices: an admin sees listening on the
+Activity pages as before, and nothing shows who shares.
+
 ## Path traversal: `library.SafeJoin`
 
 Any filesystem access derived from user input goes through
@@ -387,7 +473,7 @@ Two mechanisms in `internal/api/ratelimit.go`, six buckets wired in `api.New`:
 | Bucket | Mechanism | Limit | Applied to |
 |---|---|---|---|
 | `ipLimiter` | Token bucket per IP (`rateLimiter`) | ~50 req/s, burst 200 | The general API: every request (global `rateLimit` middleware) except static files and authenticated media. Static files are those the mux hands to a handler the web package registered (`web.IsStatic`: the console, the web player, the connect page and its assets, served from memory); one cold console page loads forty-odd chunks, so they are not counted. The health check and the setup page are counted |
-| `mediaLimiter` | Token bucket per credential (`rateLimiter`) | ~200 req/s, burst 2000 | Media GETs (`/cover`, `/stream`, `/meta/cover`: the routes `requireMediaAuth` wraps) once they authenticate. See below |
+| `mediaLimiter` | Token bucket per credential (`rateLimiter`) | ~200 req/s, burst 2000 | Media GETs (`/cover`, `/stream`, `/meta/cover`: the routes `requireBookMediaAuth` and `requireMediaAuth` wrap, both `mediaAuth`) once they authenticate. See below |
 | `loginLimiter` | Failure lockout per IP (`limiter`) | 10 failures / 15 min | `POST /auth/login` |
 | `redeemLimiter` | Failure lockout per IP | 10 failures / 15 min | `POST /auth/redeem` |
 | `demoLimiter` | **Attempt** cap per IP (`Acquire`) | 5 / 15 min | `POST /demo/session` |
@@ -402,13 +488,14 @@ stale entries so a flood of distinct IPs can't grow memory without bound.
 
 **Media is classed by route.** A cover grid loads every cover as its own
 `?token=` request, so sharing the per-IP budget turned a fast server's covers
-into 429s. `requireMediaAuth` returns a `mediaHandler`, which `rateLimit` skips
+into 429s. `requireMediaAuth` and `requireBookMediaAuth` (both `mediaAuth`) return a `mediaHandler`, which `rateLimit` skips
 (read off the handler the mux picks, like `web.IsStatic`), and owns the media
 policy itself: it refuses the request while the address's `ipLimiter` bucket is
 empty (`Ready`, which checks without spending), charges that bucket one token
 when authentication fails (no token, or a bad one), so unauthenticated media is
 bounded exactly like the general API, and otherwise spends from `mediaLimiter`,
-keyed by the credential (token row id) rather than the address: several people
+keyed by the credential (its token row id; a cast token is a `tokens` row too, so it
+has a bucket of its own) rather than the address: several people
 behind one address would otherwise share a budget. A request its credential's
 bucket refuses has still cost a token lookup, so it is charged to the address
 too. Charges use `Charge`, which always lands, even past empty (down to minus
@@ -426,7 +513,11 @@ appears as the proxy's address and shares its general bucket and its lockouts.
 
 `secureHeaders` sets `X-Content-Type-Options: nosniff`, `X-Frame-Options:
 DENY`, `Referrer-Policy: no-referrer`, and `Cross-Origin-Resource-Policy:
-same-site` on every response. **HSTS is set only in `autocert` TLS mode**:
+same-site` on every response. The one exception is an answer a
+[cast token](#cast-tokens) authenticated: it is `cross-origin`, because the
+Chromecast receiver is a web app on another site (`gstatic.com`) loading the
+book's audio and cover as no-cors `<audio>`/`<img>` requests, which `same-site`
+would make the browser block. It reaches one book's media only. **HSTS is set only in `autocert` TLS mode**:
 pinning it with a self-signed cert would make the certificate warning
 impossible to bypass, and behind a reverse proxy (`off`) the proxy owns HSTS.
 
@@ -452,9 +543,11 @@ Two policies, both owned by `internal/web`:
   images allowed for the connect page's QR PNG and the console's covers,
   `frame-ancestors 'none'`.
 - The **web player** at `/web` gets a per-document `htmlCSP`: `script-src
-  'self'` plus a sha256 hash of each inline `<script>` in that HTML document,
-  and `style-src 'unsafe-inline'` (react-native-web injects runtime styles that
-  cannot be hashed).
+  'self'`, the Cast Web Sender's three scripts on `https://www.gstatic.com` by path
+  (capability `cast`: the only remote sources in either policy, never the whole
+  origin) and a sha256 hash of each inline
+  `<script>` in that HTML document, and `style-src 'unsafe-inline'`
+  (react-native-web injects runtime styles that cannot be hashed).
 
 Details and the reasoning live in [Web UI](web-ui.md).
 
@@ -487,6 +580,8 @@ The enumerated critical list:
 - `Scope.Allows` / `Scope.VisibleInBrowse` / `pathFilterSQL`
 - the rate limiters (`limiter`, `rateLimiter`) and the route classes in `rateLimit`
 - `auth.ResolveRequest` / `lookupToken`
+- the cast token checks: `relpath.Within` / `relpath.Clean`, the grant's `covers`,
+  `auth.ResolveCastRequest`, `api.authenticate` / `castOwnBook`
 - `web.htmlCSP`
 
 Anything touching these must land with a test showing the permitted case *and*
diff --git a/docs-developers/server/data-model.md b/docs-developers/server/data-model.md
index 70ef8ef..4311e47 100644
--- a/docs-developers/server/data-model.md
+++ b/docs-developers/server/data-model.md
@@ -4,7 +4,7 @@ description: "The SQLite schema behind audiosilo-server: the rebuildable index v
 ---
 
 The schema lives in `internal/store/migrations/` as numbered SQL files
-(`0001_init.sql` … `0041_series_key.sql`), embedded into the binary and
+(`0001_init.sql` … `0043_cast_tokens.sql`), embedded into the binary and
 applied by `store.Open` at startup. This page documents the **resulting current
 schema**, noting which migration added what.
 
@@ -24,8 +24,11 @@ thing to understand before touching it:
   `issue_ignores`, `book_overrides`, `chapter_overrides`, `chapter_choices` and
   `book_covers` (per-library config) - is keyed by **`(library_id, rel_path)`**, with **no
   foreign key to `books`**. The rest of a listener's own state hangs off the
-  account rather than a path: `collections`, `collection_shares` and
-  `listening_goals` (see [Lists, ratings and goals](#lists-ratings-and-goals)).
+  account rather than a path: `collections`, `collection_shares`,
+  `listening_goals` and `household_sharing` (see
+  [Lists, ratings and goals](#lists-ratings-and-goals)). `cast_grants` is
+  path-keyed with no FK to `books` too, but it belongs to a short-lived credential
+  rather than state (see [Accounts & credentials](#accounts--credentials)).
 
 A third, small group sits beside the index: **`scan_runs`**, the history of
 the scans that built it, and **`community_chapters`**, each book's last
@@ -131,8 +134,9 @@ last activity is derived from `MAX(tokens.last_seen)`.
 **`tokens`** *(0001; `auth_code_id` added in 0014; `client_app`,
 `client_version`, `client_platform` and `last_ip` in 0018)* - opaque bearer tokens:
 `user_id` (FK CASCADE), `token_hash` (UNIQUE - only the SHA-256 hash is
-stored), `kind` (`'session'`/`'pairing'`/`'api'`, the last being a user-minted personal
-API key whose label rides in `device_name`), `device_name`, `created_at`,
+stored), `kind` (`'session'`/`'pairing'`/`'api'`/`'cast'`: `'api'` a user-minted personal
+API key whose label rides in `device_name`, `'cast'` *(0043)* a
+cast token with its `cast_grants` row (below)), `device_name`, `created_at`,
 `last_seen` (bumped by authenticated requests, at most once a minute unless the
 request's address or `X-AudioSilo-Client` changed: `auth.touchInterval`, so a
 progress save isn't also a token write), `expires_at` (NULL = no
@@ -148,9 +152,22 @@ alone), and `last_ip` the address of its newest request. Both are overwritten by
 and the daily retention job blanks `last_ip` on revoked tokens
 (`auth.ForgetRevokedAddresses`), so an address is kept only while the device is
 signed in.
-The admin console lists live session and API-key tokens as **devices**
+The admin console lists live session and API-key tokens as **devices** (never pairing
+or cast tokens)
 (`auth.ListDevices`) and can revoke one (`auth.RevokeDevice`).
 
+**`cast_grants`** *(0043)* - what a **cast token** may read. A cast token is a
+`tokens` row of kind `'cast'` (`POST /cast/token`, capability `cast`; see
+[Auth & security](auth-and-security.md#cast-tokens)) with `expires_at` 24 hours
+on; its grant is `token_id` (PK, FK CASCADE to `tokens`), `library_id` and
+`rel_path` (the **book's** own path, a part path resolved first; no FK to the
+index) and `parent_token_id` (FK CASCADE to `tokens`: the session that minted it,
+indexed). A cast token without a grant, or whose parent is gone, signed out or
+expired, is never valid; how dead ones are pruned and how many a person keeps are
+in [Cast tokens](auth-and-security.md#cast-tokens). Partial index
+`idx_tokens_cast_expiry` on `tokens(expires_at) WHERE kind = 'cast'`. A grant is not
+moved with its book: it lives 24 hours.
+
 **`auth_codes`** *(0001; `kind` + `redeemed_at` added in 0010)* - redeemable
 codes: `code_hash` (UNIQUE, SHA-256 of the normalized code), `user_id` (FK
 CASCADE), `label`, `max_uses` (0 = unlimited), `uses` (counts devices that
@@ -509,6 +526,15 @@ wins the whole row (a tie keeps the destination's).
 nothing moves them. All six are part of a database backup (`VACUUM INTO`), like
 every table.
 
+**`household_sharing`** *(0042)* - whether a person shares what they are
+listening to with the other people on the server (`/me/household`, capability
+`household`): `user_id` (`INTEGER PRIMARY KEY`, FK to `users` `ON DELETE
+CASCADE`), `share_listening` (`0`/`1`) and `updated_at` (fixed-width millisecond
+UTC). No row reads as off. It names no book, so nothing moves it, and a backup
+carries it like every table; what it lets others see is read from
+`listening_sessions` (see
+[Auth & security](auth-and-security.md#listening-in-the-house-what-other-people-see)).
+
 ### Listening from before sessions
 
 Sessions start at migration 0018, but players have posted
@@ -978,6 +1004,8 @@ The migration history so far:
 | 0039 | `more_series_index` | the partial index `idx_books_more_series` on `books(library_id) WHERE more_series <> '[]'`, so the reads of the books in more than one series (a series' members, `/series` with `memberships=1`) skip the rest |
 | 0040 | `server_state` | `server_state` (`key`, `value`, `updated_at`), small server-wide facts that aren't settings; the first key is the support card's answer: see [Server state](#server-state) |
 | 0041 | `series_key` | `books.series_key` and `book_more_series`, a series stored by its key so every series filter is an index seek in any spelling; `idx_books_series_key` replaces `idx_books_series`, and `idx_books_more_series` (0039) goes, since nothing reads it any more. Rows indexed before it are keyed at start by `catalog.KeySeries` (server_state `series_keys`), which also puts every stored `more_series` list through the list rules first |
+| 0042 | `household_sharing` | `household_sharing`, each person's opt-in to Listening in the house (no row = off) |
+| 0043 | `cast_tokens` | `tokens.kind` `'cast'` (cast tokens for a Chromecast receiver) and `cast_grants` (each one's book and parent token), with `idx_cast_grants_parent` and the partial `idx_tokens_cast_expiry` |
 
 ## SQLite choices
 
diff --git a/docs-developers/server/media.md b/docs-developers/server/media.md
index 9cbdc0a..0d95ac8 100644
--- a/docs-developers/server/media.md
+++ b/docs-developers/server/media.md
@@ -33,10 +33,11 @@ Two things happen before any bytes are read, on every media request:
 
 1. **Authorization**: `authorizedPath` resolves `{id}` + `?path=` and checks
    the caller's share scope (`Scope.Allows`). `cover` and `stream` are wired
-   through `requireMediaAuth`, the only middleware that also accepts the
-   session token as a `?token=` query parameter - browser `<img>`/`<audio>`
-   elements cannot set an `Authorization` header. Every other route rejects
-   query tokens (see [Auth & security](auth-and-security.md)).
+   through `requireBookMediaAuth`, which, like `requireMediaAuth` on
+   `/meta/cover`, also accepts the session token as a `?token=` query parameter
+   (and on these two a [cast token](auth-and-security.md#cast-tokens)) - browser
+   `<img>`/`<audio>` elements cannot set an `Authorization` header. Every other
+   route rejects query tokens (see [Auth & security](auth-and-security.md)).
 2. **Path safety**: the relative path is joined to the library root with
    `library.SafeJoin`, which rejects any traversal outside the root.
 
