diff --git a/android/README.md b/android/README.md
index 7edd816..549aedc 100644
--- a/android/README.md
+++ b/android/README.md
@@ -53,7 +53,7 @@ fixture so serde/kotlinx drift fails a JVM test.
 
 ## Service and backend bridge
 
-`PlaybackService` (a Media3 `MediaSessionService`, `foregroundServiceType="mediaPlayback"`) owns
+`PlaybackService` (a Media3 `MediaLibraryService`, `foregroundServiceType="mediaPlayback"`) owns
 the one core for the process through `CoreHost`:
 
 - `Event.Backend(BackendCommand)` -> `ExoBackend` -> ExoPlayer. `Load` builds a per-item media
@@ -89,6 +89,39 @@ the one core for the process through `CoreHost`:
   Media3; the service `addSession`s the session in `onCreate` (the UI is not a Media3 controller, so
   `onGetSession` alone would never register it and no notification or foreground promotion would
   happen).
+- Queue: `CoreSessionPlayer`'s playlist is the core's `QueueView` (`Event.QueueChanged`): the last 25
+  history entries, the current one, playing next and upcoming, media ids `queue/<key>`, so Auto's
+  queue view, Wear and the legacy `MediaSession.setQueue` show it. Picking an entry is
+  `JumpToQueueItem`; moving an upcoming entry is `MoveQueueItem` (index into playing next + upcoming);
+  removing is `RemoveQueueItems` (never the current entry); next/previous stay the core's. When the
+  queue's current entry is not the session's track yet, the playlist is that one track.
+- Library browsing: the session is a `MediaLibrarySession`, so Android Auto (the app declares
+  `automotive_app_desc.xml`), Wear, Assistant and any `MediaBrowser` can browse and search the first
+  server's library. `LibraryBrowser` answers from core queries: the root has Albums, Artists,
+  Playlists and Genres (Auto's tabs, with grid/list content-style hints); an album or playlist lists
+  its tracks, an artist or genre its albums; pages map to `Page`. Search is local only
+  (`includeServer = false`). Ids (`MediaIds.kt`) are self-contained and URL-encoded
+  (`album/<server>/<id>/<index>` and so on), so an id kept from an earlier connection still plays.
+  Playing one sends what the UI would send: an album, artist, playlist or genre plays as that context
+  (from the tapped track's index for a track inside one), a search result track via `PlayTracks`.
+  Adding items is `PlayNext` (right after the current entry) or `PlayLater`; artists and genres are
+  too broad to enqueue. Voice "play …" requests (`onAddMediaItems` with a search query) resolve to the
+  best match, honouring `EXTRA_MEDIA_FOCUS`; an empty query resumes. Subscribed browsers hear about
+  library changes (debounced 2 s). The "recent" root is refused, as resumption is.
+- "Allow control by other apps" (`media.externalControl`, device-local, off by default; Settings >
+  Playback) gates all of the above: while off, `onConnect` accepts only the system's own controls
+  (`ExternalControl`: this app, Media3's notification controller, and uids holding the privileged
+  `MEDIA_CONTENT_CONTROL`: SystemUI, Bluetooth; before API 28 the platform's anonymous legacy
+  controller too, since it cannot be identified), and every browse/search/add/custom request is
+  checked again. Turning it off strips already-connected apps of all commands and revokes their
+  artwork access. `PlaybackService` mirrors the value in SharedPreferences (`hocket-media-control`,
+  excluded from backups) so a controller connecting before the core's snapshot is judged by the
+  last choice, not the default.
+- Artwork for controllers: they cannot read the core's cache files, so browse and queue items carry
+  `content://<package>.artwork/<size>/<coverArt>` URIs served by `ArtworkProvider`, which resolves
+  them with `Query.Artwork` and opens the cached file read-only. It is exported (the controller opens
+  the URI with its own identity) but only serves this app and packages the session accepted in
+  `onConnect`.
 - Remote output: while another Connect device plays, `CoreSessionPlayer` reports
   `DeviceInfo(PLAYBACK_TYPE_REMOTE, routingControllerId = "hocket-connect")` (fixed volume: Connect
   volume is per device) and `ConnectRouteProvider` (a `MediaRoute2ProviderService`, API 30+) keeps a
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 78955c5..dc39a95 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -21,6 +21,11 @@
              ExoPlayer never follows an https->http redirect (ExoBackend), and the core only attempts
              the native-API password login over https or loopback. See android/README.md. -->
 
+        <!-- Android Auto lists media apps that declare this; the browse tree is PlaybackService's. -->
+        <meta-data
+            android:name="com.google.android.gms.car.application"
+            android:resource="@xml/automotive_app_desc" />
+
         <activity
             android:name="app.hocket.MainActivity"
             android:exported="true"
diff --git a/android/app/src/main/java/app/hocket/ui/screens/settings/SettingsCategoryScreens.kt b/android/app/src/main/java/app/hocket/ui/screens/settings/SettingsCategoryScreens.kt
index e173313..a57c619 100644
--- a/android/app/src/main/java/app/hocket/ui/screens/settings/SettingsCategoryScreens.kt
+++ b/android/app/src/main/java/app/hocket/ui/screens/settings/SettingsCategoryScreens.kt
@@ -167,7 +167,10 @@ private fun AccentChoices(dynamicLabel: String, swatches: List<Pair<String, Stri
     }
 }
 
-/** Playback & queue: queue mode, how many recent queues to keep, autoplay, sleep-timer defaults. */
+/**
+ * Playback & queue: queue mode, how many recent queues to keep, autoplay, sleep-timer defaults, and
+ * whether other apps (Android Auto, Wear, media browsers) may browse and control playback.