@@ -337,7 +338,7 @@ fallback for codecs `DirectPlayable` rejects.
 
 ```mermaid
 flowchart TD
-    A["GET /libraries/{id}/stream?path=…"] --> B["requireMediaAuth<br/>(header or ?token=)"]
+    A["GET /libraries/{id}/stream?path=…"] --> B["requireBookMediaAuth<br/>(header, or ?token= session or cast token)"]
     B --> C["authorizedPath: scope check<br/>library.SafeJoin: path safety"]
     C --> D{"transcode=1?"}
     D -- "no" --> E["media.ServeFile<br/>Range + sniffed Content-Type<br/>(?download=1 → attachment)"]
diff --git a/docs-developers/server/overview.md b/docs-developers/server/overview.md
index 1650356..bc065c6 100644
--- a/docs-developers/server/overview.md
+++ b/docs-developers/server/overview.md
@@ -119,7 +119,7 @@ schema and the SQLite rationale.
 ### `internal/auth`
 
 Accounts and credentials: argon2id password hashing (`hash.go`), opaque
-SHA-256-hashed bearer tokens (session, pairing, and API-key kinds), and redeemable auth
+SHA-256-hashed bearer tokens (session, pairing, API-key and cast kinds), and redeemable auth
 codes (invite + recovery kinds) with atomic redemption. Also owns the admin
 safety guards (`ErrLastAdmin`, `ErrAdminNeedsPassword`) and the demo-account
 reaper queries. See [Auth & security](auth-and-security.md).
diff --git a/docs-developers/server/web-ui.md b/docs-developers/server/web-ui.md
index 028876e..aa35202 100644
--- a/docs-developers/server/web-ui.md
+++ b/docs-developers/server/web-ui.md
@@ -867,15 +867,27 @@ and emits:
 ```
 default-src 'self'; img-src 'self' data: blob:; media-src 'self' blob:;
 font-src 'self' data:; style-src 'self' 'unsafe-inline';
-script-src 'self' 'sha256-…' […]; connect-src 'self';
+script-src 'self' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
+  https://www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js
+  https://www.gstatic.com/eureka/clank/ 'sha256-…' […]; connect-src 'self';
 base-uri 'none'; frame-ancestors 'none'
 ```
 
 - **`script-src` stays strict** - only the exact inline scripts present in
-  that document run; no `'unsafe-inline'`.
+  that document run; no `'unsafe-inline'`. The only remote sources are Google's
+  Cast Web Sender's three scripts on `https://www.gstatic.com`, named **by path**
+  (`castSenderScripts`): `cast_sender.js` (the player adds `?loadCastFramework=1`,
+  which a source's path ignores), the Cast framework it loads, and the Chrome sender
+  API it loads from `/eureka/clank/`. The player loads them lazily on Chromium to cast
+  (capability `cast`, see [Chromecast](../frontend/chromecast.md)). Never the whole
+  origin: `www.gstatic.com` also serves AngularJS, a known CSP allowlist bypass that
+  would let an HTML injection run script. Nothing else widens:
+  `TestHTMLCSPCastSender` pins the whole policy string, so another source, or a Cast
+  source leaking into another directive, fails the test.
 - **`style-src` allows `'unsafe-inline'`** deliberately: react-native-web and
   Uniwind inject style rules at runtime, which cannot be hashed ahead of
-  time. This is the single relaxation, confined to the player.
+  time. With the Cast sender's script sources above, it is one of the policy's two
+  relaxations, both confined to the player.
 - Because the hashes are computed from the bytes being served, the policy
   stays correct after the player build is swapped (a new Docker image, a
   refreshed `web_dir`) with no server change.
diff --git a/docs-users/admin/activity.md b/docs-users/admin/activity.md
index c2fb605..e572d82 100644
--- a/docs-users/admin/activity.md
+++ b/docs-users/admin/activity.md
@@ -56,7 +56,7 @@ Below the tiles, when someone listened in the period:
   you picked. The darker a day, the more listening; point at a day to see its
   hours.
 - **When** *your server* **listens**: listening by hour of day and weekday, with
-  the busiest hour in words ("Busiest: Wednesday 21:00").
+  the busiest hour in words ("Busiest: Wednesday 21:00", always on a 24-hour clock).
 - **Top books**: the books listened to most, with how many people listened.
   Click one to open its page.
 - **Top people**: who listened most, with how many books they listened to and
@@ -173,8 +173,9 @@ finished, edit its dates or see its sessions) and their recent sessions. See
 ## What the server records
 
 So that admins can see who is listening and on what, the server keeps a few
-records about each person. Only admins can see them, and they never leave your
-server.
+records about each person. Only admins can see them (apart from what a listener
+chooses to share with the house; see [Listening in the house](#listening-in-the-house)
+below), and they never leave your server.
 
 - **Devices.** For each signed-in device (a phone, a browser, a personal API
   key): its name, which app it is and its version, when it last connected, and
@@ -252,3 +253,26 @@ Deleting an account removes these too: its queue, its collections (and its
 place in other people's shared ones), its ratings and its goal. Deleting a
 library removes its books from everyone's queues, collections and ratings. All
 of it is part of every [backup](backups.md).
+
+### Listening in the house
+
+Listeners can choose to share what they're listening to with the other people on
+the server who share too; who sees what is on
+[Listening in the house](../listening/in-the-house.md#who-shows-up). The server
+keeps only each account's choice, and builds what it shows from the listening
+sessions it already records.
+
+Nothing in the admin console shows who shares or changes anyone's choice. As an
+admin you already see everyone's listening on this page, whether or not they
+share. Deleting an account removes its choice, and it is part of every backup.
+
+### Casting
+
+When a listener [plays a book on a Chromecast](../listening/chromecast.md), their
+app asks the server for a temporary pass for that one book (24 hours, audio and
+cover only), so the Cast device never gets the listener's own sign-in. The pass
+stops working for good when the device that asked for it signs out (including when
+you [sign that device out](users-and-invites.md#the-devices-page)) or when the
+account is deleted. It also doesn't work while the account is disabled or the person
+can't open the book, but it works again if that changes within its 24 hours.
+Passes are not listed as devices in the console.
diff --git a/docs-users/faq.md b/docs-users/faq.md
index 6477b68..9b8d5bf 100644
--- a/docs-users/faq.md
+++ b/docs-users/faq.md
@@ -147,6 +147,14 @@ Separately, the server asks GitHub once a day whether a newer AudioSilo
 version exists (it can be turned off); see
 [What the update check sends](./admin/server.md#what-the-update-check-sends).
 
+### Can other people on my server see what I'm listening to?
+
+Other listeners can't, unless you choose to: **Listening in the house** is off by
+default, and only works between people who have both turned it on. See
+[Listening in the house](./listening/in-the-house.md). Your server's admin is
+different: they can already see everyone's listening in the admin console's
+[Activity](./admin/activity.md#what-the-server-records), whether or not you share.
+
 ## Users & sharing
 
 ### How many users can I have, and can I limit what each one sees?
diff --git a/docs-users/getting-started/remote-access.md b/docs-users/getting-started/remote-access.md
index 2b98e17..9a9381f 100644
--- a/docs-users/getting-started/remote-access.md
+++ b/docs-users/getting-started/remote-access.md
@@ -24,6 +24,10 @@ Because no public authority issued that certificate, every browser shows a "conn
 One practical limit of a self-signed certificate: "install to home screen" for the web player needs a connection the browser fully trusts (or `localhost`). Streaming in a browser tab works fine; for the installable app experience away from `localhost`, use one of the two options below - or the native [mobile apps](../listening/mobile-apps.md).
 :::
 
+:::note Casting needs a certificate the Cast device trusts
+To [cast](../listening/chromecast.md), your server's address must work for the Cast device, which can't click through a certificate warning. The default self-signed certificate won't work. Use HTTPS with a trusted certificate (one of the two options below), or, from the iPhone and Android apps, plain HTTP on your home network set as the [home address](#tell-the-server-its-home-address): behind a [reverse proxy](#behind-a-reverse-proxy), that's AudioSilo's own port (for example `http://192.168.1.20:8080`), not the proxy's. The web player casts only from an HTTPS page, so it needs the trusted certificate.
+:::
+
 ### A real certificate with autocert (Let's Encrypt)
 
 If you have a domain name pointing at your server, the server can obtain and renew a free, browser-trusted certificate for it automatically:
diff --git a/docs-users/listening/account.md b/docs-users/listening/account.md
index caea172..ab43f13 100644
--- a/docs-users/listening/account.md
+++ b/docs-users/listening/account.md
@@ -62,7 +62,7 @@ The list appears on servers new enough to show it.
 
 If you're about to sign out **without a password set**, the app stops you with a warning - *"Without one you'll need a new invite from your admin to sign back in on this server"* - and offers to **Set a password** right there. Take the offer; it's the whole reason the warning exists. If books from this server are downloaded on the device, the warning also says how many you'd lose.
 
-Signing out **removes this server from the app** (the card says so), so it deletes that server's downloaded books from the device and any progress that hasn't synced yet. (Books, progress, and bookmarks stored on the server are safe - sign back in and they're all there.)
+Signing out **takes this server out of your app** and deletes your downloads from it on this device, along with any of your progress that hasn't synced yet. Anyone else on this device signed in to the same server keeps theirs. (Books, progress, and bookmarks stored on the server are safe - sign back in and they're all there.)
 
 :::tip
 Signing out isn't a big deal. Next time you open the connect screen, any server you've connected to before shows a one-tap **Reconnect to &lt;your server&gt;** row - so you only re-enter your code or password, never the server address. See [Connecting and signing in](connecting.md#getting-back-in-after-signing-out).
diff --git a/docs-users/listening/api-keys.md b/docs-users/listening/api-keys.md
index 3fd8837..b3099f4 100644
--- a/docs-users/listening/api-keys.md
+++ b/docs-users/listening/api-keys.md
@@ -5,7 +5,7 @@ description: "Create a personal API key so a dashboard, script, or monitoring to
 
 An **API key** is a long, secret token you create for yourself so another app can talk to your AudioSilo server *as you*, without handing over your password. It is the right tool when you want a home dashboard (such as Heimdall), a script, a cron job, or an uptime monitor to reach your server automatically.
 
-Each key acts as you for everyday requests - browsing your libraries, reading your books, saving your listening progress. You can create as many as you like, name each one, and revoke any of them at any time. (The one thing a key can't do is manage your account itself - it can't create another key or set your password. Those always need you signed in normally, so a leaked key can't lock you out or quietly multiply itself.)
+Each key acts as you for everyday requests - browsing your libraries, reading your books, saving your listening progress. You can create as many as you like, name each one, and revoke any of them at any time. (A key can't manage your account itself - it can't create another key or set your password - and it can't start casting to a Chromecast. Those always need you signed in normally, so a leaked key can't lock you out or quietly multiply itself.)
 
 ## Where to find it
 
diff --git a/docs-users/listening/book-page.md b/docs-users/listening/book-page.md
index 019a607..59b6bba 100644
--- a/docs-users/listening/book-page.md
+++ b/docs-users/listening/book-page.md
@@ -64,6 +64,8 @@ A long description folds after a few lines, with **Show more**. Under it, what's
 
 **Your listening** appears once you've started the book: how long you've **Listened** to it, your **Speed** for it, and when you **Started** and **Finished** it, as far as your server's records go. In the Android app, once [Smart speed](full-player.md#smart-speed-and-voice-boost) has saved time on the book, **Smart speed saved** says how much, on this device.
 
+**In the house** appears when you share what you're listening to and someone else on your server who shares theirs is on this book, with their name and where they are in it (see [Listening in the house](in-the-house.md)).
+
 ## The tabs
 
 Everything else sits in a row of tabs, so a long chapter list never buries the rest. Swipe the row sideways if it doesn't all fit. Some tabs show a count beside their name: the chapters, your bookmarks and notes, and the characters you've met.
diff --git a/docs-users/listening/browsing.md b/docs-users/listening/browsing.md
index ae97ff3..aae20a5 100644
--- a/docs-users/listening/browsing.md
+++ b/docs-users/listening/browsing.md
@@ -32,7 +32,7 @@ From left to right:
 - A **search field**. In the web player it opens [quick search](#quick-search-in-the-web-player); in the tablet app it takes you to the Search page. Where the bar is too narrow for the field (a tablet held upright, say), it shrinks to a search button that does the same.
 - The **Up next** button, with the number of books queued. It opens [Up next](up-next.md).
 - A **gear** button for [Settings](settings.md). It opens Settings over the page you're on, so going back returns you there.
-- Your **profile button** - your initial, plus your name on wider screens. It opens a menu listing your **servers**, each with a line saying who you're signed in as, or that it's **offline** or **needs signing in again** (pick one to open its [account page](account.md)); **Add a server** (in the apps; the web player only reaches its own server); your [Journal](journal.md); [Settings](settings.md); **Account on** your main server; and a switch between **light and dark** appearance.
+- Your **profile button** - your initial, plus your name on wider screens. It opens a menu that starts with who's **Listening as**, then the other people on this device (pick one to switch to them; see [Sharing a device with your household](profiles.md)) and **Who's listening?**, then your **servers**, each with a line saying who you're signed in as, or that it's **offline** or **needs signing in again** (pick one to open its [account page](account.md)); **Add a server** (in the apps; the web player only reaches its own server); your [Journal](journal.md); [Settings](settings.md); **Account on** your main server; and a switch between **light and dark** appearance.
 
 ![The profile menu open from the top bar](/img/screenshots/web-player/profile-menu.png)
 
@@ -58,6 +58,7 @@ The home screen is built around what *you* are doing, not just what's on the ser
 - **This week** - a ring for the books you've finished this year against your yearly goal (or just how many you've finished, if you haven't set one), the hours you've listened in the last seven days, your listening streak, and a small bar for each of the last seven days.
 - **Continue listening** - the other books you've started, most recent first, each showing how much is left. Tap one to open it, or open its [book menu](#the-book-menu) to resume, mark it finished, and more. **All in progress** opens the Library with just those books.
 - **Next in your series** - what comes after the books you're on, or just finished, with a line saying why ("After The Way of Kings, which you're 40% into"). It includes the next book even when you don't have it yet: those show as a pale "ghost" cover marked **Not in your library**, and tapping one opens the series page.
+- **Listening in the house** - when you and others on your server share what you're listening to, what they're on right now or listened to in the last 24 hours. It's off by default; see [Listening in the house](in-the-house.md).
 - **Smart shelves** - saved filters that keep themselves up to date: **Finish what you started**, **Short listens** (under 5 hours), **"Name" reads** for the narrator you've listened to most lately, and **Added this week**. Tap one to open the Library with that filter on (the narrator's shelf opens their page). They appear once there are at least two worth showing.
 - **Recently added**, **Favourites** (once you have some) and **Recently finished**, each with a **See all** link.
 
@@ -166,7 +167,7 @@ What you see here is what your account has been granted - see [Sharing](../admin
 
 ### When your server is older
 
-The Library adapts to what your server can do. Authors, Series and Narrators (and the author, narrator and series pages) need a recent AudioSilo server, and so do Collections, Up next, the This week card, Next in your series, and **Mark as not finished**. On an older server those parts simply don't appear, and everything else works as before. Ask whoever runs your server to update it to get them.
+The Library adapts to what your server can do. Authors, Series and Narrators (and the author, narrator and series pages) need a recent AudioSilo server, and so do Collections, Up next, the This week card, Next in your series, **Mark as not finished**, [Listening in the house](in-the-house.md) and the [Cast](chromecast.md) button. On an older server those parts simply don't appear, and everything else works as before. Ask whoever runs your server to update it to get them.
 
 ## Series pages
 
diff --git a/docs-users/listening/chromecast.md b/docs-users/listening/chromecast.md
new file mode 100644
index 0000000..20babfc
--- /dev/null
+++ b/docs-users/listening/chromecast.md
@@ -0,0 +1,65 @@
+---
+title: Chromecast
+description: "Play a book on a Chromecast, a TV with Google Cast or a Nest speaker: where the Cast button is, what your setup needs (a Cast device on the same network, a server address it can reach, no self-signed certificate), what changes while casting, and stopping."
+---
+
+AudioSilo can play a book on a **Chromecast** or any other Google Cast device: a TV with Chromecast built in, a Google TV, or a Nest speaker. The book plays on the Cast device, and your phone or computer becomes its remote: play and pause, skip, chapters and speed all work from the player, and your place keeps saving to your server as usual.
+
+## The Cast button
+
+The **Cast** button is in the [full player](full-player.md), in its row of buttons with speed, the sleep timer and bookmark. On a tablet or computer it's also on the player bar along the bottom, when the window is wide enough to show all the bar's buttons.
+
+![The web player's full player in Chrome over HTTPS: the Cast button at the end of the row with speed, Sleep and Bookmark](/img/screenshots/web-player/player-cast.png)
+
+Tap it, pick your Cast device, and the book carries on there from where you were. If it was playing, it keeps playing on the Cast device; if it was paused, it waits there paused.
+
+The button appears:
+
+- in the **iPhone and Android apps** (on Android, with Google Play services);
+- in the **web player** in Chrome, Edge and other Chromium-based browsers, when you open the web player over **HTTPS**. Safari and Firefox can't cast, and neither can any browser on an iPhone or iPad.
+
+It only appears while a book is loaded, and only when that book's server runs an AudioSilo version that supports casting (and, in the iPhone and Android apps, a version of the app that has it). On an older server there is no Cast button: updating AudioSilo on the server adds it, and in the apps, updating the app too.
+
+On an iPhone, if AudioSilo hasn't asked before, the first tap brings up a request to use your **local network**: that's how it finds Cast devices. Allow it, or the app can't see any.
+
+## What you need
+
+- **A Cast device on the same network** as your phone or computer.
+- **A server address the Cast device can reach.** The Cast device fetches the book from your server itself. It uses the address your app is connected through at that moment: in the iPhone and Android apps, your [home address](../getting-started/remote-access.md#tell-the-server-its-home-address) when you're at home; in the web player, the address you opened it at. That address must work for the Cast device too:
+  - **Plain HTTP on your home network** works from the iPhone and Android apps, for example `http://192.168.1.20:8080` (the web player casts only from an HTTPS page, so it needs a trusted certificate). A server [behind a reverse proxy](../getting-started/remote-access.md#behind-a-reverse-proxy) serves plain HTTP on its own port, and its home address can point straight at it.
+  - **HTTPS with a trusted certificate** works: a [Let's Encrypt certificate](../getting-started/remote-access.md#a-real-certificate-with-autocert-lets-encrypt), or a [reverse proxy](../getting-started/remote-access.md#behind-a-reverse-proxy) with a real certificate.
+  - **A self-signed certificate does not work.** A Cast device can't click through a certificate warning the way you can in a browser, so it won't play from a server on the default self-signed certificate.
+  - **`localhost` doesn't work.** If the app reaches your server at `localhost` (the server runs on the same computer), the Cast device can't. The Cast button explains this instead of casting. Connect to the server by its network address instead.
+
+A downloaded book casts from your server too, since the Cast device can't read the files on your phone. So casting needs the server to be reachable even for a book you've downloaded.
+
+## Books in other formats
+
+Cast devices play MP3, M4B/M4A (AAC), Ogg, Opus, FLAC and WAV directly. A book in a format they can't play (Apple Lossless, WMA, AC-3 and a few others) is converted by your server on the way, if your server has ffmpeg (see [Do I need ffmpeg?](../faq.md#do-i-need-ffmpeg)). Without it, the Cast button says the book can't be cast. A converted book takes a moment longer to start and to jump to a new place.
+
+## While casting
+
+- **Your place keeps saving** to your server, just as when the book plays on your device, and chapters, skipping and speed all work.
+- **Smart speed, Voice boost and auto-rewind don't apply**: the Cast device plays the plain audio. They come back when the book returns to your device.
+- **The sleep timer** still works: it pauses the Cast device when it runs out. It doesn't fade the volume down first, since the volume is your TV's or speaker's own.
+- You can also pause and play with the TV's remote or the Google Home app; AudioSilo notices and saves your place.
+
+### On an iPhone or iPad
+
+The Cast device keeps playing when you leave the app, but iOS stops AudioSilo soon after, so your place is saved up to when you left. **Keep the app open while casting** for your place to keep saving as you listen. When you come back to the app, it catches up with where the Cast device got to and saves that. The iPhone's lock screen doesn't show controls for a book that's casting.
+
+### On Android
+
+While a book is casting, a **Cast notification** (and the lock screen) has the controls: play and pause, stop casting, and either previous and next, which move between the book's files (a book in several files), or skip back and skip forward (a book in one file). It also keeps AudioSilo running, so your place keeps saving while the app is in the background.
+
+## Stopping
+
+Tap the **Cast** button again and choose to stop casting (in the web player, Chrome's Cast window has the stop button). You can also stop casting from Google Home or the Android notification. The book comes back to your device **paused** at the place the Cast device reached; press play to carry on there. Stopping the book with the TV's own remote only pauses it: the Cast device stays connected, and the next play carries on there.
+
+## If casting doesn't start
+
+The player says what went wrong, and the book stays on your device:
+
+- *"This book can't be cast"* explains why: the server doesn't support casting yet, the app reaches the server at `localhost`, or the book's format can't be played and the server can't convert it.
+- *"Couldn't play on Living Room TV"* (or *"Couldn't start casting"*) usually means the Cast device couldn't reach your server: check the [address and certificate](#what-you-need) above.
+- *"Couldn't connect to the Cast device"* means the Cast device itself didn't answer: check it's on and on the same network.
diff --git a/docs-users/listening/full-player.md b/docs-users/listening/full-player.md
index 15323be..5d9bcf6 100644
--- a/docs-users/listening/full-player.md
+++ b/docs-users/listening/full-player.md
@@ -14,7 +14,7 @@ The full player is about the book you're listening to. Its background takes on t
 - **The status line**: whether your [place is saved](playback.md#your-position-follows-you), how much of the book you've heard, and the [time left](#time-left): *"Synced just now · 38% of the book · 22h 27m left at 1.25×"*. After a big jump it turns into the [undo button](#undo-a-jump), and in a sleep timer's last seconds the [sleep timer's card](sleep-timer.md#the-last-30-seconds) takes its place.
 - **The [seek bar](#the-seek-bar-and-the-timeline)** for the current chapter, and a slim **timeline of the whole book** below it.
 - **The transport**: previous chapter, skip back, play/pause, skip forward, next chapter. The skip buttons show how far they jump (15 seconds back and 30 forward out of the box; change them in [Settings](settings.md#playback)). If playback fails, the play button becomes **Retry**.
-- **The actions**: [speed](#playback-speed), the [sleep timer](sleep-timer.md), **bookmark** (one tap adds one where you are; see [Bookmarks and notes](bookmarks-and-notes.md)), **output** for [AirPlay or Cast](playback.md#play-to-another-speaker-airplay--cast) where your device has one, and [Up next](up-next.md) with how many books are queued. On a tablet or computer, while [Smart speed or Voice boost](#smart-speed-and-voice-boost) is on, one more button says so: *"Saved 2h 11m"* (Android, once Smart speed has saved some), else *"Voice boost"* or *"Smart speed"* for whichever is on. It opens the speed sheet.
+- **The actions**: [speed](#playback-speed), the [sleep timer](sleep-timer.md), **bookmark** (one tap adds one where you are; see [Bookmarks and notes](bookmarks-and-notes.md)), **output** to send the sound to another speaker ([AirPlay](playback.md#play-to-another-speaker-airplay-and-chromecast) on an iPhone, an iPad or in Safari, the system's media output panel on Android) where your device has one, **Cast** to play on a [Chromecast](chromecast.md) when your server supports it, and [Up next](up-next.md) with how many books are queued. On a tablet or computer, while [Smart speed or Voice boost](#smart-speed-and-voice-boost) is on, one more button says so: *"Saved 2h 11m"* (Android, once Smart speed has saved some), else *"Voice boost"* or *"Smart speed"* for whichever is on. It opens the speed sheet.
 
 Beside or below it sits the [companion](companion.md): Who's who, Story so far, the chapters, and your bookmarks, notes and history for the book.
 
diff --git a/docs-users/listening/in-the-car.md b/docs-users/listening/in-the-car.md
index 24cd6af..7971e88 100644
--- a/docs-users/listening/in-the-car.md
+++ b/docs-users/listening/in-the-car.md
@@ -6,7 +6,7 @@ description: "Listening with Android Auto and Apple CarPlay: getting AudioSilo o
 The AudioSilo apps for Android and iPhone can put your books on a car's screen: **Android Auto** on Android, **CarPlay** on iPhone. The car shows the same lists on both, plays through the app on your phone, and saves your place exactly as the phone does. The web player has no car mode.
 
 :::note
-CarPlay isn't available yet: Apple has to approve AudioSilo for CarPlay first (see [Availability](mobile-apps.md#availability)). Until then, AudioSilo doesn't appear in CarPlay.
+Apple has approved AudioSilo for CarPlay, but the iPhone app in the App Store (version 2.0.0) doesn't include it yet: it arrives with a later update (see [Availability](mobile-apps.md#availability)). Until then, AudioSilo doesn't appear in CarPlay.
 :::
 
 ## Getting AudioSilo into the car
@@ -24,7 +24,7 @@ If AudioSilo isn't in the launcher:
 
 ### CarPlay
 
-Once Apple has approved AudioSilo for CarPlay, it appears on the CarPlay home screen like any audio app: connect your iPhone to the car and tap it. It works with your iPhone locked in your pocket, as long as you've unlocked it once since it last restarted; until then it waits, and never signs you out.
+Once your iPhone app has the update that brings CarPlay, AudioSilo appears on the CarPlay home screen like any audio app: connect your iPhone to the car and tap it. It works with your iPhone locked in your pocket, as long as you've unlocked it once since it last restarted; until then it waits, and never signs you out.
 
 ## What the car shows
 
@@ -32,12 +32,12 @@ Up to four lists, as tabs along the car's screen:
 
 - **Continue listening** - the books you're part-way through, on every server you're signed in to, the one you're playing first (the same books as Home's Continue listening).
 - **Up next** - the same [Up next](up-next.md) queue the app shows: the one on the server of the book you're playing, or on your main server when nothing is playing (where that server has a queue).
-- **Downloads** - the books downloaded to your phone, newest first.
+- **Downloads** - your books downloaded to the phone, newest first.
 - **Library** - the most recently added books in the library you have selected.
 
 Each book shows its cover, its author and, once you've started it, the time left at that book's speed (*"Arthur Conan Doyle · 3h 12m left"*). The car also marks how far through each book you are and whether you've finished it. Cars show only so many items, so the longer lists are cut short.
 
-The lists follow what you do on the phone: start a book, pause, add to your queue or finish a download, and the car catches up within a few seconds. If none of your servers can be reached when the car connects, the car keeps the lists it showed last time, and your downloaded books still play. The car's words are in the language you chose for the app.
+When several people share the phone ([profiles](profiles.md)), the car shows only the books of the person listening now, and switching person changes the lists. The lists follow what you do on the phone: start a book, pause, add to your queue or finish a download, and the car catches up within a few seconds. If none of your servers can be reached when the car connects, the car keeps the lists it showed last time, and your downloaded books still play. The car's words are in the language you chose for the app.
 
 ## Playing a book
 
diff --git a/docs-users/listening/in-the-house.md b/docs-users/listening/in-the-house.md
new file mode 100644
index 0000000..c7d80dd
--- /dev/null
+++ b/docs-users/listening/in-the-house.md
@@ -0,0 +1,57 @@
+---
+title: Listening in the house
+description: "See what the other people on your server are listening to, on your Home page and on a book's page: off by default, only between people who both share, and what is and isn't shared."
+---
+
+**Listening in the house** shows what the other people on your server are listening to: who, which book, which chapter, and whether they're listening right now. It's for a household sharing one AudioSilo server, so you can see that your partner is halfway through the book you just finished, or pick up the one the kids are on.
+
+It is **off by default**, and it only works **both ways**: you see the others only while you share yours too, and they see you only while they share theirs.
+
+## Turning it on
+
+Open [Settings](settings.md) and go to **Household and sharing**. Each of your servers that supports it has a switch: **Share what I'm listening to with the house**. Under it, the app says exactly what it does:
+
+*"Your current book shows on the Home page of other people on Hearthside who share theirs too. Off by default."*
+
+(with your server's name in place of *Hearthside*). Turn it on, and from then on you see the others who share, and they see you. Turn it off again whenever you like: you stop showing up for them, and the house disappears from your Home page straight away.
+
+The switch is per server: if you're signed in to two servers, you choose for each one. It belongs to the person listening: when several people share the device ([profiles](profiles.md)), each sees and sets the switches for their own accounts. It only appears for a server running an AudioSilo version that has the feature, and a [demo](../demo.md) account can't turn it on.
+
+## What you see
+
+**On your Home page**, a **Listening in the house** section appears (after *Next in your series*) once someone else who shares has listened in the last day. Its line under the title names the server and says *shared by choice*. Each person gets a card:
+
+- their initials and name, with a small green dot while they're listening right now;
+- the book's title and cover;
+- when, and the chapter: **Listening now**, **Paused**, **Earlier today**, **Yesterday** or **Recently**, then the chapter they're on (*"Listening now · Chapter 4"*).
+
+Tap a card to open that book's page. **Sharing settings** beside the title takes you to the switch. When nobody else is listening, the section isn't shown at all.
+
+![Listening in the house on the Home page: jamie listening now to The Hound of the Baskervilles and rosa paused on The Call of the Wild, with Sharing settings beside the title](/img/screenshots/web-player/home-house.png)
+
+**On a book's page**, an **In the house** card appears when someone who shares is on that same book, with their name and where they are in it.
+
+![A book's page with the In the house card under About: jamie, listening now, and the chapter](/img/screenshots/web-player/book-in-the-house.png)
+
+The house is checked again every minute while the app is open on the Home page or a book's page.
+
+## Who shows up
+
+- Only other people on the same server who have turned sharing on. You never see yourself.
+- Only their most recent book, and only if they listened to it in the last 24 hours.
+- Only books **you** can open yourself. If someone's latest book is in a library or folder you don't have access to, that person doesn't appear at all, rather than showing an older book.
+- Never a demo account, and never an account the admin has disabled.
+
+## What is and isn't shared
+
+Shared, while you have the switch on: your username, the book you listened to most recently (its title, author and cover), your exact place in it and the book's length (the app shows the chapter you're on), and the exact time your app last saved your place (the app shows whether you're listening now, paused, or listened earlier).
+
+**Never shared**: the device you listen on, your network address, or which app you use. None of that is ever sent to other listeners.