+ */
 @Composable
 fun PlaybackSettingsScreen(nav: NavHostController) {
     val client = LocalCoreClient.current
@@ -176,6 +179,7 @@ fun PlaybackSettingsScreen(nav: NavHostController) {
     val mode = setting(SettingKeys.QUEUE_MODE)
     val sleepMinutes = setting(SettingKeys.SLEEP_DEFAULT_MINUTES)
     val sleepEnd = setting(SettingKeys.SLEEP_STOP_AT_END_OF_TRACK)
+    val externalControl = setting(SettingKeys.MEDIA_EXTERNAL_CONTROL)
     SubScreen(nav, stringResource(R.string.settings_category_playback)) {
         val current = queue.mode
         val appleLabel = stringResource(R.string.queue_mode_apple)
@@ -202,6 +206,8 @@ fun PlaybackSettingsScreen(nav: NavHostController) {
         ChoiceRow(listOf(15, 30, 45, 60, 90).map { it to it.toString() }, isSelected = { minutes == it }, onSelect = { sleepMinutes.setInt(it) }, modifier = Modifier.padding(horizontal = 16.dp),
             describe = { m -> minuteResources.getQuantityString(R.plurals.a11y_minutes, m, m) })
         SwitchRow(stringResource(R.string.sleep_end_of_track), sleepEnd.bool ?: true, { sleepEnd.setBool(it) }, scope = sleepEnd.scope, tag = "sleep.stopAtEndOfTrack")
+        SwitchRow(stringResource(R.string.settings_external_control), externalControl.bool ?: false, { externalControl.setBool(it) },
+            subtitle = stringResource(R.string.settings_external_control_summary), scope = externalControl.scope, tag = "media.externalControl")
     }
 }
 
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index eb0602e..c30ab61 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -244,6 +244,8 @@
     <string name="sleep_off">Off</string>
     <string name="sleep_minutes">%1$d min</string>
     <string name="sleep_end_of_track">Stop at end of track</string>
+    <string name="settings_external_control">Allow control by other apps</string>
+    <string name="settings_external_control_summary">Let apps like Android Auto, Wear and media browsers browse your library, see the queue and control playback. Notification, lock screen and Bluetooth controls always work.</string>
     <string name="sleep_active">Stops in %1$s</string>
     <string name="sleep_active_end_of_track">Stops at end of track</string>
     <string name="sleep_start">Start</string>
diff --git a/android/app/src/main/res/xml/automotive_app_desc.xml b/android/app/src/main/res/xml/automotive_app_desc.xml
new file mode 100644
index 0000000..e64f442
--- /dev/null
+++ b/android/app/src/main/res/xml/automotive_app_desc.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<automotiveApp>
+    <uses name="media" />
+</automotiveApp>
diff --git a/android/app/src/main/res/xml/backup_rules.xml b/android/app/src/main/res/xml/backup_rules.xml
index e7d4835..393cf6b 100644
--- a/android/app/src/main/res/xml/backup_rules.xml
+++ b/android/app/src/main/res/xml/backup_rules.xml
@@ -5,7 +5,9 @@
          downloads and stream cache, the device id (must be unique per install: Connect leases and
          elections; a fresh one is generated when the prefs file is missing) and the keystore
          ciphertext plus names (the key never leaves the device, so the ciphertext is useless elsewhere
-         and the plaintext keys would leak the server address and username). -->
+         and the plaintext keys would leak the server address and username), and the mirror of
+         "allow control by other apps" (a device-local choice: restoring it must not let other apps
+         in on a new device). -->
     <exclude domain="file" path="hocket/cache" />
     <exclude domain="file" path="hocket/downloads" />
     <exclude domain="file" path="hocket/hocket.sqlite" />
@@ -16,4 +18,5 @@
     <exclude domain="sharedpref" path="hocket-core.xml" />
     <exclude domain="sharedpref" path="hocket-credentials.xml" />
     <exclude domain="sharedpref" path="hocket-credential-names.xml" />
+    <exclude domain="sharedpref" path="hocket-media-control.xml" />
 </full-backup-content>
diff --git a/android/app/src/main/res/xml/data_extraction_rules.xml b/android/app/src/main/res/xml/data_extraction_rules.xml
index 04086bc..617e362 100644
--- a/android/app/src/main/res/xml/data_extraction_rules.xml
+++ b/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -12,6 +12,7 @@
         <exclude domain="sharedpref" path="hocket-core.xml" />
         <exclude domain="sharedpref" path="hocket-credentials.xml" />
         <exclude domain="sharedpref" path="hocket-credential-names.xml" />
+        <exclude domain="sharedpref" path="hocket-media-control.xml" />
     </cloud-backup>
     <device-transfer>
         <exclude domain="file" path="hocket/cache" />
@@ -24,5 +25,6 @@
         <exclude domain="sharedpref" path="hocket-core.xml" />
         <exclude domain="sharedpref" path="hocket-credentials.xml" />
         <exclude domain="sharedpref" path="hocket-credential-names.xml" />
+        <exclude domain="sharedpref" path="hocket-media-control.xml" />
     </device-transfer>
 </data-extraction-rules>
diff --git a/android/app/src/test/java/app/hocket/config/ManifestRulesTest.kt b/android/app/src/test/java/app/hocket/config/ManifestRulesTest.kt
index 60803bd..fa341b3 100644
--- a/android/app/src/test/java/app/hocket/config/ManifestRulesTest.kt
+++ b/android/app/src/test/java/app/hocket/config/ManifestRulesTest.kt
@@ -28,11 +28,13 @@ class ManifestRulesTest {
         (0 until childNodes.length).map { childNodes.item(it) }.filterIsInstance<Element>().filter { it.tagName == tag }
 
     /** Everything the device must keep to itself: the library mirror and its backups (large, and a
-     * cache), the Connect device id (must be unique per install) and the keystore ciphertext and names. */
+     * cache), the Connect device id (must be unique per install), the keystore ciphertext and names, and
+     * the "allow control by other apps" mirror (device-local). */
     private val mustExclude = setOf(
         "file:hocket/hocket.sqlite", "file:hocket/hocket.sqlite-wal", "file:hocket/hocket.sqlite-shm", "file:hocket/backups",
         "file:hocket/downloads", "file:hocket/cache",
         "sharedpref:hocket-core.xml", "sharedpref:hocket-credentials.xml", "sharedpref:hocket-credential-names.xml",
+        "sharedpref:hocket-media-control.xml",
     )
 
     private fun excludes(section: Element): Set<String> = section.children("exclude").map { it.getAttribute("domain") + ":" + it.getAttribute("path") }.toSet()
@@ -63,4 +65,28 @@ class ManifestRulesTest {
             assertEquals("$path declares no broadcast receiver", 0, receivers.length)
         }
     }
+
+    @Test
+    fun theLibraryIsPublishedToMediaBrowsersAndAndroidAuto() {
+        val service = parse("android/playback/src/main/AndroidManifest.xml").getElementsByTagName("service").let { list ->
+            (0 until list.length).map { list.item(it) as Element }.single { it.getAttribute("android:name") == "app.hocket.playback.PlaybackService" }
+        }
+        val actions = service.getElementsByTagName("action").let { list -> (0 until list.length).map { (list.item(it) as Element).getAttribute("android:name") } }
+        assertTrue(actions.containsAll(listOf("androidx.media3.session.MediaLibraryService", "android.media.browse.MediaBrowserService")))
+        val meta = parse("android/app/src/main/AndroidManifest.xml").getElementsByTagName("meta-data").let { list -> (0 until list.length).map { list.item(it) as Element } }
+        assertEquals("@xml/automotive_app_desc", meta.single { it.getAttribute("android:name") == "com.google.android.gms.car.application" }.getAttribute("android:resource"))
+        val uses = parse("android/app/src/main/res/xml/automotive_app_desc.xml").documentElement.children("uses").map { it.getAttribute("name") }
+        assertEquals(listOf("media"), uses)
+    }
+
+    @Test
+    fun theArtworkProviderIsTheOnlyProviderAndCannotBeWrittenOrGranted() {
+        // Exported so controllers can open artwork; ArtworkProvider itself checks the caller.