+
+The server admin has no screen that shows who shares. An admin can already see everyone's listening in the admin console's [Activity](../admin/activity.md#what-the-server-records), whether or not you share with the house.
+
+## Notes
+
+- While you don't share, the app doesn't ask the server who else is listening at all.
+- It isn't live to the second. A card can be up to a minute behind, and *Listening now* means the person's app saved their place within the last minute.
+- Only listening on this server counts. Listening that an admin [imported](../admin/import.md) from another app doesn't show up in the house.
diff --git a/docs-users/listening/kids-mode.md b/docs-users/listening/kids-mode.md
new file mode 100644
index 0000000..ce1fc25
--- /dev/null
+++ b/docs-users/listening/kids-mode.md
@@ -0,0 +1,52 @@
+---
+title: Kids mode
+description: "A simple AudioSilo for children: one library as big covers, a big player, a bedtime that starts a sleep timer, and a Grown-ups button you hold to leave. Setting it up for a child's profile, and choosing what they can see."
+---
+
+**Kids mode** turns AudioSilo into something a child can use on their own: their stories as big covers, a big simple player, and a bedtime. There's no search, no settings, no downloads page and nothing else to wander into. It works in the iPhone and Android apps and in the web player.
+
+## Setting it up
+
+Kids mode belongs to a [profile](profiles.md): a person on this device. To set one up:
+
+1. **Give the child an account on your server**, and limit what it can see to their books: in the admin console, a [share](../admin/sharing.md) with just the children's library or folders, given to that account (see [Users and invites](../admin/users-and-invites.md)). What the account can open is what kids mode can show: the app never shows a child more than their account is allowed.
+2. **Add the child to the device**: **Add someone** on [Who's listening?](profiles.md#adding-someone), signing in with the child's account. The app then switches to the child.
+3. **Switch back to yourself** (on Who's listening?, or **Switch** on your card in Settings > Household and sharing), then **turn on Kids mode** for the child in [Settings > Household and sharing](settings.md#household-and-sharing), under their name, and pick:
+   - **Library**: the one library kids mode shows, when the child's account can see more than one. Left alone, it's the first one the account lists.
+   - **Bedtime**: when bedtime starts, **7:30 PM** unless you change it (times are written the way the app's language writes them: 7:30 PM in English, 19:30 in the other languages).
+
+If you turn kids mode on while the child is the one listening, the app goes straight into kids mode. To pick the library and bedtime then, hold **Grown-ups**, choose yourself and open Settings > Household and sharing.
+
+Kids mode can't be turned on for the last grown-up on the device: someone has to be able to leave it.
+
+It's a good idea to give the grown-ups' profiles a [PIN](profiles.md#a-pin-for-a-person): leaving kids mode goes through Who's listening?, and without a PIN a child can choose a grown-up there.
+
+## What the child sees
+
+![Kids mode on a computer: Hi Leo, the bedtime card, the big player with a story loaded, and the story tiles](/img/screenshots/web-player/kids.png)
+
+- **"Hi Leo"** at the top, with the **Grown-ups** button.
+- **The bedtime card**: *"Bedtime is at 7:30 PM"*, and what happens then. At bedtime it says *"It's bedtime"*, and while the sleep timer runs, how many minutes it has left.
+- **The story playing now**, in a big player: the cover, the title, the chapter and the minutes left in it, a line showing how far through the chapter they are, and four big buttons: **previous chapter**, **go back 30 seconds**, **play/pause** and **next chapter**. No speed, no sleep menu, no bookmarks.
+- **Your stories**: the library as big cover tiles, the stories they're part-way through first, then every other book, finished ones too (children listen again). Tap one and it plays right there.
+
+![Kids mode on a phone: the bedtime card, the four big player buttons and the story tiles in two columns](/img/screenshots/web-player/phone-kids.png)
+
+If the server can't be reached, kids mode shows the stories downloaded to this device for the child's account, so a downloaded story still plays in the car or on a plane. They come from the child's library when the app knows which one that is: the **Library** you picked, or the one it was showing before the server went away. If the app is opened while the server can't be reached and no Library was picked, every story downloaded for the child's account shows. With no downloads, it says the stories can't load and offers **Try again**.
+
+If the child's account needs signing in again (for example after the server was reset), a banner on the kids screen says so. Signing in again there keeps the child's profile and kids mode.
+
+## Bedtime
+
+From the bedtime you set until **6:00 AM** the next morning, starting or resuming a story starts a **20-minute sleep timer**: the story plays for 20 minutes, then the sound fades out slowly and it stops. It works the same way as the [sleep timer](sleep-timer.md), but the child doesn't have to set anything.
+
+- It never starts in the car (CarPlay or Android Auto).
+- While a kids profile is listening, its bedtime replaces the device's own [automatic sleep timer](sleep-timer.md#starting-a-timer-automatically-at-night) setting; for everyone else on the device that setting is unchanged.
+
+## Leaving kids mode
+
+**Press and hold Grown-ups for 2 seconds.** While it's held the button says *Keep holding* and a fill grows across it; let go early and nothing happens. (With reduced motion on there's no fill, and it still takes the full 2 seconds. A screen reader announces it as a hold to leave kids mode.)
+
+Holding it opens [Who's listening?](profiles.md#whos-listening): choose a grown-up (with their PIN, if they have one) to leave kids mode, or the child again to go back. While a child is listening and a grown-up is on the device, **Add someone** is turned off there ("Choose a grown-up before adding someone."), and so is signing in to a new server or the demo, so a child can't get out of kids mode by adding a new person. Choose a grown-up first. On Android, the back button never takes a child out of kids mode (at most it closes the app).
+
+To stop using kids mode for good, turn **Kids mode** off for that person in Settings > Household and sharing.
diff --git a/docs-users/listening/mobile-apps.md b/docs-users/listening/mobile-apps.md
index c1f2d6e..eb537c5 100644
--- a/docs-users/listening/mobile-apps.md
+++ b/docs-users/listening/mobile-apps.md
@@ -11,7 +11,7 @@ AudioSilo has native apps for **iOS** and **Android**. They're the same player y
 
 - **iOS**: the app is on the **[App Store](https://apps.apple.com/us/app/audiosilo/id6783431375)** - search for AudioSilo, or follow the link.
 - **Android**: the app is on **[Google Play](https://play.google.com/store/apps/details?id=app.audiosilo)** - search for AudioSilo, or follow the link.
-- **CarPlay**: built into the iPhone app, but Apple has to approve an app for CarPlay audio before a car will show it. That approval isn't part of the App Store app yet, so AudioSilo doesn't appear in CarPlay until a later update.
+- **CarPlay**: Apple has approved AudioSilo for CarPlay audio, but the App Store version (2.0.0) doesn't include it yet; it arrives with a later update. Until then, AudioSilo doesn't appear in CarPlay.
 - **Android Auto**: built into the Android app; see [In the car](in-the-car.md#android-auto) for getting it onto the car's screen.
 - **iPhone widgets and the sleep timer Live Activity**: not in the App Store version yet; they arrive with a later update.
 
@@ -50,6 +50,10 @@ Both apps show the current chapter on the lock screen, with a chapter scrubber a
 
 The apps put your books on the car's screen through **Android Auto** and **CarPlay** (see [Availability](#availability)). See [In the car](in-the-car.md).
 
+## Casting to a TV or speaker
+
+Both apps can play a book on a Chromecast, a TV with Google Cast or a Nest speaker, with the phone as the remote. See [Chromecast](chromecast.md) for what your setup needs.
+
 ## Widgets on iPhone
 
 The iPhone app comes with a home screen widget and a Live Activity for the sleep timer (see [Availability](#availability)).
diff --git a/docs-users/listening/offline-downloads.md b/docs-users/listening/offline-downloads.md
index 4245581..c885019 100644
--- a/docs-users/listening/offline-downloads.md
+++ b/docs-users/listening/offline-downloads.md
@@ -61,13 +61,15 @@ Kept files survive closing the app, too. A download the app closed part-way thro
 
 ## Downloads belong to their server
 
-Each downloaded book belongs to the **server you downloaded it from**. If you've connected the app to [more than one server](connecting.md), the Downloads page shows all of them together, but each book stays tied to its own server.
+Each downloaded book belongs to the **server you downloaded it from**, and to the **person** who downloaded it. If you've connected the app to [more than one server](connecting.md), the Downloads page shows all of them together, but each book stays tied to its own server. If you [share the device with your household](profiles.md), the Downloads page shows only the downloads of the person listening; everyone else's stay on the device for them.
+
+If a download belongs to an account that is no longer signed in on this device, it shows in a **Not signed in** group, where you can only remove it to free the space. Signing in to that account again puts it back in its place.
 
 That matters when you disconnect a server:
 
-- **Removing a server** ([Settings > Accounts and devices](settings.md#accounts-and-devices)) or **signing out** of it **deletes that server's downloaded books from this device**, along with any listening progress that hadn't synced back to the server yet.
-- The app warns you first when the server you're removing has books downloaded on the device, so you're never caught out.
-- Your other servers' downloads are untouched, and nothing on the server itself is affected - reconnect and you can download them again any time.
+- **Removing a server** ([Settings > Accounts and devices](settings.md#accounts-and-devices)) or **signing out** of it **deletes the books you downloaded from that server on this device**, along with any of your listening progress that hadn't synced back to the server yet. Someone else on this device who is signed in to the same server with their own account keeps their downloads.
+- The app warns you first when you have books from that server downloaded on the device, so you're never caught out.
+- Your other servers' downloads, and everyone else's on this device, are untouched, and nothing on the server itself is affected - reconnect and you can download them again any time.
 
 :::tip
 If you just want to free up space, use **Remove** on a single book instead - that removes one book and leaves the server connected.
diff --git a/docs-users/listening/playback.md b/docs-users/listening/playback.md
index c02cedc..276c8f3 100644
--- a/docs-users/listening/playback.md
+++ b/docs-users/listening/playback.md
@@ -18,17 +18,19 @@ On an **iPhone running iOS 26 or later**, the mini player is a glass strip insid
 - a thin line along its top edge showing your progress through the whole book;
 - on the left, the cover, the chapter, the book and author, and whether your [place is saved](#your-position-follows-you) - tap it to open the full player;
 - in the middle, previous chapter, skip back, play/pause, skip forward and next chapter, over a scrubber for the current chapter (with a tick for each bookmark) and the time left in the book;
-- on the right, the [undo button](full-player.md#undo-a-jump) after a jump, then speed, the [sleep timer](sleep-timer.md) (with its countdown while one runs), bookmark, output, [Up next](up-next.md), and an arrow that opens the full player.
+- on the right, the [undo button](full-player.md#undo-a-jump) after a jump, then speed, the [sleep timer](sleep-timer.md) (with its countdown while one runs), bookmark, output, [Cast](chromecast.md), [Up next](up-next.md), and an arrow that opens the full player.
 
-When the bar is short of room (a narrower window, or the undo button taking its space), it drops speed, bookmark and output first, then the chapter scrubber and the time left; everything it drops is in the full player.
+When the bar is short of room (a narrower window, or the undo button taking its space), it drops speed, bookmark, output and Cast first, then the chapter scrubber and the time left; everything it drops is in the full player.
 
-## Play to another speaker (AirPlay / Cast)
+## Play to another speaker (AirPlay and Chromecast)
 
-The **output** button in the full player (and on the player bar) hands audio off to another output:
+The **output** button in the full player (and on the player bar; a screen reader calls it **Audio output**) hands audio off to another output:
 
 - **iPhone / iPad** - opens the AirPlay picker, so you can send playback to a HomePod, an Apple TV, or AirPlay speakers.
-- **Android** - opens the system output switcher, for a Bluetooth speaker (an Echo paired as a speaker, for example) or a Cast device.
-- **Web** - uses AirPlay in Safari, or the browser's Cast picker in Chrome. The button only appears in browsers that support one of these; elsewhere it's hidden.
+- **Android** - opens the system's media output panel (or the Bluetooth settings where there isn't one), for a Bluetooth speaker (an Echo paired as a speaker, for example).
+- **Web** - uses AirPlay in Safari. Other browsers have no output picker, so the button is hidden there.
+
+To play on a **Chromecast**, a TV with Google Cast or a Nest speaker, use the **Cast** button beside it instead: see [Chromecast](chromecast.md).
 
 Your position keeps syncing as normal while playing to another device.
 
diff --git a/docs-users/listening/profiles.md b/docs-users/listening/profiles.md
new file mode 100644
index 0000000..ea06a08
--- /dev/null
+++ b/docs-users/listening/profiles.md
@@ -0,0 +1,72 @@
+---
+title: Sharing a device with your household
+description: "Profiles: everyone who listens on one phone, tablet or computer keeps their own place in every book. Who's listening?, Add someone, switching, the optional PIN, removing someone, and links that belong to someone else."
+---
+
+A family tablet, a phone that gets handed round in the car, the computer in the kitchen: when more than one person listens on the same device, each of them can have a **profile** of their own. A profile is a person on this device. Each person signs in with their own AudioSilo account, so each keeps their own place in every book, their own [Up next](up-next.md), [bookmarks](bookmarks-and-notes.md) and [listening stats](you.md). The app shows one person's books and servers at a time: whoever is listening now.
+
+If you were already using AudioSilo when profiles arrived, nothing changes until you add someone: everything you were signed in to is now your profile, and nobody was signed out.
+
+## Who's listening?
+
+**Who's listening?** shows everyone on this device as a large initial in a coloured circle, with a line under each name. The person listening now has a pink ring. Tap someone to switch to them, or **Close** to carry on as you are.
+
+![Who's listening? on a computer: Ellen with the pink ring, Jamie with a key for the PIN, Leo in kids mode with his bedtime, and Add someone](/img/screenshots/web-player/profiles.png)
+
+Open it from:
+
+- **on a phone**, the **Me** tab's **Account** section, under *Listening as*;
+- **on a tablet or computer**, your [profile menu](browsing.md#getting-around) (top right), which also lists the other people to switch to straight away;
+- [Settings > Household and sharing](settings.md#household-and-sharing).
+
+With two or more people on the device it also opens **when the app starts**, so whoever picks it up chooses first. Turn that off with **Ask who's listening when the app opens** in Settings > Household and sharing. It's turned on for you when a second person is added.
+
+## Adding someone
+
+Tap **Add someone** on Who's listening? (or in Settings > Household and sharing). They sign in with **their own account**, on your server or on another one, exactly as when [connecting a server](connecting.md). They become a new person on this device, and the app switches to them.
+
+Each person can have one account on each server. If you sign in to a server where you already have an account, as a different user (a child's account on the family server, say), that account becomes a new person too, rather than replacing yours.
+
+## Switching
+
+When you switch to someone else:
+
+- the book that was playing, if it's the other person's, is paused, its place saved, and put away, so the next person doesn't find someone else's book in the player;
+- the app goes to the new person's Home page, with only their servers, books, downloads, Up next and stats;
+- the [car](in-the-car.md) lists change to the new person's, and the iPhone widget clears until they play something.
+
+Nothing of the other person is lost: their downloads stay on the device, and listening they did offline still syncs to their account in the background.
+
+## A PIN for a person
+
+Each person can have a **PIN**: four digits, asked whenever someone switches **to** that person. It's off by default. Set, change or remove it in Settings > Household and sharing, under that person's **PIN**. Changing or removing a PIN asks for the current one first.
+
+- A wrong PIN says *"That PIN doesn't match"*. After five wrong tries in a row, the prompt makes you wait 30 seconds.
+- Leaving [kids mode](kids-mode.md) goes through Who's listening?, so whoever is chosen there is asked for their PIN.
+- A PIN stays on this device: it isn't your account's password, and the server never sees it. It keeps a person's place and books away from a sibling's taps; it isn't a lock against someone determined to get in.
+
+**Forgotten a PIN?** Remove that person from this device in Settings > Household and sharing (removing someone doesn't ask for their PIN), then sign in to their account again with **Add someone**. Their place in every book is on the server, so nothing is lost.
+
+## Settings > Household and sharing
+
+![Settings, Household and sharing on a computer: Leo's card with Switch, Name, PIN, Kids mode, Library and Bedtime, then Ask who's listening when the app opens and the Listening in the house switch](/img/screenshots/web-player/settings-household.png)
+
+[Settings](settings.md#household-and-sharing) lists everyone on this device. For each person:
+
+- **Switch** to them (the person listening now is marked *Listening now*);
+- **Name**: rename them. The name shows on this device only; their account keeps its username;
+- **PIN**: set, change or remove it (above);
+- **Kids mode**, with its library and bedtime (see [Kids mode](kids-mode.md));
+- **Remove from this device**: signs them out of their servers on this device and deletes their downloads here. Their place in every book stays on the server. If they have no password on a server, the app warns you first: they'll need a new invite to sign in there again.
+
+Below the people: **Who's listening?**, **Add someone**, the **Ask who's listening when the app opens** switch, and [Listening in the house](in-the-house.md#turning-it-on), one switch per server of the person listening.
+
+## When the person listening is removed
+
+If the person listening now is removed from the device, or signs out of their last server, and other people are left, the app asks **Who's listening?** straight away, and it can't be closed: nothing of anyone shows until someone is chosen (with their PIN, if they have one).
+
+## Links to someone else's book
+
+A link can belong to someone else on the device: the iPhone widget or Live Activity left showing their book, a page in the web player's history, a link someone shared. Instead of opening it, the app says **"This belongs to Sam"**, with **Switch to Sam** (asking for Sam's PIN if there is one) and **Go back**. After switching, the page opens where you are.
+
+A link to a server this device is no longer signed in to says **"Not signed in to that server"**, with **Go back**.
diff --git a/docs-users/listening/settings.md b/docs-users/listening/settings.md
index f2fb546..d07c986 100644
--- a/docs-users/listening/settings.md
+++ b/docs-users/listening/settings.md
@@ -40,7 +40,7 @@ Whether AudioSilo should set a [sleep timer](sleep-timer.md) for you at night, s
 | Setting | What it does | Options (default) |
 |---|---|---|
 | **Auto sleep timer** | Start a sleep timer automatically for playback that begins between the hours below | On / Off (default **Off**) |
-| **From** / **Until** | The nightly window it applies to, adjustable in **30-minute steps** and shown in your device's own clock format | Any times (default **10:00 PM** to **6:00 AM**) |
+| **From** / **Until** | The nightly window it applies to, adjustable in **30-minute steps** and written the way the app's language writes times (10:00 PM in English, 22:00 in the other languages) | Any times (default **10:00 PM** to **6:00 AM**) |
 | **Timer type** | What the automatic timer does | End of chapter, or 15 / 30 / 45 / 60 minutes (default **End of chapter**) |
 | **Shake to extend** | A shake keeps a sleep timer going at its end ([Shake to extend](sleep-timer.md#shake-to-extend)); mobile apps only, and the web player says it isn't available in the browser | On / Off (default **On**) |
 | **Shake sensitivity** | How hard that shake has to be (shown while Shake to extend is on) | Low / Medium / High (default **Medium**) |
@@ -87,14 +87,24 @@ The app speaks **English, Español, Français, Deutsch, Português, and Italiano
 
 ## Household and sharing
 
-Profiles - everyone in the house with their own place in every book, a kids mode, and sharing - come in a later update. Until then this section says so, and there's nothing to set.
+![Household and sharing on a computer: a kids profile's card with its Library and Bedtime, Ask who's listening when the app opens, and Share what I'm listening to with the house](/img/screenshots/web-player/settings-household.png)
+
+Everyone who listens on this device, each with their own servers, place in every book, queue and stats (see [Sharing a device with your household](profiles.md)). Each person has a card:
+
+- **Switch** to them, or *Listening now* for the person listening;
+- **Name** - rename them on this device (their account keeps its username);
+- **PIN** - **Set a PIN**, or **Change** and **Remove** it (see [A PIN for a person](profiles.md#a-pin-for-a-person));
+- **Kids mode** - turns this person's app into [kids mode](kids-mode.md), with the **Library** it shows and the **Bedtime** (from then until 6:00 AM, playing starts a 20-minute sleep timer);
+- **Remove from this device** - signs them out of their servers here and deletes their downloads here. Their place in every book stays on the server. It doesn't ask for their PIN: it's the way out of a forgotten one.
+
+Under the people: **Who's listening?** and **Add someone**; **Ask who's listening when the app opens** (with two or more people on the device); and **Listening in the house**, with a **Share what I'm listening to with the house** switch for each server of the person listening that supports it (see [Listening in the house](in-the-house.md#turning-it-on)).
 
 ## Accounts and devices
 
-The servers this device is signed in to, each with your username and its address. Tap one to open your [account on that server](account.md): your password, pairing another device, your signed-in devices, API keys and signing out. **Add a server** connects another one - your home screen, search, and favourites then combine everything (see [Connecting and signing in](connecting.md)). The web player doesn't offer it, since it only reaches the server it's served from. The bin button beside a server removes it from this device.
+The servers you're signed in to on this device (with more than one person on the device, only the person listening's: see [Sharing a device with your household](profiles.md)), each with your username and its address. Tap one to open your [account on that server](account.md): your password, pairing another device, your signed-in devices, API keys and signing out. **Add a server** connects another one - your home screen, search, and favourites then combine everything (see [Connecting and signing in](connecting.md)). The web player doesn't offer it, since it only reaches the server it's served from. The bin button beside a server removes your sign-in to it from this device.
 
 :::warning
-Removing a server also **deletes that server's downloaded books from this device**, plus any listening progress that hasn't synced back yet. The app asks first if the server has downloads on the device. Your other servers are unaffected, and nothing on the server itself is touched. See [Offline downloads](offline-downloads.md).
+Removing a server also **deletes the books you downloaded from it on this device**, plus any of your listening progress that hasn't synced back yet. The app asks first if you have downloads from it on the device. Your other servers, and anyone else on this device signed in to the same server, are unaffected, and nothing on the server itself is touched. See [Offline downloads](offline-downloads.md).
 :::
 
 ## Support AudioSilo
diff --git a/docs-users/troubleshooting.md b/docs-users/troubleshooting.md
index 92e5e59..7bdcfa7 100644
--- a/docs-users/troubleshooting.md
+++ b/docs-users/troubleshooting.md
@@ -204,7 +204,7 @@ progress on the server is intact.
 ### AudioSilo doesn't appear in Android Auto or CarPlay
 
 Android Auto only lists apps installed from Google Play unless you allow
-unknown sources, and AudioSilo isn't in CarPlay until Apple approves it (see
+unknown sources, and CarPlay arrives with an iPhone app update after 2.0.0 (see
 [Availability](./listening/mobile-apps.md#availability)). See
 [Getting AudioSilo into the car](./listening/in-the-car.md#getting-audiosilo-into-the-car)
 for the steps and checks.
diff --git a/screenshots/README.md b/screenshots/README.md
index a1113dc..4a97911 100644
--- a/screenshots/README.md
+++ b/screenshots/README.md
@@ -164,6 +164,44 @@ Every capture context reduces motion, so the Year in listening story stays on it
 card. The desktop You shot picks Stats in the sub-nav first: the Journal shot (opened
 from the profile menu) leaves the Me tab on its Journal section.
 
+The household shots (`web-player/profiles.png`, `settings-household.png`,
+`home-house.png`, `book-in-the-house.png`, `kids.png`, `phone-kids.png`,
+`player-cast.png`) need people rather than the demo user: a demo account can't share
+what it listens to, and the people on a device, their PINs and kids mode live in that
+browser's `localStorage`. So `capture-web.mjs` provisions four accounts through the
+admin API (`ADMIN_PASSWORD`): **ellen** (the viewer, with a place in A Christmas
+Carol), **jamie** and **rosa** (who share; their listening comes from progress saves
+as the apps make them, two 15 s apart, and jamie keeps saving every 15 s, so the house
+shows jamie listening now and rosa paused once the server reads her last save as a
+minute old; she is saved again if more than 5 minutes passed before Home is shot) and
+**leo** (a child, whose account only sees a "Stories" share of the Lewis Carroll and
+Charles Dickens folders). Then it drives the UI as a family would, in a fresh browser:
+Ellen signs in by password, Settings > Household and sharing renames her, "Add
+someone" signs Jamie and Leo in as people of their own, Ellen switches back, gives
+Jamie a PIN, turns kids mode on for Leo (library Books) and turns sharing on. The
+Settings shot is taken at 1440x1000 with Leo's card at the top. Leo's shots choose him
+on "Who's listening?" (a reload asks, with two or more people) and load a story,
+paused; the phone shot reuses that browser's storage. Every household context runs in a
+fixed-offset time zone where it is 8 pm, after Leo's 7:30 pm bedtime, so the kids
+bedtime card reads the same on every run. If setting the household up fails part-way,
+its shots are skipped and keep their previous images. The accounts and the share are
+deleted again at the end, even when a step failed part-way, and their sign-ins are
+taken out of the server's event feed (sqlite3), so the admin console's shots never
+show them (the Audit log keeps the admin's create and delete entries); any accounts
+left over from a run that was killed are deleted before provisioning. A run that only wants
+`player-cast.png` (`SHOTS_ONLY`) provisions Ellen alone.
+
+The Cast button only shows on an https page in a Chromium browser, and for a server
+reached at a loopback address it is only dimmed and explains why it can't cast (its
+name is then "Cast, not available for this book"); the capture server is plain http on
+`127.0.0.1`. For `web-player/player-cast.png` the script starts a local https proxy in
+front of it with a throwaway self-signed certificate (**openssl**, into
+`.cache/cast-tls`, reused while under a day old), on a free port, and opens it as `audiosilo.shots.test` in a separate
+Chromium that resolves that name to `127.0.0.1` and accepts the certificate. Ellen
+signs in there, her book is loaded and paused, and the shot is clipped to the full
+player's transport and action row. Nothing leaves the machine except the Cast sender
+script the button loads from `www.gstatic.com` (offline, the button still shows).
+
 The connect shots run last, in a fresh browser with nothing stored:
 `web-player/connect.png` types the server's own address and presses Continue (the probe
 card), then the run signs in as the **admin** with a username and password (a real
@@ -196,7 +234,7 @@ Every capture is optimized in place with **pngquant** (`brew install pngquant`)
 loss, so the committed image is the optimized one. It's optional: if pngquant
 isn't on `PATH` the shots are just left raw (with a one-time warning).
 
-Prereqs: Go 1.26+, Node 24 (also builds the server's admin console), ffmpeg/ffprobe, sqlite3 (the seeded year of
+Prereqs: Go 1.26+, Node 24 (also builds the server's admin console), ffmpeg/ffprobe, openssl (the Cast shot's certificate), sqlite3 (the seeded year of
 listening), pngquant (optional; for image
 optimization), and a web export at `FRONTEND/dist` (the sibling
 `../../audiosilo-frontend` by default; `audiosilo-server/scripts/build-web.sh`
diff --git a/screenshots/capture-web.mjs b/screenshots/capture-web.mjs
index 900b4c1..5edce4e 100644
--- a/screenshots/capture-web.mjs
+++ b/screenshots/capture-web.mjs
@@ -1,5 +1,5 @@
 // Captures the web-player documentation screenshots against a locally-running
-// AudioSilo server in demo mode (run.sh starts it). Three passes:
+// AudioSilo server in demo mode (run.sh starts it). Four passes:
 //   0. tag two seeded series through the admin API (the LibriVox files carry no
 //      series tags, so the Library's Series section and a series page would be
 //      empty) - needs ADMIN_PASSWORD, which run.sh passes,
@@ -8,15 +8,21 @@
 //      give the demo user an Up next queue, a collection and each WARM book's
 //      records (a place, a finish and rating, bookmarks, notes, history, a
 //      sleep-timer drift-off) through the API,
-//   2. capture desktop, tablet and phone profiles into static/img/screenshots/web-player/.
+//   2. capture desktop, tablet and phone profiles into static/img/screenshots/web-player/,
+//   3. the household: four accounts and a share made through the admin API
+//      (ADMIN_PASSWORD), driven through the UI for the profiles, kids mode and house
+//      shots and, through a local https proxy, the Cast shot, then deleted again.
 import {chromium} from 'playwright';
 import path from 'node:path';
+import http from 'node:http';
+import https from 'node:https';
 import {mkdir} from 'node:fs/promises';
-import {existsSync} from 'node:fs';
+import {existsSync, readFileSync, statSync} from 'node:fs';
 import {execFileSync} from 'node:child_process';
 import {
   CACHE,
   DAY,
+  DESKTOP_CONTEXT,
   HOUR,
   MIN,
   apiClient,
@@ -63,6 +69,15 @@ const drawerClosed = () => {
   }
 };
 
+// A capture context: DESKTOP_CONTEXT (1440x900, retina, dark, motion reduced) with
+// `options` on top (a viewport, stored auth, a time zone...), the Up next drawer
+// closed. `on` is the browser to open it in (the Cast shot has its own).
+async function newCaptureContext(options = {}, on = browser) {
+  const ctx = await on.newContext({...DESKTOP_CONTEXT, ...options});
+  await ctx.addInitScript(drawerClosed);
+  return ctx;
+}
+
 // The warmed books, oldest first (the last is the most recently played, the first
 // Continue listening card the shots open): a title substring of a seeded book (the
 // whole title from its start where a capture opens it by name), the fraction of its
@@ -271,10 +286,9 @@ console.log('== warm demo session ==');
   await ctx.addInitScript(audioHook);
   const page = await ctx.newPage();
   await page.goto(BASE + 'demo', {waitUntil: 'networkidle', timeout: 60000});
-  for (let i = 0; i < 30; i++) {
-    if ((await page.locator('[role="button"]:has(img)').count().catch(() => 0)) > 0) break;
-    await sleep(1000);
-  }
+  // The demo session is ready once Home shows a cover (best effort: the warm-ups below
+  // fail loudly on their own if it never is).
+  await page.locator('[role="button"]:has(img)').first().waitFor({state: 'attached', timeout: 30000}).catch(() => {});
   await sleep(1500);
 
   for (const {q, frac} of WARM) {
@@ -398,16 +412,9 @@ console.log('== warm demo session ==');
 // Every visited page stays mounted but hidden: act through `firstVisible` / `tid`.
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
-async function newProfile(name, viewport, dsf) {
+async function newProfile(name, viewport) {
   console.log(`== ${name} (${viewport.width}x${viewport.height}) ==`);
-  const ctx = await browser.newContext({
-    viewport,
-    deviceScaleFactor: dsf,
-    colorScheme: 'dark',
-    reducedMotion: 'reduce',
-    storageState: AUTH,
-  });
-  await ctx.addInitScript(drawerClosed);
+  const ctx = await newCaptureContext({viewport, storageState: AUTH});
   return {ctx, page: await ctx.newPage()};
 }
 
@@ -443,12 +450,19 @@ async function openFirstBook(page, shot) {
   if (shot) await shoot(page, shot);
 }
 
-// Press the book page's primary button (Resume, Start listening...) and give the book a
-// moment to start; returns when it was pressed.
-async function listen(page) {
-  await firstVisible(page.getByRole('button', {name: PRIMARY_PLAY})).click({timeout: 8000});
+// The play button is named Pause while playing, Play once paused (and while still
+// loading, with a spinner, before it starts by itself) and Retry after a failure.