+        val providers = listOf("android/playback/src/main/AndroidManifest.xml", "android/app/src/main/AndroidManifest.xml")
+            .flatMap { path -> parse(path).getElementsByTagName("provider").let { list -> (0 until list.length).map { list.item(it) as Element } } }
+        val provider = providers.single()
+        assertEquals("app.hocket.playback.ArtworkProvider", provider.getAttribute("android:name"))
+        assertFalse(provider.hasAttribute("android:grantUriPermissions"))
+        assertFalse(provider.hasAttribute("android:writePermission"))
+    }
 }
diff --git a/android/app/src/test/java/app/hocket/ui/SettingsCategoriesTest.kt b/android/app/src/test/java/app/hocket/ui/SettingsCategoriesTest.kt
index 03360ba..091a7de 100644
--- a/android/app/src/test/java/app/hocket/ui/SettingsCategoriesTest.kt
+++ b/android/app/src/test/java/app/hocket/ui/SettingsCategoriesTest.kt
@@ -56,7 +56,7 @@ class SettingsCategoriesTest {
 
     /** Registry settings the old page did not show, now in their category. */
     private val added = setOf("queue.mode", "sleep.defaultMinutes", "sleep.stopAtEndOfTrack", "downloads.wifiOnly", "lyrics.defaultOffsetMs", "lyrics.showTranslations",
-        "storage.cacheUsage", "storage.cacheMaxBytes", "storage.prefetchOnMobileData", "storage.dataSaved")
+        "media.externalControl", "storage.cacheUsage", "storage.cacheMaxBytes", "storage.prefetchOnMobileData", "storage.dataSaved")
 
     /** Categories that open one of the older sub-screens: the old page's row for it. */
     private val screenCategories = mapOf(
@@ -67,7 +67,7 @@ class SettingsCategoriesTest {
     private val expected = mapOf(
         SettingsCategory.Account to setOf("sync.master", "server.info", "server.syncNow", "server.fullSync", "server.remove"),
         SettingsCategory.Appearance to setOf("display.theme", "display.accent", "display.artworkColour", "display.animatedBackground"),
-        SettingsCategory.Playback to setOf("queue.mode", "queue.savedCap", "queue.autoplay", "sleep.defaultMinutes", "sleep.stopAtEndOfTrack"),
+        SettingsCategory.Playback to setOf("queue.mode", "queue.savedCap", "queue.autoplay", "sleep.defaultMinutes", "sleep.stopAtEndOfTrack", "media.externalControl"),
         SettingsCategory.Downloads to setOf("open.downloads", "downloads.wifiOnly", "storage.clearCache", "storage.warnThreshold", "storage.cacheUsage", "storage.cacheMaxBytes", "storage.prefetchOnMobileData", "storage.dataSaved"),
         SettingsCategory.Lyrics to setOf("lyrics.external", "lyrics.defaultOffsetMs", "lyrics.showTranslations"),
         SettingsCategory.Library to setOf("ratings.loveThreshold", "open.filters", "open.stats"),
diff --git a/android/core/src/main/java/app/hocket/core/SettingKeys.kt b/android/core/src/main/java/app/hocket/core/SettingKeys.kt
index 61209af..a8f7cd4 100644
--- a/android/core/src/main/java/app/hocket/core/SettingKeys.kt
+++ b/android/core/src/main/java/app/hocket/core/SettingKeys.kt
@@ -19,6 +19,8 @@ object SettingKeys {
     const val RATINGS_LOVE_BRIDGE_ENABLED = "ratings.loveBridge.enabled"
     const val RATINGS_LOVE_BRIDGE_THRESHOLD = "ratings.loveBridge.threshold"
     const val BATTERY_AUTO_ENGAGE = "battery.autoEngage"
+    /** Other apps (Auto, Wear, media browsers) may browse and control playback. Off by default. */
+    const val MEDIA_EXTERNAL_CONTROL = "media.externalControl"
     const val BATTERY_LYRICS_FPS = "battery.lyricsFps"
     const val BATTERY_SMALL_ARTWORK = "battery.smallArtwork"
     const val BATTERY_PAUSE_PREFETCH = "battery.pausePrefetch"
diff --git a/android/core/src/main/java/app/hocket/core/fake/FakeCore.kt b/android/core/src/main/java/app/hocket/core/fake/FakeCore.kt
index f2482ce..6222a8b 100644
--- a/android/core/src/main/java/app/hocket/core/fake/FakeCore.kt
+++ b/android/core/src/main/java/app/hocket/core/fake/FakeCore.kt
@@ -138,6 +138,7 @@ class FakeCore(
         def(SettingKeys.RATINGS_LOVE_BRIDGE_ENABLED, "false", SettingScope.AccountSynced)
         def(SettingKeys.RATINGS_LOVE_BRIDGE_THRESHOLD, "4", SettingScope.AccountSynced)
         def(SettingKeys.BATTERY_AUTO_ENGAGE, "true", SettingScope.DeviceLocal)
+        def(SettingKeys.MEDIA_EXTERNAL_CONTROL, "false", SettingScope.DeviceLocal)
         def(SettingKeys.BATTERY_LYRICS_FPS, "30", SettingScope.DeviceLocal)
         def(SettingKeys.BATTERY_SMALL_ARTWORK, "true", SettingScope.DeviceLocal)
         def(SettingKeys.BATTERY_PAUSE_PREFETCH, "true", SettingScope.DeviceLocal)
diff --git a/android/playback/src/main/AndroidManifest.xml b/android/playback/src/main/AndroidManifest.xml
index f32ef52..1769bc0 100644
--- a/android/playback/src/main/AndroidManifest.xml
+++ b/android/playback/src/main/AndroidManifest.xml
@@ -19,6 +19,7 @@