+const PLAYING_OR_FAILED = /^(pause|retry)$/i;
+
+// Press the book page's primary button (Resume, Start listening...) and wait until the
+// book plays (or failed); returns when the button was pressed. `scope` narrows the
+// transport to one bar (the Cast shot's docked player); with `ifShown` a page without
+// the button (its book already started by itself) is fine.
+async function startPlayback(page, {scope = page, ifShown = false} = {}) {
+  const primary = firstVisible(page.getByRole('button', {name: PRIMARY_PLAY}));
+  if (!ifShown || (await primary.count())) await primary.click({timeout: 8000});
   const at = Date.now();
-  await sleep(4500);
+  await firstVisible(scope.getByRole('button', {name: PLAYING_OR_FAILED})).waitFor({timeout: 20000});
   return at;
 }
 
@@ -467,14 +481,20 @@ const SETTLE_MS = 600;
 const JUMP_UNDO_READY_MS = 8000;
 
 // Stage a paused, healthy player for the shots: a still frame (no moving playhead,
-// no buffering spinner) that reads the same on every run. The play button is named
-// Pause while playing, Play once paused (and while still loading, with a spinner,
-// before it starts by itself) and Retry after a failure: wait for a settled button.
-async function pausePlayback(page) {
-  await firstVisible(page.getByRole('button', {name: /^(pause|retry)$/i})).waitFor({timeout: 20000});
-  const pause = firstVisible(page.getByRole('button', {name: /^pause$/i}));
+// no buffering spinner) that reads the same on every run. Waits for a settled button
+// (PLAYING_OR_FAILED) first, then pauses a playing book.
+async function pausePlayback(page, scope = page) {
+  await firstVisible(scope.getByRole('button', {name: PLAYING_OR_FAILED})).waitFor({timeout: 20000});
+  const pause = firstVisible(scope.getByRole('button', {name: /^pause$/i}));
   if (await pause.count()) await pause.click({timeout: 8000});
-  await firstVisible(page.getByRole('button', {name: /^play$/i})).waitFor({timeout: 8000});
+  await firstVisible(scope.getByRole('button', {name: /^play$/i})).waitFor({timeout: 8000});
+}
+
+// Start the open book and stage it paused (startPlayback, then pausePlayback).
+async function playThenPause(page, opts = {}) {
+  const at = await startPlayback(page, opts);
+  await pausePlayback(page, opts.scope);
+  return at;
 }
 
 // The full player, from the docked bar's expand button (tablet/desktop).
@@ -518,12 +538,12 @@ async function sheetShot(page, testId, shot) {
 
 // Tablet/desktop: one browsing session with a book playing in the docked bar.
 async function captureWide(name, viewport, shots) {
-  const {ctx, page} = await newProfile(name, viewport, 2);
+  const {ctx, page} = await newProfile(name, viewport);
 
   let listenedAt = 0;
   await step('book', async () => {
     await openFirstBook(page, shots.book);
-    listenedAt = await listen(page);
+    listenedAt = await startPlayback(page);
   });
 
   // Home and the pause run whatever SHOTS_ONLY selects, so a partial run stages every
@@ -829,13 +849,12 @@ async function captureWide(name, viewport, shots) {
 // Phone: the primary button opens the full player; closing it leaves the mini player above
 // the tab bar, which the Home shot shows.
 async function capturePhone(name, viewport, shots) {
-  const {ctx, page} = await newProfile(name, viewport, 2);
+  const {ctx, page} = await newProfile(name, viewport);
 
   await step('book + player', async () => {
     await openFirstBook(page, shots.book);
-    await listen(page);
     try {
-      await pausePlayback(page);
+      await playThenPause(page);
       await shoot(page, shots.player);
       if (wanted(shots.speedSheet)) await sheetShot(page, 'player-speed', shots.speedSheet);
       if (wanted(shots.sleepSheet)) await sheetShot(page, 'player-sleep', shots.sleepSheet);
@@ -923,45 +942,534 @@ await capturePhone('phone', {width: 430, height: 932}, {
   settings: 'web-player/phone-settings.png',
 });
 
+// The connect start screen, done once the probe card shows what it found. A served
+// player that asks its own server on open has no address field; one that has the field
+// gets the server's address typed and Continue pressed.
+async function probeServer(page, origin) {
+  await tid(page, 'connect-start').waitFor({timeout: 15000});
+  const field = firstVisible(page.getByRole('textbox', {name: 'Server address'}));
+  if (await field.count()) {
+    await field.fill(origin);
+    await firstVisible(page.getByRole('button', {name: 'Continue', exact: true})).click({timeout: 8000});
+  }
+  await tid(page, 'probe-notice').waitFor({timeout: 15000});
+}
+
+// From the probe card: Sign in, by username and password.
+async function signInWithPassword(page, username, password) {
+  await firstVisible(page.getByRole('button', {name: /^Sign in to /})).click({timeout: 8000});
+  await tid(page, 'sign-in-step').waitFor({timeout: 8000});
+  await firstVisible(page.getByRole('radio', {name: 'Username and password'})).click({timeout: 8000});
+  await firstVisible(page.getByLabel('Username', {exact: true})).fill(username);
+  await firstVisible(page.getByLabel('Password', {exact: true})).fill(password);
+  await firstVisible(page.getByRole('button', {name: 'Sign in', exact: true})).click({timeout: 8000});
+}
+
+// ── Household: profiles, kids mode, listening in the house, Cast ────────────
+// The Phase 8 shots need people, not the demo: a demo account can't share what it
+// listens to, and profiles, PINs and kids mode are this device's (the browser's
+// localStorage), set up by driving the UI as a family would. provisionHouse makes the
+// accounts through the admin API: Ellen (the viewer, with a book on the go), Jamie and
+// Rosa (who share, Jamie listening now and Rosa paused, from progress saves as the
+// apps make them) and Leo (a child, whose account an admin limits to the KIDS_SHARE
+// folders). captureHouse then signs Ellen in on a fresh browser, adds Jamie and Leo
+// with "Add someone", gives Jamie a PIN and Leo kids mode, and turns sharing on for
+// Ellen in Settings > Household. unprovisionHouse deletes the accounts and the share
+// again, and takes their sign-ins out of the server's event feed, so the admin console's
+// shots (captured afterwards) never show them.
+const HOUSE_PASSWORD = 'household-demo';
+const HOUSE_VIEWER = {username: 'ellen', name: 'Ellen', q: 'Christmas Carol', at: 0.4};
+// The others on Ellen's device, in the order "Add someone" adds them.
+const HOUSE_DEVICE = [
+  {username: 'jamie', name: 'Jamie', pin: '2468'},
+  {username: 'leo', name: 'Leo', kids: true},
+];
+// The housemates who share; `live` keeps saving (Listening now), the other stops after
+// two saves, so the house shows it Paused once its last save is a minute old.
+const HOUSE_MATES = [
+  {username: 'jamie', q: 'Hound of the Baskervilles', at: 0.35, live: true},
+  {username: 'rosa', q: 'Call of the Wild', at: 0.62},
+];
+const KIDS_SHARE = {name: 'Stories', paths: ['Lewis Carroll', 'Charles Dickens']};
+const KIDS_STORY = 'Alice';
+const KIDS_USERNAME = HOUSE_DEVICE.find((p) => p.kids).username;
+// Every account the household makes (and a previous, interrupted run may have left).
+const HOUSE_USERNAMES = [...new Set([HOUSE_VIEWER, ...HOUSE_DEVICE, ...HOUSE_MATES].map((p) => p.username))];
+// The server reports a housemate as playing while their newest save is under a minute
+// old (catalog livePlaying), paused up to ten minutes (SessionGap), then only "recent".
+// It stamps a save with its own clock, so a save can't be backdated: the Home shot waits
+// for the paused housemate in real time (houseState), and saves them once more first
+// when their last save is older than this, well inside the ten minutes.
+const HOUSE_RESAVE_AFTER_MS = 5 * MIN;
+const HOUSE_SHOTS = {
+  profiles: 'web-player/profiles.png',
+  household: 'web-player/settings-household.png',
+  homeHouse: 'web-player/home-house.png',
+  bookHouse: 'web-player/book-in-the-house.png',
+  kids: 'web-player/kids.png',
+  phoneKids: 'web-player/phone-kids.png',
+  cast: 'web-player/player-cast.png',
+};
+
+// Kids mode's bedtime card reads the clock: every household context runs in a fixed-offset
+// zone where it is 8 pm now (after Leo's 7:30 pm bedtime), so the card says "It's bedtime"
+// on every run.
+function eveningZone() {
+  const offset = ((20 - new Date().getUTCHours() + 24 + 10) % 24) - 10; // -10..13 hours
+  return offset === 0 ? 'Etc/GMT' : `Etc/GMT${offset > 0 ? '-' : '+'}${Math.abs(offset)}`;
+}
+
+// Make the household's accounts into `house` (see newHouse), recording each as it is
+// made, so unprovisionHouse removes whatever a failure half-way left. Anything an
+// interrupted earlier run left (the accounts, the share) is removed first. `viewerOnly`
+// (a run that only wants the Cast shot) makes Ellen and her book on the go alone.
+const newHouse = () => ({admin: null, users: [], shareId: null, beat: null, mates: [], save: null, ready: false});
+
+async function provisionHouse(house, {viewerOnly = false} = {}) {
+  if (!ADMIN_PASSWORD) throw new Error('ADMIN_PASSWORD not set: no household to provision');
+  const {token: admin} = await api(null, 'POST', '/auth/login', {username: 'admin', password: ADMIN_PASSWORD});
+  house.admin = admin;
+  const stale = ((await api(admin, 'GET', '/admin/users'))?.users ?? []).filter((u) => HOUSE_USERNAMES.includes(u.username));
+  for (const u of stale) await api(admin, 'DELETE', `/admin/users/${u.id}`);
+  const staleShares = ((await api(admin, 'GET', '/admin/shares'))?.shares ?? []).filter((s) => s.name === KIDS_SHARE.name);
+  for (const s of staleShares) await api(admin, 'DELETE', `/admin/shares/${s.id}`);
+  if (stale.length || staleShares.length) {
+    console.log(`  ✓ removed a previous run's ${[...stale.map((u) => u.username), ...staleShares.map((s) => `"${s.name}"`)].join(', ')}`);
+  }
+  const [library] = (await api(admin, 'GET', '/admin/libraries')).libraries;
+  const {books} = await api(admin, 'GET', `/libraries/${library.id}/books?limit=200`);
+  const find = (t) => {
+    const b = books.find((x) => `${x.title} ${x.rel_path}`.includes(t));
+    if (!b) throw new Error(`no seeded book matching "${t}"`);
+    return b;
+  };
+  const names = viewerOnly ? [HOUSE_VIEWER.username] : HOUSE_USERNAMES;
+  for (const username of names) {
+    const made = await api(admin, 'POST', '/admin/users', {username, password: HOUSE_PASSWORD, role: 'user'});
+    const id = made?.user?.id ?? made?.id;
+    house.users.push(id);
+    if (username !== KIDS_USERNAME) {
+      await api(admin, 'POST', '/admin/library-access', {user_id: id, library_id: library.id});
+    } else {
+      const share = await api(admin, 'POST', '/admin/shares', {name: KIDS_SHARE.name});
+      house.shareId = share?.share?.id ?? share?.id;
+      for (const p of KIDS_SHARE.paths) {
+        await api(admin, 'POST', `/admin/shares/${house.shareId}/paths`, {library_id: library.id, path: p});
+      }
+      await api(admin, 'POST', '/admin/share-access', {user_id: id, share_id: house.shareId});
+    }
+  }
+  const progress = (token, book, body, client) =>
+    api(token, 'PUT', `/libraries/${library.id}/progress${pathQuery(book.rel_path)}`, {
+      duration: book.duration,
+      updated_at: new Date().toISOString(),
+      version: Date.now(),
+      ...body,
+    }, client ? {'x-audiosilo-client': client} : {});
+  const login = async (username) =>
+    (await api(null, 'POST', '/auth/login', {username, password: HOUSE_PASSWORD, device_name: `${username}'s phone`})).token;
+
+  // Ellen's book on the go (one save: a place, no listening), so her Home has a Now card.
+  {
+    const token = await login(HOUSE_VIEWER.username);
+    const b = find(HOUSE_VIEWER.q);
+    await progress(token, b, {position: b.duration * HOUSE_VIEWER.at});
+    await api(token, 'POST', '/auth/logout');
+  }
+  if (viewerOnly) {
+    house.ready = true;
+    console.log(`  ✓ household: ${HOUSE_VIEWER.username} only (the Cast shot)`);
+    return;
+  }
+  // The housemates: sharing on, then two saves 15 s apart (a session with listening in
+  // it: the server counts listening only as fast as its own clock runs between two
+  // saves, so this wait is real); the live one keeps saving every 15 s until
+  // unprovisionHouse.
+  for (const m of HOUSE_MATES) {
+    const token = await login(m.username);
+    await api(token, 'PUT', '/me/household', {share_listening: true});
+    const book = find(m.q);
+    house.mates.push({...m, token, book, pos: book.duration * m.at, last: 0});
+  }
+  house.save = (m) => {
+    const now = Date.now();
+    if (m.last) m.pos = Math.min(m.book.duration, m.pos + (now - m.last) / 1000);
+    m.last = now;
+    return progress(m.token, m.book, {position: m.pos, playback_speed: 1, device_id: `${m.username}-phone`}, 'AudioSilo/2.0.0 (ios)');
+  };
+  for (const m of house.mates) await house.save(m);
+  await sleep(15000);
+  for (const m of house.mates) await house.save(m);
+  house.beat = setInterval(() => {
+    for (const m of house.mates.filter((x) => x.live)) {
+      house.save(m).catch((e) => console.log(`  ! heartbeat for ${m.username}: ${e.message}`));
+    }
+  }, 15000);
+  house.ready = true;
+  console.log(`  ✓ household: ${names.join(', ')} (${HOUSE_MATES.map((m) => m.username).join(' and ')} share)`);
+}
+
+// Wait until the server reports housemate `username` as `state` (asked as another
+// housemate, who shares too and so sees them): the state comes from the age of their
+// newest save, so this waits in real time.
+async function houseState(house, username, state, timeoutMs = 2 * MIN) {
+  const viewer = house.mates.find((m) => m.username !== username);
+  const until = Date.now() + timeoutMs;
+  for (;;) {
+    const {listening} = await api(viewer.token, 'GET', '/household/listening');
+    const row = (listening ?? []).find((r) => r.username === username);
+    if (row?.state === state) return;
+    if (Date.now() > until) throw new Error(`the server never reported ${username} as ${state} (last: ${row?.state ?? 'not listed'})`);
+    await sleep(2000);
+  }
+}
+
+async function unprovisionHouse(house) {
+  if (house.beat) clearInterval(house.beat);
+  for (const id of house.users) await api(house.admin, 'DELETE', `/admin/users/${id}`).catch(() => {});
+  if (house.shareId) await api(house.admin, 'DELETE', `/admin/shares/${house.shareId}`).catch(() => {});
+  await api(house.admin, 'POST', '/auth/logout').catch(() => {});
+  // Every household sign-in is also a "New sign-in" server event, which names no user row
+  // and so outlives the account: take those out too, or the Events shot lists them.
+  try {
+    const names = HOUSE_USERNAMES.map((u) => `'${u}'`).join(', ');
+    sqlite(`DELETE FROM server_events WHERE kind = 'new_device' AND json_extract(data, '$.user') IN (${names});`);
+  } catch (e) {
+    console.log(`  ! household sign-ins left in the server's event feed: ${e.message}`);
+  }
+  console.log('  ✓ household accounts removed again');
+}
+
+// Settings > Household and sharing, by its link. A reload is a launch, and with two
+// people on the device it asks "Who's listening?" first: close it.
+async function openHousehold(page) {
+  await page.goto(BASE + 'settings?section=household', {waitUntil: 'networkidle', timeout: 45000});
+  const pane = tid(page, 'settings-pane-household');
+  await pane.or(tid(page, 'profiles-screen')).waitFor({timeout: 15000});
+  if (await tid(page, 'profiles-close').count()) await tid(page, 'profiles-close').click({timeout: 8000});
+  await pane.waitFor({timeout: 15000});
+  await sleep(SETTLE_MS);
+}
+
+// A person's card in the Household pane, by the name it shows.
+const personCard = (page, name) =>
+  firstVisible(
+    page.locator('[data-testid^="household-person-"]').filter({has: page.getByRole('heading', {name, exact: true})}),
+  );
+
+// Rename a person on this device (Household): usernames are lower case, people aren't.
+async function renamePerson(page, from, to) {
+  await firstVisible(page.getByRole('button', {name: `Rename ${from}`})).click({timeout: 8000});
+  await firstVisible(page.getByTestId('rename-field')).fill(to);
+  await firstVisible(page.getByRole('button', {name: 'Save', exact: true})).click({timeout: 8000});
+  await personCard(page, to).waitFor({timeout: 8000});
+}
+
+// The kids screen, choosing the child on "Who's listening?" when a launch asks first, with
+// the story loaded and paused (a still frame).
+async function kidsStaged(page, kidName) {
+  await page.goto(BASE, {waitUntil: 'networkidle', timeout: 45000});
+  const kids = tid(page, 'kids-screen');
+  await kids.or(tid(page, 'profiles-screen')).waitFor({timeout: 15000});
+  if (!(await kids.count())) {
+    await firstVisible(page.getByRole('button', {name: new RegExp(`^${escapeRe(kidName)},`)})).click({timeout: 8000});
+  }
+  await kids.waitFor({timeout: 15000});
+  const player = tid(page, 'kids-player');
+  if (!(await player.count())) {
+    await firstVisible(page.getByRole('button', {name: new RegExp(`^Play ${escapeRe(KIDS_STORY)}`)})).click({timeout: 8000});
+    await player.waitFor({timeout: 15000});
+  }
+  // The play button is named Play while the story loads (a spinner) and once paused,
+  // Pause while it plays: pause it once it plays.
+  const play = tid(page, 'kids-play');
+  await page.waitForFunction(
+    () => document.querySelector('[data-testid="kids-play"]')?.getAttribute('aria-label') === 'Pause',
+    null,
+    {timeout: 20000},
+  );
+  await play.click({timeout: 8000});
+  await page.waitForFunction(