             android:exported="true"
             android:foregroundServiceType="mediaPlayback">
             <intent-filter>
+                <action android:name="androidx.media3.session.MediaLibraryService" />
                 <action android:name="androidx.media3.session.MediaSessionService" />
                 <action android:name="android.media.browse.MediaBrowserService" />
             </intent-filter>
@@ -34,6 +35,13 @@
                 <action android:name="android.media.MediaRoute2ProviderService" />
             </intent-filter>
         </service>
+        <!-- Cover art for the apps browsing the library (Auto, Wear, MediaBrowsers): they cannot read
+             the core's cache files. Exported because a controller opens the URI itself, but
+             ArtworkProvider only serves callers the session accepted as controllers, read-only. -->
+        <provider
+            android:name="app.hocket.playback.ArtworkProvider"
+            android:authorities="${applicationId}.artwork"
+            android:exported="true" />
         <!-- Media buttons: Media3 declares its own androidx.media3.session.MediaButtonReceiver (it
              FGS-starts the service only for a PLAY key while nothing plays). The legacy
              androidx.media.session.MediaButtonReceiver must not be declared as well: exported with a
diff --git a/android/playback/src/main/java/app/hocket/playback/ArtworkProvider.kt b/android/playback/src/main/java/app/hocket/playback/ArtworkProvider.kt
new file mode 100644
index 0000000..6be39fc
--- /dev/null
+++ b/android/playback/src/main/java/app/hocket/playback/ArtworkProvider.kt
@@ -0,0 +1,70 @@
+package app.hocket.playback
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.database.Cursor
+import android.net.Uri
+import android.os.ParcelFileDescriptor
+import app.hocket.core.ArtworkSizes
+import app.hocket.core.Queries
+import app.hocket.core.api.QueryResult
+import java.io.File
+import java.io.FileNotFoundException
+import java.util.concurrent.ConcurrentHashMap
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeoutOrNull
+
+/**
+ * Serves cover art to the apps browsing the library ([LibraryBrowser]): Android Auto, Wear and
+ * other `MediaBrowser`s get `content://<package>.artwork/<size>/<coverArt>` URIs, since they cannot
+ * read the core's cache files. Opening one resolves it through `Query.Artwork` (fetching it into the
+ * cache if needed) and hands back the cached file read-only.
+ *
+ * Exported, because a controller reads the URI with its own identity, but only callers the session
+ * has accepted as controllers ([allow], from `onConnect`) and this app itself may open anything;
+ * everyone else gets a `SecurityException`. Sizes are the core's fixed cache sizes only.
+ */
+class ArtworkProvider : ContentProvider() {
+    companion object {
+        private const val TIMEOUT_MS = 10_000L
+        private val SIZES = setOf(ArtworkSizes.THUMB, ArtworkSizes.LIST, ArtworkSizes.GRID, ArtworkSizes.FULL)
+        private val allowed: MutableSet<String> = ConcurrentHashMap.newKeySet()
+
+        fun authority(context: Context): String = "${context.packageName}.artwork"
+
+        fun uri(context: Context, coverArt: String, size: Int = ArtworkSizes.GRID): Uri =
+            Uri.Builder().scheme("content").authority(authority(context)).appendPath(size.toString()).appendPath(coverArt).build()
+
+        /** Lets [packageName] (a connected media controller) open artwork URIs until [revokeAll]. */
+        fun allow(packageName: String) { allowed += packageName }
+
+        internal fun isAllowed(packageName: String?, own: String): Boolean = packageName != null && (packageName == own || packageName in allowed)
+
+        /** Nobody but this app may open artwork again until controllers reconnect. */
+        fun revokeAll() = allowed.clear()
+    }
+
+    override fun onCreate(): Boolean = true
+
+    override fun openFile(uri: Uri, mode: String): ParcelFileDescriptor {
+        val ctx = context ?: throw FileNotFoundException(uri.toString())
+        if (mode != "r") throw SecurityException("artwork is read-only")
+        if (!isAllowed(callingPackage, ctx.packageName)) throw SecurityException("not a connected media controller")
+        val segments = uri.pathSegments
+        val size = segments.getOrNull(0)?.toIntOrNull()?.takeIf { it in SIZES } ?: throw FileNotFoundException(uri.toString())
+        val coverArt = segments.getOrNull(1)?.takeIf { segments.size == 2 && it.isNotEmpty() } ?: throw FileNotFoundException(uri.toString())
+        val core = CoreHost.current ?: throw FileNotFoundException("no core running")
+        // A binder thread: blocking on the core's (possibly fetching) answer is fine, bounded.
+        val path = runBlocking { withTimeoutOrNull(TIMEOUT_MS) { runCatching { (core.query(Queries.artwork(coverArt, size)) as? QueryResult.Path)?.data }.getOrNull() } }
+            ?: throw FileNotFoundException(uri.toString())
+        val file = File(path.removePrefix("file://"))
+        return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY)
+    }
+
+    override fun getType(uri: Uri): String = "image/*"
+    override fun query(uri: Uri, projection: Array<out String>?, selection: String?, selectionArgs: Array<out String>?, sortOrder: String?): Cursor? = null
+    override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+    override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<out String>?): Int = 0
+}
diff --git a/android/playback/src/main/java/app/hocket/playback/CoreSessionPlayer.kt b/android/playback/src/main/java/app/hocket/playback/CoreSessionPlayer.kt
index c75efd4..f4f9397 100644
--- a/android/playback/src/main/java/app/hocket/playback/CoreSessionPlayer.kt
+++ b/android/playback/src/main/java/app/hocket/playback/CoreSessionPlayer.kt
@@ -1,6 +1,7 @@
 package app.hocket.playback
 
 import android.net.Uri
+import androidx.media3.common.C
 import androidx.media3.common.DeviceInfo
 import androidx.media3.common.MediaItem
 import androidx.media3.common.MediaMetadata
@@ -11,6 +12,9 @@ import app.hocket.core.Commands
 import app.hocket.core.api.Command
 import app.hocket.core.api.MediaSessionAction
 import app.hocket.core.api.MediaSessionState
+import app.hocket.core.api.QueueEntry
+import app.hocket.core.api.QueueView
+import app.hocket.core.api.TrackSummary
 import app.hocket.core.api.RepeatMode
 import app.hocket.core.client.PositionClock
 import com.google.common.util.concurrent.Futures
@@ -25,6 +29,14 @@ import android.os.Looper
  * device), so the OS notification, lockscreen, Bluetooth and headset controls must reflect the
  * session, not the local decoder. Position is extrapolated from the stamp the same way the UI does.
  *
+ * The playlist is the core's queue ([applyQueue]): recent history, the current entry, playing next
+ * and upcoming, keyed by queue key (media id `queue/<key>`), so controllers show it as the session
+ * queue (Auto's queue view, legacy `MediaSession.setQueue`). Picking an entry is a
+ * `JumpToQueueItem`, moving and removing upcoming entries are `MoveQueueItem` / `RemoveQueueItems`,
+ * and items a controller sets or adds (library ids from [LibraryBrowser]) go to [MediaRequests].
+ * The current entry's metadata is always the session's own; when the queue does not agree with it
+ * (the view has not caught up yet) the playlist is that one item.
+ *
  * While another device plays ([remote]), the player reports remote playback
  * ([DeviceInfo.PLAYBACK_TYPE_REMOTE], fixed volume) with [ConnectRoutes.SESSION_ID] as its routing
  * controller id, so the system pairs the session with [ConnectRouteProvider]'s routing session and
@@ -34,10 +46,55 @@ class CoreSessionPlayer(
     looper: Looper,
     private val dispatch: (Command) -> Unit,
     private val now: () -> Double = { System.currentTimeMillis().toDouble() },
+    private val media: MediaRequests? = null,
+    private val artwork: (TrackSummary) -> Uri? = { null },
 ) : SimpleBasePlayer(looper) {
+    /** What the player does with media ids a controller sets or adds ([LibraryBrowser]). */
+    interface MediaRequests {
+        fun play(mediaIds: List<String>, startIndex: Int)
+        fun enqueue(mediaIds: List<String>, next: Boolean)
+    }
+
+    companion object {
+        /** History entries shown before the current one: enough to go back, small over binder. */
+        const val HISTORY_SHOWN = 25
+
+        private val REMOTE_DEVICE: DeviceInfo = DeviceInfo.Builder(DeviceInfo.PLAYBACK_TYPE_REMOTE)
+            .setRoutingControllerId(ConnectRoutes.SESSION_ID)
+            .build()
+
+        /**
+         * The timeline for [queue] around the playing track: the last [HISTORY_SHOWN] history
+         * entries, the current one, playing next, upcoming. Empty when the queue's current entry is
+         * not [currentTrackId] (or there is none).
+         */
+        fun timeline(queue: QueueView?, currentTrackId: String?): QueueTimeline {
+            val current = queue?.current ?: return QueueTimeline.EMPTY
+            if (currentTrackId != null && current.track.id != currentTrackId) return QueueTimeline.EMPTY
+            val history = queue.history.takeLast(HISTORY_SHOWN)
+            return QueueTimeline(history + current + queue.playingNext + queue.upcoming, history.size)
+        }
+    }
+
+    /** The queue entries the playlist shows and where the current one is. */
+    data class QueueTimeline(val entries: List<QueueEntry>, val currentIndex: Int) {
+        /** Index into the core's combined playing-next + upcoming list (`MoveQueueItem.toIndex`). */
+        fun upcomingIndex(index: Int): Int = index - currentIndex - 1
+
+        companion object { val EMPTY = QueueTimeline(emptyList(), 0) }
+    }
+
     private var current: MediaSessionState = MediaSessionState(null, false, app.hocket.core.api.PositionStamp(0u, 0.0, 1.0, false), false, RepeatMode.Off, 1.0, emptyList(), true)
     private var clockOffsetMs = 0.0
     private var remote = false
+    private var queue: QueueView? = null
+    private var timeline = QueueTimeline.EMPTY
+
+    /** Apply a new queue view from the core. Main thread. */
+    fun applyQueue(view: QueueView) {
+        queue = view
+        invalidateState()
+    }
 
     /** Apply a new state from the core and notify controllers. Main thread. */
     fun apply(state: MediaSessionState, clockOffsetMs: Double = this.clockOffsetMs, remote: Boolean = this.remote) {
@@ -55,6 +112,7 @@ class CoreSessionPlayer(
     override fun getState(): State {
         val s = current
         val meta = s.metadata
+        timeline = if (meta == null) QueueTimeline.EMPTY else timeline(queue, meta.trackId)
         val commands = Player.Commands.Builder().apply {
             add(Player.COMMAND_PLAY_PAUSE); add(Player.COMMAND_STOP); add(Player.COMMAND_PREPARE)