+    () => document.querySelector('[data-testid="kids-play"]')?.getAttribute('aria-label') === 'Play',
+    null,
+    {timeout: 8000},
+  );
+  await sleep(SETTLE_MS);
+  await page.mouse.move(0, 0);
+}
+
+async function captureHouse(house) {
+  const timezoneId = eveningZone();
+  const origin = new URL(BASE).origin;
+  const ctx = await newCaptureContext({timezoneId});
+  const kidsName = HOUSE_DEVICE.find((p) => p.kids).name;
+  try {
+    const page = await ctx.newPage();
+    // Ellen on a fresh browser, then everyone else with "Add someone" (each new person
+    // becomes the one listening), each renamed.
+    let peopleReady = false;
+    await step('household: people', async () => {
+      await page.goto(BASE + 'connect', {waitUntil: 'networkidle', timeout: 45000});
+      await probeServer(page, origin);
+      await signInWithPassword(page, HOUSE_VIEWER.username, HOUSE_PASSWORD);
+      await tid(page, 'ready-screen').waitFor({timeout: 15000});
+      await openHousehold(page);
+      await renamePerson(page, HOUSE_VIEWER.username, HOUSE_VIEWER.name);
+      for (const p of HOUSE_DEVICE) {
+        await firstVisible(page.getByRole('button', {name: 'Add someone', exact: true})).click({timeout: 8000});
+        await probeServer(page, origin);
+        await signInWithPassword(page, p.username, HOUSE_PASSWORD);
+        await tid(page, 'top-bar-profile').waitFor({timeout: 15000});
+        await openHousehold(page);
+        await renamePerson(page, p.username, p.name);
+      }
+      // Back to Ellen, who sets up the others: a PIN, kids mode on one library.
+      await firstVisible(page.getByRole('button', {name: `Switch to ${HOUSE_VIEWER.name}`})).click({timeout: 8000});
+      await tid(page, 'top-bar-(home)').waitFor({timeout: 15000});
+      await openHousehold(page);
+      for (const p of HOUSE_DEVICE.filter((x) => x.pin)) {
+        await firstVisible(page.getByRole('button', {name: `Set a PIN for ${p.name}`})).click({timeout: 8000});
+        const field = firstVisible(page.getByTestId('pin-field'));
+        await field.pressSequentially(p.pin, {delay: 50});
+        await firstVisible(page.getByText('Enter the PIN again')).waitFor({timeout: 8000});
+        await field.pressSequentially(p.pin, {delay: 50});
+        await field.waitFor({state: 'hidden', timeout: 15000});
+      }
+      for (const p of HOUSE_DEVICE.filter((x) => x.kids)) {
+        await firstVisible(page.getByRole('switch', {name: `Kids mode for ${p.name}`})).click({timeout: 8000});
+        // The library the admin's share leaves the account (picked, not the fallback).
+        await personCard(page, p.name).getByRole('button', {name: 'Library', exact: true}).click({timeout: 8000});
+        await firstVisible(page.getByRole('option', {name: 'Books', exact: true})).click({timeout: 8000});
+      }
+      // Ellen shares (the switch settles on the server's answer).
+      const share = /^Share what I'm listening to with the house/;
+      await firstVisible(page.getByRole('switch', {name: share})).click({timeout: 8000});
+      await firstVisible(page.getByRole('switch', {name: share, checked: true})).waitFor({timeout: 8000});
+      console.log(`  ✓ ${[HOUSE_VIEWER, ...HOUSE_DEVICE].map((p) => p.name).join(', ')} on this device`);
+      peopleReady = true;
+    });
+    // A household set up half-way would shoot the wrong state over the committed shots:
+    // they keep their previous images instead.
+    if (!peopleReady) return;
+
+    if (wanted(HOUSE_SHOTS.household)) {
+      // The kids profile's card at the top of a taller window: its kids mode settings,
+      // then "Ask who's listening" and the sharing switch under it.
+      await step('household: settings', async () => {
+        await page.setViewportSize({width: 1440, height: 1000});
+        try {
+          await personCard(page, kidsName).evaluate((el) => el.scrollIntoView({block: 'start'}));
+          await sleep(SETTLE_MS);
+          await page.mouse.move(0, 0);
+          await shoot(page, HOUSE_SHOTS.household);
+        } finally {
+          await page.setViewportSize({width: 1440, height: 900});
+        }
+      });
+    }
+
+    if (wanted(HOUSE_SHOTS.profiles)) {
+      await step('household: who is listening', async () => {
+        await firstVisible(page.getByRole('button', {name: "Who's listening?", exact: true})).click({timeout: 8000});
+        await tid(page, 'profiles-screen').waitFor({timeout: 8000});
+        await sleep(SETTLE_MS);
+        await page.mouse.move(0, 0);
+        await shoot(page, HOUSE_SHOTS.profiles);
+        await tid(page, 'profiles-close').click({timeout: 8000});
+        await tid(page, 'profiles-screen').waitFor({state: 'hidden', timeout: 8000});
+      });
+    }
+
+    if (wanted(HOUSE_SHOTS.homeHouse, HOUSE_SHOTS.bookHouse)) {
+      // Home once the paused housemate reads as paused; the house row in the middle of
+      // the window. Then the live housemate's book, from their card.
+      await step('household: home', async () => {
+        const live = HOUSE_MATES.find((m) => m.live);
+        const paused = HOUSE_MATES.find((m) => !m.live);
+        // Home asks the house when it opens, then once a minute: open it once the server
+        // already says paused, so its first answer does (a save first if a slow run
+        // left the last one near the ten minutes after which a session reads as ended).
+        const mate = house.mates.find((m) => m.username === paused.username);
+        if (Date.now() - mate.last > HOUSE_RESAVE_AFTER_MS) await house.save(mate);
+        await houseState(house, paused.username, 'paused');
+        await tid(page, 'top-bar-(home)').click({timeout: 8000});
+        await firstVisible(page.getByRole('button', {name: new RegExp(`^${paused.username} paused `)})).waitFor({timeout: 90000});
+        await firstVisible(page.getByRole('button', {name: new RegExp(`^${live.username} is listening to `)})).waitFor({timeout: 8000});
+        await firstVisible(page.locator('[data-testid^="house-row-"]')).evaluate((el) => el.scrollIntoView({block: 'center'}));
+        await sleep(SETTLE_MS);
+        await page.mouse.move(0, 0);
+        await shoot(page, HOUSE_SHOTS.homeHouse);
+        if (!wanted(HOUSE_SHOTS.bookHouse)) return;
+        await firstVisible(page.getByRole('button', {name: new RegExp(`^${live.username} is listening to `)})).click({timeout: 8000});
+        await tid(page, 'book-page').waitFor({timeout: 15000});
+        await tid(page, 'in-the-house').waitFor({timeout: 30000});
+        await sleep(SETTLE_MS);
+        await page.mouse.move(0, 0);
+        await shoot(page, HOUSE_SHOTS.bookHouse);
+      });
+    }
+
+    if (wanted(HOUSE_SHOTS.kids, HOUSE_SHOTS.phoneKids)) {
+      // The child, chosen on "Who's listening?" (a reload asks), with a story loaded; then
+      // the same device at phone width.
+      await step('household: kids', async () => {
+        await kidsStaged(page, kidsName);
+        await shoot(page, HOUSE_SHOTS.kids);
+      });
+      if (wanted(HOUSE_SHOTS.phoneKids)) {
+        await step('household: phone kids', async () => {
+          // This device's storage, from the live browser (kidsStaged picks the child itself).
+          const storageState = await ctx.storageState();
+          const phone = await newCaptureContext({viewport: {width: 430, height: 932}, timezoneId, storageState});
+          try {
+            const p = await phone.newPage();
+            await kidsStaged(p, kidsName);
+            await shoot(p, HOUSE_SHOTS.phoneKids);
+          } finally {
+            await phone.close();
+          }
+        });
+      }
+    }
+  } finally {
+    await ctx.close();
+  }
+}
+
+// The Cast button shows only on an https page in a Chromium browser, and for a server
+// this device reaches at a loopback address (which no receiver could) it is only dimmed,
+// explaining instead of casting, under another name; and the
+// capture server is plain http on 127.0.0.1. So this step puts a local https proxy in
+// front of it, with a throwaway self-signed certificate (openssl, in .cache), and opens
+// it under a made-up name that a separate Chromium resolves to 127.0.0.1 (a separate
+// browser because --host-resolver-rules is a launch flag: no context option or route
+// can make a name resolve). Nothing leaves this machine but the Cast sender script the
+// button loads from www.gstatic.com (the button shows without it).
+const CAST_HOST = 'audiosilo.shots.test';
+
+// Whether `file` exists and was written less than a day ago.
+function freshFile(file) {
+  try {
+    return Date.now() - statSync(file).mtimeMs < DAY;
+  } catch {
+    return false;
+  }
+}
+
+async function captureCast() {
+  const dir = path.join(CACHE, 'cast-tls');
+  await mkdir(dir, {recursive: true});
+  const key = path.join(dir, 'key.pem');
+  const cert = path.join(dir, 'cert.pem');
+  // The certificate is good for two days: one made in the last day is reused.
+  if (!(freshFile(cert) && existsSync(key))) {
+    execFileSync('openssl', [
+      'req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '2',
+      '-keyout', key, '-out', cert, '-subj', `/CN=${CAST_HOST}`, '-addext', `subjectAltName=DNS:${CAST_HOST}`,
+    ], {stdio: 'ignore'});
+  }
+  const upstream = new URL(BASE);
+  // Plain requests only. A websocket upgrade is deliberately not proxied (no 'upgrade'
+  // listener, so Node drops it): the shot needs none of the server's live updates.
+  const proxy = https.createServer({key: readFileSync(key), cert: readFileSync(cert)}, (req, res) => {
+    const up = http.request(
+      {host: upstream.hostname, port: upstream.port, method: req.method, path: req.url, headers: req.headers},
+      (r) => {
+        res.writeHead(r.statusCode ?? 502, r.headers);
+        r.pipe(res);
+      },
+    );
+    up.on('error', () => res.destroy());
+    req.pipe(up);
+  });
+  let castBrowser = null;
+  try {
+    await new Promise((resolve, reject) => {
+      proxy.once('error', reject);
+      proxy.listen(0, '127.0.0.1', resolve);
+    });
+    const origin = `https://${CAST_HOST}:${proxy.address().port}`;
+    castBrowser = await chromium.launch({args: [`--host-resolver-rules=MAP ${CAST_HOST} 127.0.0.1`]});
+    const ctx = await newCaptureContext({ignoreHTTPSErrors: true, timezoneId: eveningZone()}, castBrowser);
+    const page = await ctx.newPage();
+    await page.goto(`${origin}/web/connect`, {waitUntil: 'networkidle', timeout: 45000});
+    await probeServer(page, origin);
+    await signInWithPassword(page, HOUSE_VIEWER.username, HOUSE_PASSWORD);
+    await tid(page, 'ready-screen').waitFor({timeout: 15000});
+    await firstVisible(page.getByRole('button', {name: 'Start listening'})).click({timeout: 8000});
+    // Ellen's book on the go, from Home's first cover (the Now card's, which may start it
+    // at once).
+    const card = page.locator('[role="button"]:has(img)').first();
+    await card.waitFor({state: 'visible', timeout: 20000});
+    await card.click({timeout: 12000});
+    await tid(page, 'book-page').waitFor({timeout: 15000});
+    await sleep(SETTLE_MS);
+    await playThenPause(page, {scope: tid(page, 'shell-docked-player'), ifShown: true});
+    await expandPlayer(page);
+    await tid(page, 'companion-tab-chapters').click({timeout: 8000});
+    // The transport and the action row, centred on the play button.
+    const cast = firstVisible(page.getByRole('button', {name: 'Cast', exact: true}));
+    await cast.waitFor({timeout: 30000}).catch(() => {
+      throw new Error(
+        `no enabled Cast button at ${origin}: it shows only in Chromium on an https page, for a book ` +
+          'the server can cast (capability cast), and at a loopback address it only explains',
+      );
+    });
+    await sleep(SETTLE_MS);
+    await page.mouse.move(0, 0);
+    const playBox = await firstVisible(page.getByRole('button', {name: /^play$/i})).boundingBox();
+    const castBox = await cast.boundingBox();
+    if (!playBox || !castBox) throw new Error('no player controls');
+    const cx = playBox.x + playBox.width / 2;
+    const top = playBox.y - 150;
+    await shoot(page, HOUSE_SHOTS.cast, {
+      clip: {x: cx - 420, y: top, width: 840, height: castBox.y + castBox.height + 28 - top},
+    });
+  } finally {
+    await castBrowser?.close();
+    // close() alone waits for the browser's kept-alive connections to time out.
+    proxy.closeAllConnections();
+    proxy.close();
+  }
+}
+
+if (wanted(...Object.values(HOUSE_SHOTS))) {
+  console.log('== household ==');
+  // Only the Cast shot wanted: Ellen alone, no housemates to wait on.
+  const castOnly = !wanted(...Object.entries(HOUSE_SHOTS).filter(([k]) => k !== 'cast').map(([, f]) => f));
+  const house = newHouse();
+  try {
+    await step('provision household', () => provisionHouse(house, {viewerOnly: castOnly}));
+    if (house.ready) {
+      if (!castOnly) await step('household', () => captureHouse(house));
+      if (wanted(HOUSE_SHOTS.cast)) await step('household: cast button', captureCast);
+    }
+  } finally {
+    if (house.admin) await step('remove household', () => unprovisionHouse(house));
+  }
+}
+
 // ── Unauthenticated screens ─────────────────────────────────────────────────
 console.log('== public screens ==');
 // The connect flow on a fresh browser: the start screen with the probe card (the served
-// player finds its own server, nothing typed), then a first connection (the admin, by username and password: a real account, so the
-// account page has its Password card and API keys) to "Your library is ready.", then
+// player finds its own server, nothing typed), then a first connection (the admin, by
+// username and password: a real account, so the account page has its Password card and
+// API keys) to "Your library is ready.", then
 // the account page from the profile menu. That player session is signed out again at
 // the end, so it never shows in the admin Devices shot.
 await step('connect', async () => {
-  const ctx = await browser.newContext({
-    viewport: {width: 1440, height: 900},
-    deviceScaleFactor: 2,
-    colorScheme: 'dark',
-    reducedMotion: 'reduce',
-  });
-  await ctx.addInitScript(drawerClosed);
+  const ctx = await newCaptureContext();
   const page = await ctx.newPage();
   try {
     await page.goto(BASE + 'connect', {waitUntil: 'networkidle', timeout: 45000});
-    await tid(page, 'connect-start').waitFor({timeout: 15000});
-    // The served player asks its own server on open (no address field); a frontend from
-    // before that still needs the address typed.
-    const field = page.getByRole('textbox', {name: 'Server address'});
-    if (await field.count()) {
-      await firstVisible(field).fill(new URL(BASE).origin);
-      await firstVisible(page.getByRole('button', {name: 'Continue', exact: true})).click({timeout: 8000});
-    }
-    await tid(page, 'probe-notice').waitFor({timeout: 15000});
+    await probeServer(page, new URL(BASE).origin);
     await sleep(SETTLE_MS);
     await page.mouse.move(0, 0);
     await shoot(page, 'web-player/connect.png');
     if (!wanted('web-player/connect-ready.png', 'web-player/account.png')) return;
     if (!ADMIN_PASSWORD) throw new Error('ADMIN_PASSWORD not set: no first connection to show');
 
-    await firstVisible(page.getByRole('button', {name: /^Sign in to /})).click({timeout: 8000});
-    await tid(page, 'sign-in-step').waitFor({timeout: 8000});
-    await firstVisible(page.getByRole('radio', {name: 'Username and password'})).click({timeout: 8000});
-    await firstVisible(page.getByLabel('Username', {exact: true})).fill('admin');
-    await firstVisible(page.getByLabel('Password', {exact: true})).fill(ADMIN_PASSWORD);
-    await firstVisible(page.getByRole('button', {name: 'Sign in', exact: true})).click({timeout: 8000});
+    await signInWithPassword(page, 'admin', ADMIN_PASSWORD);
     await tid(page, 'ready-screen').waitFor({timeout: 15000});
     await firstVisible(page.getByRole('button', {name: 'Start listening'})).waitFor({timeout: 8000});
     await sleep(3000); // the library sentence and the shelf
diff --git a/screenshots/lib.mjs b/screenshots/lib.mjs
index 5722e0f..f405840 100644
--- a/screenshots/lib.mjs
+++ b/screenshots/lib.mjs
@@ -28,8 +28,9 @@ export const firstVisible = (locator) => locator.filter({visible: true}).first()
 export const tid = (page, id) => firstVisible(page.getByTestId(id));
 
 // The standard desktop capture context (retina, dark, motion-reduced) shared by
-// the capture scripts. capture-web builds its own parameterized contexts (phone
-// profile, connect/demo variants) on purpose.
+// the capture scripts. capture-web spreads it into its capture contexts
+// (`newCaptureContext`), overriding the viewport where a shot needs it; its warm-up and
+// demo-landing contexts are still built by hand.
 export const DESKTOP_CONTEXT = {
   viewport: {width: 1440, height: 900},
   deviceScaleFactor: 2,
diff --git a/screenshots/manifest.mjs b/screenshots/manifest.mjs
index 0e8ce54..6bcb97f 100644
--- a/screenshots/manifest.mjs
+++ b/screenshots/manifest.mjs
@@ -32,7 +32,7 @@ export const SHOTS = [
   {file: 'web-player/dock-undo.png', capture: 'web', title: 'Web player - Docked bar with Undo', hint: 'the docked player bar (a strip along the window bottom) just after a next-chapter jump: the Back to <time> chip leading the actions'},
   {file: 'web-player/end-credits.png', capture: 'web', title: 'Web player - End credits', hint: 'the end credits, opened early from the full player menu (book paused): shelf or cover, stats, Up next card'},