             add(Player.COMMAND_GET_CURRENT_MEDIA_ITEM); add(Player.COMMAND_GET_METADATA); add(Player.COMMAND_GET_TIMELINE)
@@ -62,7 +120,10 @@ class CoreSessionPlayer(
             add(Player.COMMAND_SET_REPEAT_MODE); add(Player.COMMAND_SET_SHUFFLE_MODE)
             if (MediaSessionAction.Next in s.actions) { add(Player.COMMAND_SEEK_TO_NEXT); add(Player.COMMAND_SEEK_TO_NEXT_MEDIA_ITEM) }
             if (MediaSessionAction.Previous in s.actions) { add(Player.COMMAND_SEEK_TO_PREVIOUS); add(Player.COMMAND_SEEK_TO_PREVIOUS_MEDIA_ITEM) }
-            if (MediaSessionAction.Seek in s.actions) { add(Player.COMMAND_SEEK_IN_CURRENT_MEDIA_ITEM); add(Player.COMMAND_SEEK_BACK); add(Player.COMMAND_SEEK_FORWARD); add(Player.COMMAND_SEEK_TO_MEDIA_ITEM) }
+            if (MediaSessionAction.Seek in s.actions) { add(Player.COMMAND_SEEK_IN_CURRENT_MEDIA_ITEM); add(Player.COMMAND_SEEK_BACK); add(Player.COMMAND_SEEK_FORWARD) }
+            if (MediaSessionAction.Seek in s.actions || timeline.entries.size > 1) add(Player.COMMAND_SEEK_TO_MEDIA_ITEM)
+            if (timeline.entries.size > 1) add(Player.COMMAND_CHANGE_MEDIA_ITEMS)
+            if (media != null) { add(Player.COMMAND_SET_MEDIA_ITEM); add(Player.COMMAND_CHANGE_MEDIA_ITEMS) }
         }.build()
         val builder = State.Builder()
             .setAvailableCommands(commands)
@@ -86,16 +147,24 @@ class CoreSessionPlayer(
                 .setUserRating(androidx.media3.common.HeartRating(meta.loved))
                 .apply { meta.artworkPath?.let { setArtworkUri(if (it.startsWith("file:") || it.startsWith("content:")) Uri.parse(it) else Uri.fromFile(java.io.File(it))) } }
                 .build()
-            val item = MediaItem.Builder().setMediaId(meta.trackId ?: "current").setMediaMetadata(mm).build()
-            builder.setPlaylist(listOf(
-                MediaItemData.Builder(meta.trackId ?: "current")
-                    .setMediaItem(item)
-                    .setMediaMetadata(mm)
-                    .setDurationUs(Util.msToUs(meta.durationMs.toLong()))
-                    .setIsSeekable(MediaSessionAction.Seek in s.actions)
-                    .build(),
-            ))
-            builder.setCurrentMediaItemIndex(0)
+            val seekable = MediaSessionAction.Seek in s.actions
+            val durationUs = Util.msToUs(meta.durationMs.toLong())
+            if (timeline.entries.isEmpty()) {
+                val id = meta.trackId ?: "current"
+                builder.setPlaylist(listOf(MediaItemData.Builder(id).setMediaItem(MediaItem.Builder().setMediaId(id).setMediaMetadata(mm).build()).setMediaMetadata(mm).setDurationUs(durationUs).setIsSeekable(seekable).build()))
+                builder.setCurrentMediaItemIndex(0)
+            } else {
+                builder.setPlaylist(timeline.entries.mapIndexed { i, entry ->
+                    val id = MediaId.QueueItem(entry.item.key).format()
+                    if (i == timeline.currentIndex) {
+                        MediaItemData.Builder(id).setMediaItem(MediaItem.Builder().setMediaId(id).setMediaMetadata(mm).build()).setMediaMetadata(mm).setDurationUs(durationUs).setIsSeekable(seekable).build()
+                    } else {
+                        val em = trackMetadata(entry.track, artwork(entry.track))
+                        MediaItemData.Builder(id).setMediaItem(MediaItem.Builder().setMediaId(id).setMediaMetadata(em).build()).setMediaMetadata(em).setDurationUs(Util.msToUs(entry.track.durationMs.toLong())).build()
+                    }
+                })
+                builder.setCurrentMediaItemIndex(timeline.currentIndex)
+            }
             val stamp = s.position
             val duration = meta.durationMs.toLong()
             builder.setContentPositionMs { PositionClock.extrapolate(stamp, now(), clockOffsetMs, duration) }
@@ -104,12 +173,6 @@ class CoreSessionPlayer(
         return builder.build()
     }
 
-    private companion object {
-        val REMOTE_DEVICE: DeviceInfo = DeviceInfo.Builder(DeviceInfo.PLAYBACK_TYPE_REMOTE)
-            .setRoutingControllerId(ConnectRoutes.SESSION_ID)
-            .build()
-    }
-
     override fun handleSetPlayWhenReady(playWhenReady: Boolean): ListenableFuture<*> {
         dispatch(Commands.mediaSessionCommand(if (playWhenReady) MediaSessionAction.Play else MediaSessionAction.Pause))
         return Futures.immediateVoidFuture()
@@ -149,11 +212,46 @@ class CoreSessionPlayer(
     }
 
     override fun handleSeek(mediaItemIndex: Int, positionMs: Long, seekCommand: Int): ListenableFuture<*> {
-        when (seekCommand) {
-            Player.COMMAND_SEEK_TO_NEXT, Player.COMMAND_SEEK_TO_NEXT_MEDIA_ITEM -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Next))
-            Player.COMMAND_SEEK_TO_PREVIOUS, Player.COMMAND_SEEK_TO_PREVIOUS_MEDIA_ITEM -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Previous))
-            else -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Seek, positionMs.coerceAtLeast(0).toDouble()))
+        val t = timeline
+        when {
+            seekCommand == Player.COMMAND_SEEK_TO_NEXT || seekCommand == Player.COMMAND_SEEK_TO_NEXT_MEDIA_ITEM -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Next))
+            seekCommand == Player.COMMAND_SEEK_TO_PREVIOUS || seekCommand == Player.COMMAND_SEEK_TO_PREVIOUS_MEDIA_ITEM -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Previous))
+            // Another queue entry (a controller's queue view): jump to it.
+            mediaItemIndex != C.INDEX_UNSET && mediaItemIndex != t.currentIndex && mediaItemIndex in t.entries.indices ->
+                dispatch(Commands.jumpToQueueItem(t.entries[mediaItemIndex].item.key))
+            else -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Seek, (if (positionMs == C.TIME_UNSET) 0L else positionMs).coerceAtLeast(0).toDouble()))
+        }
+        return Futures.immediateVoidFuture()
+    }
+
+    override fun handleMoveMediaItems(fromIndex: Int, toIndex: Int, newIndex: Int): ListenableFuture<*> {
+        // Only upcoming entries move, and only among upcoming entries: history and the current
+        // entry are not the core's to reorder.
+        val t = timeline
+        val moved = t.entries.subList(fromIndex.coerceIn(0, t.entries.size), toIndex.coerceIn(0, t.entries.size))
+        if (moved.isNotEmpty() && fromIndex > t.currentIndex && newIndex > t.currentIndex) {
+            moved.forEachIndexed { i, entry -> dispatch(Commands.moveQueueItem(entry.item.key, t.upcomingIndex(newIndex) + i)) }
         }
         return Futures.immediateVoidFuture()
     }
+
+    override fun handleRemoveMediaItems(fromIndex: Int, toIndex: Int): ListenableFuture<*> {
+        val t = timeline
+        val keys = t.entries.subList(fromIndex.coerceIn(0, t.entries.size), toIndex.coerceIn(0, t.entries.size))
+            .filterIndexed { i, _ -> fromIndex + i != t.currentIndex }
+            .map { it.item.key }
+        if (keys.isNotEmpty()) dispatch(Commands.removeQueueItems(keys))
+        return Futures.immediateVoidFuture()
+    }
+
+    override fun handleAddMediaItems(index: Int, mediaItems: List<MediaItem>): ListenableFuture<*> {
+        // Right after the current entry is "play next"; anywhere later is "play later".
+        media?.enqueue(mediaItems.map { it.mediaId }, next = timeline.entries.isEmpty() || index <= timeline.currentIndex + 1)
+        return Futures.immediateVoidFuture()
+    }
+
+    override fun handleSetMediaItems(mediaItems: List<MediaItem>, startIndex: Int, startPositionMs: Long): ListenableFuture<*> {
+        if (mediaItems.isNotEmpty()) media?.play(mediaItems.map { it.mediaId }, if (startIndex == C.INDEX_UNSET) 0 else startIndex)
+        return Futures.immediateVoidFuture()
+    }
 }
diff --git a/android/playback/src/main/java/app/hocket/playback/ExternalControl.kt b/android/playback/src/main/java/app/hocket/playback/ExternalControl.kt
new file mode 100644
index 0000000..80e4b3a
--- /dev/null
+++ b/android/playback/src/main/java/app/hocket/playback/ExternalControl.kt
@@ -0,0 +1,64 @@
+package app.hocket.playback
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+import android.os.Process
+
+/**
+ * "Allow control by other apps" (`media.externalControl`): whether apps other than the system may
+ * connect to the media session, i.e. browse the library, see the queue and control playback
+ * (Android Auto, Wear, media browsers, automation apps). Off by default.
+ *
+ * The system's own controls always work, whatever the setting: this app, and callers holding
+ * `MEDIA_CONTENT_CONTROL` (a privileged permission: SystemUI's notification and lock-screen
+ * controls, Bluetooth AVRCP, the system itself; checked by uid). Before Android 9 the platform does
+ * not say which app sent a legacy `MediaController` command, so those anonymous callers are let
+ * through there; otherwise the system's controls would stop working on those versions. Media3's
+ * notification controller is checked by the session ([MediaSessionBridge]).
+ *
+ * The value belongs to the core; this class keeps a copy in SharedPreferences so that a controller
+ * connecting while the service starts (before the core's snapshot arrives) is judged by the last
+ * known choice rather than by the default. The copy is excluded from backups, like the core's own
+ * store.
+ */
+class ExternalControl(
+    context: Context,
+    private val sdk: Int = Build.VERSION.SDK_INT,
+    /** True when [uid] holds `MEDIA_CONTENT_CONTROL` (or is the system). */
+    private val hasMediaContentControl: (uid: Int) -> Boolean = { uid ->
+        context.applicationContext.checkPermission(MEDIA_CONTENT_CONTROL, -1, uid) == PackageManager.PERMISSION_GRANTED
+    },
+) {
+    companion object {
+        const val PREFS = "hocket-media-control"
+        private const val KEY_ALLOWED = "allowed"
+        const val MEDIA_CONTENT_CONTROL = "android.permission.MEDIA_CONTENT_CONTROL"
+        /** What Media3 reports for a legacy controller the platform did not identify (before API 28). */
+        const val LEGACY_CONTROLLER = "android.media.session.MediaController"
+    }
+
+    private val prefs = context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+
+    /** Whether other apps are allowed in now. */
+    var allowed: Boolean = prefs.getBoolean(KEY_ALLOWED, false)
+        private set
+
+    /** Applies the core's value; true when it changed. */
+    fun update(allowed: Boolean): Boolean {
+        if (allowed == this.allowed) return false
+        this.allowed = allowed
+        prefs.edit().putBoolean(KEY_ALLOWED, allowed).apply()
+        return true
+    }
+
+    /** This app or the system (see the class docs): never subject to the setting. */
+    fun isSystem(packageName: String, uid: Int): Boolean = when {
+        uid == Process.myUid() -> true
+        uid >= 0 && hasMediaContentControl(uid) -> true
+        sdk < Build.VERSION_CODES.P && packageName == LEGACY_CONTROLLER -> true
+        else -> false
+    }
+
+    fun permits(packageName: String, uid: Int): Boolean = allowed || isSystem(packageName, uid)
+}
diff --git a/android/playback/src/main/java/app/hocket/playback/LibraryBrowser.kt b/android/playback/src/main/java/app/hocket/playback/LibraryBrowser.kt
new file mode 100644
index 0000000..2969c24
--- /dev/null
+++ b/android/playback/src/main/java/app/hocket/playback/LibraryBrowser.kt
@@ -0,0 +1,299 @@
+package app.hocket.playback
+
+import android.content.Context
+import android.net.Uri
+import android.os.Bundle
+import android.provider.MediaStore
+import android.util.Log
+import androidx.media3.common.MediaItem
+import androidx.media3.common.MediaMetadata
+import androidx.media3.session.MediaConstants
+import app.hocket.core.Commands
+import app.hocket.core.CoreHandle
+import app.hocket.core.Queries
+import app.hocket.core.api.Album
+import app.hocket.core.api.Artist
+import app.hocket.core.api.Command
+import app.hocket.core.api.Genre
+import app.hocket.core.api.MediaSessionAction
+import app.hocket.core.api.Page
+import app.hocket.core.api.Playlist
+import app.hocket.core.api.QueryResult
+import app.hocket.core.api.SearchResults
+import app.hocket.core.api.Track
+import app.hocket.core.api.TrackSummary
+import app.hocket.core.toSummary
+import java.util.UUID
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
+
+/**
+ * The library as other apps see it: the browse tree of the [MediaSessionBridge]'s library session
+ * (Android Auto, Wear, Assistant, any `MediaBrowser`), its search, and what the session's player does
+ * with a media id a controller asks it to play or enqueue.