   {file: 'web-player/palette.png', capture: 'web', title: 'Web player - Quick search', hint: 'the command palette (top bar search / ⌘K) with "holmes" typed: Books and Series groups'},
-  {file: 'web-player/profile-menu.png', capture: 'web', title: 'Web player - Profile menu', hint: "the top bar's profile menu: servers, Add a server, Journal, Settings, account, appearance"},
+  {file: 'web-player/profile-menu.png', capture: 'web', title: 'Web player - Profile menu', hint: "the top bar's profile menu: Listening as (the one person on the demo device) and Who's listening?, servers, Add a server, Journal, Settings, account, appearance"},
   {file: 'web-player/search.png', capture: 'web', title: 'Web player - Search', hint: 'the Search page with "holmes": grouped Books, and Series as the series card with its mini shelf'},
   {file: 'web-player/you-stats.png', capture: 'web', title: 'Web player - Your listening', hint: "You in the top bar (Stats): the header with this week, the four stat tiles (week, streak, goal, daily average), the listening calendar, the clock and hours per week (the seeded year of listening)"},
   {file: 'web-player/year.png', capture: 'web', title: 'Web player - Year in listening', hint: 'You > Year in listening: the story card on stage (held: the pointer parked on it) beside the title, how it works, the thumbnails and Share this card'},
@@ -55,6 +55,15 @@ export const SHOTS = [
   {file: 'web-player/phone-sleep-sheet.png', capture: 'web', title: 'Phone - Sleep sheet', hint: 'the sleep timer sheet over the phone player: minute tiles, End of chapter, Or stop after, the sleep settings'},
   {file: 'web-player/phone-you-stats.png', capture: 'web', title: 'Phone - Your listening', hint: 'the Me tab (the You hub on Stats): the large title Your listening, the sections row (Stats, Year, Journal, Settings, Account), this week and the stat tiles in two columns'},
   {file: 'web-player/phone-settings.png', capture: 'web', title: 'Phone - Settings', hint: 'the Me tab on Settings: the large title Settings, the sections row, the Listening group with the Playback card stacked (steppers, Smart speed, Voice boost)'},
+  // Household (capture-web.mjs's household pass: three people on one device, two
+  // housemates who share, a kids profile; see README.md)
+  {file: 'web-player/profiles.png', capture: 'web', title: "Web player - Who's listening?", hint: "the /profiles picker from Settings > Household: Ellen ringed as listening, Jamie with the PIN key, Leo in kids mode with his bedtime line, and Add someone"},
+  {file: 'web-player/settings-household.png', capture: 'web', title: 'Web player - Settings, Household and sharing', hint: "Settings > Household and sharing (1440x1000), scrolled to Leo's card: Switch, Name, PIN, Kids mode with Library (Books) and Bedtime, Remove from this device; then Who's listening? / Add someone, Ask who's listening when the app opens (on), and the Listening in the house switch (on)"},
+  {file: 'web-player/kids.png', capture: 'web', title: 'Web player - Kids mode', hint: "/kids for Leo at 8 pm (a fixed evening time zone): Hi Leo and Grown-ups: hold, the It's bedtime card with its sleep timer, the kids player with Alice loaded and paused, the story tiles of the account's limited share"},
+  {file: 'web-player/phone-kids.png', capture: 'web', title: 'Phone - Kids mode', hint: 'phone-width /kids on the same device: the bedtime card, the kids player (four big buttons), two columns of story tiles'},
+  {file: 'web-player/home-house.png', capture: 'web', title: 'Web player - Listening in the house', hint: 'Ellen\'s Home scrolled to Listening in the house: jamie listening now and rosa paused (both share), the "<server> · shared by choice" line and Sharing settings'},
+  {file: 'web-player/book-in-the-house.png', capture: 'web', title: 'Web player - In the house card', hint: "the page of the book jamie is listening to, opened from that house card: the aside's About and In the house cards"},
+  {file: 'web-player/player-cast.png', capture: 'web', title: 'Web player - Cast button', hint: 'the full player (book paused), clipped to the transport and the action row ending with the Cast button: an https page through a local proxy in Chromium, server with cast'},
 
   // ── Admin console (admin-ui, desktop 1440x900 dark unless noted) + public server pages
   {file: 'admin/login.png', capture: 'admin', title: 'Admin - Sign in', hint: 'the console sign-in page, signed out'},
diff --git a/screenshots/run.sh b/screenshots/run.sh
index 657a07d..b5572a6 100755
--- a/screenshots/run.sh
+++ b/screenshots/run.sh
@@ -12,7 +12,7 @@
 #   6. backfills placeholders for anything not captured (e.g. the desktop
 #      manager on a headless run - see README.md for manager captures).
 #
-# Prereqs: Go 1.26+, Node 24, ffmpeg/ffprobe, sqlite3, `npm install` +
+# Prereqs: Go 1.26+, Node 24, ffmpeg/ffprobe, sqlite3, openssl, `npm install` +
 # `npx playwright install chromium` in this directory. The web export at
 # FRONTEND/dist (below) is built with audiosilo-server/scripts/build-web.sh when
 # it is missing; an existing one is used as it is.
diff --git a/sidebars-developers.ts b/sidebars-developers.ts
index 90b2869..794f373 100644
--- a/sidebars-developers.ts
+++ b/sidebars-developers.ts
@@ -43,6 +43,7 @@ const sidebars: SidebarsConfig = {
         'frontend/playback',
         'frontend/audio-effects',
         'frontend/native-integrations',
+        'frontend/chromecast',
         'frontend/end-of-book',
         'frontend/sleep-timer',
         'frontend/player-ui',
@@ -50,6 +51,9 @@ const sidebars: SidebarsConfig = {
         'frontend/annotations',
         'frontend/journal',
         'frontend/you-and-settings',
+        'frontend/profiles',
+        'frontend/kids-mode',
+        'frontend/listening-in-the-house',
         'frontend/connect-and-addresses',
         'frontend/offline',
         'frontend/state-and-data',
diff --git a/sidebars-users.ts b/sidebars-users.ts
index 80cd43b..0e1ee43 100644
--- a/sidebars-users.ts
+++ b/sidebars-users.ts
@@ -54,6 +54,10 @@ const sidebars: SidebarsConfig = {
         'listening/offline-downloads',
         'listening/mobile-apps',
         'listening/in-the-car',
+        'listening/chromecast',
+        'listening/profiles',
+        'listening/kids-mode',
+        'listening/in-the-house',
         'listening/you',
         'listening/year-in-listening',
         'listening/settings',
diff --git a/static/img/screenshots/web-player/account.png b/static/img/screenshots/web-player/account.png
index 1dd3718..485e997 100644
Binary files a/static/img/screenshots/web-player/account.png and b/static/img/screenshots/web-player/account.png differ
diff --git a/static/img/screenshots/web-player/author.png b/static/img/screenshots/web-player/author.png
index 7098119..4268f3f 100644
Binary files a/static/img/screenshots/web-player/author.png and b/static/img/screenshots/web-player/author.png differ
diff --git a/static/img/screenshots/web-player/book-bookmarks.png b/static/img/screenshots/web-player/book-bookmarks.png
index 899508c..b36e2b2 100644
Binary files a/static/img/screenshots/web-player/book-bookmarks.png and b/static/img/screenshots/web-player/book-bookmarks.png differ
diff --git a/static/img/screenshots/web-player/book-detail.png b/static/img/screenshots/web-player/book-detail.png
index bd563ce..5721e57 100644
Binary files a/static/img/screenshots/web-player/book-detail.png and b/static/img/screenshots/web-player/book-detail.png differ
diff --git a/static/img/screenshots/web-player/book-details.png b/static/img/screenshots/web-player/book-details.png
index b2bfc36..38715fa 100644
Binary files a/static/img/screenshots/web-player/book-details.png and b/static/img/screenshots/web-player/book-details.png differ
diff --git a/static/img/screenshots/web-player/book-finished.png b/static/img/screenshots/web-player/book-finished.png
index ed9a36f..de481b6 100644
Binary files a/static/img/screenshots/web-player/book-finished.png and b/static/img/screenshots/web-player/book-finished.png differ
diff --git a/static/img/screenshots/web-player/book-in-the-house.png b/static/img/screenshots/web-player/book-in-the-house.png
new file mode 100644
index 0000000..87e137c
Binary files /dev/null and b/static/img/screenshots/web-player/book-in-the-house.png differ
diff --git a/static/img/screenshots/web-player/bookmark-editor.png b/static/img/screenshots/web-player/bookmark-editor.png
index 1a3288c..a8d6e8c 100644
Binary files a/static/img/screenshots/web-player/bookmark-editor.png and b/static/img/screenshots/web-player/bookmark-editor.png differ
diff --git a/static/img/screenshots/web-player/collection.png b/static/img/screenshots/web-player/collection.png
index c8f3bfb..0d8a71a 100644
Binary files a/static/img/screenshots/web-player/collection.png and b/static/img/screenshots/web-player/collection.png differ
diff --git a/static/img/screenshots/web-player/connect-ready.png b/static/img/screenshots/web-player/connect-ready.png
index 91ce0db..e293c10 100644
Binary files a/static/img/screenshots/web-player/connect-ready.png and b/static/img/screenshots/web-player/connect-ready.png differ
diff --git a/static/img/screenshots/web-player/demo.png b/static/img/screenshots/web-player/demo.png
index ea67dc5..cad26cc 100644
Binary files a/static/img/screenshots/web-player/demo.png and b/static/img/screenshots/web-player/demo.png differ
diff --git a/static/img/screenshots/web-player/dock-undo.png b/static/img/screenshots/web-player/dock-undo.png
index dd25f90..9fab8a9 100644
Binary files a/static/img/screenshots/web-player/dock-undo.png and b/static/img/screenshots/web-player/dock-undo.png differ
diff --git a/static/img/screenshots/web-player/downloads.png b/static/img/screenshots/web-player/downloads.png
index 4ea39f9..fd4c13e 100644
Binary files a/static/img/screenshots/web-player/downloads.png and b/static/img/screenshots/web-player/downloads.png differ
diff --git a/static/img/screenshots/web-player/end-credits.png b/static/img/screenshots/web-player/end-credits.png
index 2b2cf0e..8030a3b 100644
Binary files a/static/img/screenshots/web-player/end-credits.png and b/static/img/screenshots/web-player/end-credits.png differ
diff --git a/static/img/screenshots/web-player/home-house.png b/static/img/screenshots/web-player/home-house.png
new file mode 100644
index 0000000..8081a51
Binary files /dev/null and b/static/img/screenshots/web-player/home-house.png differ
diff --git a/static/img/screenshots/web-player/home.png b/static/img/screenshots/web-player/home.png
index 74cab38..83bd949 100644
Binary files a/static/img/screenshots/web-player/home.png and b/static/img/screenshots/web-player/home.png differ
diff --git a/static/img/screenshots/web-player/journal-bookmarks.png b/static/img/screenshots/web-player/journal-bookmarks.png
index 8809b7f..a65d905 100644
Binary files a/static/img/screenshots/web-player/journal-bookmarks.png and b/static/img/screenshots/web-player/journal-bookmarks.png differ
diff --git a/static/img/screenshots/web-player/journal.png b/static/img/screenshots/web-player/journal.png
index f471041..248476c 100644
Binary files a/static/img/screenshots/web-player/journal.png and b/static/img/screenshots/web-player/journal.png differ
diff --git a/static/img/screenshots/web-player/kids.png b/static/img/screenshots/web-player/kids.png
new file mode 100644
index 0000000..48ece06
Binary files /dev/null and b/static/img/screenshots/web-player/kids.png differ
diff --git a/static/img/screenshots/web-player/library-series.png b/static/img/screenshots/web-player/library-series.png
index cbedebe..ef819a8 100644
Binary files a/static/img/screenshots/web-player/library-series.png and b/static/img/screenshots/web-player/library-series.png differ
diff --git a/static/img/screenshots/web-player/library.png b/static/img/screenshots/web-player/library.png
index 118853b..6737157 100644
Binary files a/static/img/screenshots/web-player/library.png and b/static/img/screenshots/web-player/library.png differ
diff --git a/static/img/screenshots/web-player/palette.png b/static/img/screenshots/web-player/palette.png
index 06ec247..4118e36 100644
Binary files a/static/img/screenshots/web-player/palette.png and b/static/img/screenshots/web-player/palette.png differ
diff --git a/static/img/screenshots/web-player/phone-book-detail.png b/static/img/screenshots/web-player/phone-book-detail.png
index 15ab52d..97c27d2 100644
Binary files a/static/img/screenshots/web-player/phone-book-detail.png and b/static/img/screenshots/web-player/phone-book-detail.png differ
diff --git a/static/img/screenshots/web-player/phone-home.png b/static/img/screenshots/web-player/phone-home.png
index ce09977..b2dd43e 100644
Binary files a/static/img/screenshots/web-player/phone-home.png and b/static/img/screenshots/web-player/phone-home.png differ
diff --git a/static/img/screenshots/web-player/phone-kids.png b/static/img/screenshots/web-player/phone-kids.png
new file mode 100644
index 0000000..7c15ee3
Binary files /dev/null and b/static/img/screenshots/web-player/phone-kids.png differ
diff --git a/static/img/screenshots/web-player/phone-player.png b/static/img/screenshots/web-player/phone-player.png
index 0f0af3d..5bf6ea4 100644
Binary files a/static/img/screenshots/web-player/phone-player.png and b/static/img/screenshots/web-player/phone-player.png differ
diff --git a/static/img/screenshots/web-player/phone-sleep-sheet.png b/static/img/screenshots/web-player/phone-sleep-sheet.png
index a845953..5afe81b 100644
Binary files a/static/img/screenshots/web-player/phone-sleep-sheet.png and b/static/img/screenshots/web-player/phone-sleep-sheet.png differ
diff --git a/static/img/screenshots/web-player/phone-speed-sheet.png b/static/img/screenshots/web-player/phone-speed-sheet.png
index f27fcc1..824b390 100644
Binary files a/static/img/screenshots/web-player/phone-speed-sheet.png and b/static/img/screenshots/web-player/phone-speed-sheet.png differ
diff --git a/static/img/screenshots/web-player/phone-up-next.png b/static/img/screenshots/web-player/phone-up-next.png
index 0bb0880..1ea05db 100644
Binary files a/static/img/screenshots/web-player/phone-up-next.png and b/static/img/screenshots/web-player/phone-up-next.png differ
diff --git a/static/img/screenshots/web-player/phone-you-stats.png b/static/img/screenshots/web-player/phone-you-stats.png
index cb83779..8e0af68 100644
Binary files a/static/img/screenshots/web-player/phone-you-stats.png and b/static/img/screenshots/web-player/phone-you-stats.png differ
diff --git a/static/img/screenshots/web-player/player-cast.png b/static/img/screenshots/web-player/player-cast.png
new file mode 100644
index 0000000..6c165e1
Binary files /dev/null and b/static/img/screenshots/web-player/player-cast.png differ
diff --git a/static/img/screenshots/web-player/player.png b/static/img/screenshots/web-player/player.png
index eb7ede4..7a1f558 100644
Binary files a/static/img/screenshots/web-player/player.png and b/static/img/screenshots/web-player/player.png differ
diff --git a/static/img/screenshots/web-player/profile-menu.png b/static/img/screenshots/web-player/profile-menu.png
index d908794..26a24c3 100644
Binary files a/static/img/screenshots/web-player/profile-menu.png and b/static/img/screenshots/web-player/profile-menu.png differ
diff --git a/static/img/screenshots/web-player/profiles.png b/static/img/screenshots/web-player/profiles.png
new file mode 100644
index 0000000..27c7736
Binary files /dev/null and b/static/img/screenshots/web-player/profiles.png differ
diff --git a/static/img/screenshots/web-player/search.png b/static/img/screenshots/web-player/search.png
index f877f02..e739dca 100644
Binary files a/static/img/screenshots/web-player/search.png and b/static/img/screenshots/web-player/search.png differ
diff --git a/static/img/screenshots/web-player/series.png b/static/img/screenshots/web-player/series.png
index 09802d5..4750d28 100644
Binary files a/static/img/screenshots/web-player/series.png and b/static/img/screenshots/web-player/series.png differ
diff --git a/static/img/screenshots/web-player/settings-household.png b/static/img/screenshots/web-player/settings-household.png
new file mode 100644
index 0000000..72aecb1
Binary files /dev/null and b/static/img/screenshots/web-player/settings-household.png differ
diff --git a/static/img/screenshots/web-player/settings.png b/static/img/screenshots/web-player/settings.png
index 8050c9b..6263147 100644
Binary files a/static/img/screenshots/web-player/settings.png and b/static/img/screenshots/web-player/settings.png differ
diff --git a/static/img/screenshots/web-player/tablet-home.png b/static/img/screenshots/web-player/tablet-home.png
index 3baa3c9..c31091c 100644
Binary files a/static/img/screenshots/web-player/tablet-home.png and b/static/img/screenshots/web-player/tablet-home.png differ
diff --git a/static/img/screenshots/web-player/up-next.png b/static/img/screenshots/web-player/up-next.png
index fe66961..e875d4e 100644
Binary files a/static/img/screenshots/web-player/up-next.png and b/static/img/screenshots/web-player/up-next.png differ
diff --git a/static/img/screenshots/web-player/year.png b/static/img/screenshots/web-player/year.png
index 20fd862..c59c47c 100644
Binary files a/static/img/screenshots/web-player/year.png and b/static/img/screenshots/web-player/year.png differ
diff --git a/static/img/screenshots/web-player/you-stats.png b/static/img/screenshots/web-player/you-stats.png
index 2ef3451..1221e05 100644
Binary files a/static/img/screenshots/web-player/you-stats.png and b/static/img/screenshots/web-player/you-stats.png differ