+ *
+ * Everything is a core query on the first server, the same one the UI shows; nothing is cached here
+ * (the core's mirror is local, so browsing works offline). Ids are [MediaId]s. Artwork is a
+ * [ArtworkProvider] content URI, since a controller cannot read the core's cache files.
+ *
+ * Play requests become the same commands the UI sends: an album, artist, playlist or genre plays as
+ * that context (from the tapped track, for a track inside one), a lone track via `PlayTracks`, a
+ * queue entry is a jump. Enqueued items become `PlayNext` / `PlayLater`.
+ */
+class LibraryBrowser(
+    private val context: Context,
+    private val core: () -> CoreHandle,
+    private val serverId: () -> String?,
+    private val scope: CoroutineScope,
+) : CoreSessionPlayer.MediaRequests {
+    companion object {
+        private const val TAG = "LibraryBrowser"
+        /** Id of the item a voice "play something" (empty query) resolves to: resume the session. */
+        const val RESUME = "resume"
+        const val SEARCH_LIMIT = 25
+        /** Enough to enqueue a whole playlist in one query. */
+        private const val PLAYLIST_ALL = 10_000
+
+        private const val STYLE_LIST = MediaConstants.EXTRAS_VALUE_CONTENT_STYLE_LIST_ITEM
+        private const val STYLE_GRID = MediaConstants.EXTRAS_VALUE_CONTENT_STYLE_GRID_ITEM
+
+        /** Root extras: search works, and children may carry content style hints. */
+        fun rootExtras(): Bundle = Bundle().apply {
+            putBoolean("android.media.browse.CONTENT_STYLE_SUPPORTED", true)
+            putBoolean("android.media.browse.SEARCH_SUPPORTED", true)
+            putInt(MediaConstants.EXTRAS_KEY_CONTENT_STYLE_BROWSABLE, STYLE_GRID)
+            putInt(MediaConstants.EXTRAS_KEY_CONTENT_STYLE_PLAYABLE, STYLE_LIST)
+        }
+
+        private fun style(browsable: Int, playable: Int = STYLE_LIST) = Bundle().apply {
+            putInt(MediaConstants.EXTRAS_KEY_CONTENT_STYLE_BROWSABLE, browsable)
+            putInt(MediaConstants.EXTRAS_KEY_CONTENT_STYLE_PLAYABLE, playable)
+        }
+    }
+
+    // -- browse tree -------------------------------------------------------------------------------
+
+    fun root(): MediaItem = folder(MediaId.Root, context.getString(R.string.browse_root), MediaMetadata.MEDIA_TYPE_FOLDER_MIXED, rootExtras())
+
+    /** The children of [parentId], one page; null when [parentId] is not a browsable id of ours. */
+    suspend fun children(parentId: String, page: Int, pageSize: Int): List<MediaItem>? {
+        val id = MediaId.parse(parentId) ?: return null
+        val window = Page((page.coerceAtLeast(0).toLong() * pageSize).coerceAtMost(UInt.MAX_VALUE.toLong()).toUInt(), pageSize.coerceAtLeast(1).toUInt())
+        return when (id) {
+            MediaId.Root -> LibrarySection.entries.map(::section).window(window)
+            is MediaId.Section -> {
+                val server = serverId() ?: return emptyList()
+                when (id.section) {
+                    LibrarySection.Albums -> (query(Queries.albums(server, window)) as? QueryResult.Albums)?.data?.items.orEmpty().map(::album)
+                    LibrarySection.Artists -> (query(Queries.artists(server, window)) as? QueryResult.Artists)?.data?.items.orEmpty().map(::artist)
+                    LibrarySection.Playlists -> (query(Queries.playlists(server)) as? QueryResult.Playlists)?.data.orEmpty().map(::playlist).window(window)
+                    LibrarySection.Genres -> (query(Queries.genres(server)) as? QueryResult.Genres)?.data.orEmpty().map { genre(server, it) }.window(window)
+                }
+            }
+            is MediaId.Album -> albumTracks(id.id).mapIndexed { i, t -> track(t.toSummary(), MediaId.AlbumTrack(id.serverId, id.id, i)) }.window(window)
+            is MediaId.Artist -> (query(Queries.albums(id.serverId, window, artistId = id.id)) as? QueryResult.Albums)?.data?.items.orEmpty().map(::album)
+            is MediaId.Genre -> (query(Queries.albums(id.serverId, window, genre = id.name)) as? QueryResult.Albums)?.data?.items.orEmpty().map(::album)
+            is MediaId.Playlist -> {
+                val tracks = (query(Queries.playlistTracks(id.id, window)) as? QueryResult.Tracks)?.data ?: return emptyList()
+                tracks.items.mapIndexed { i, t -> track(t.toSummary(), MediaId.PlaylistTrack(id.serverId, id.id, tracks.offset.toInt() + i)) }
+            }
+            else -> null
+        }
+    }
+
+    /** One item by id (a controller restoring its place, or subscribing); null when unknown. */
+    suspend fun item(mediaId: String): MediaItem? = when (val id = MediaId.parse(mediaId)) {
+        null -> null
+        MediaId.Root -> root()
+        is MediaId.Section -> section(id.section)
+        is MediaId.Album -> albumDetail(id.id)?.let(::album)
+        is MediaId.AlbumTrack -> albumTracks(id.albumId).getOrNull(id.index)?.let { track(it.toSummary(), id) }
+        is MediaId.Artist -> (query(Queries.artist(id.id)) as? QueryResult.ArtistDetail)?.data?.let(::artist)
+        is MediaId.Playlist -> playlistDetail(id.id)?.let(::playlist)
+        is MediaId.PlaylistTrack -> playlistTrack(id.playlistId, id.index)?.let { track(it, id) }
+        is MediaId.Genre -> folder(id, id.name, MediaMetadata.MEDIA_TYPE_GENRE, style(STYLE_GRID), playable = true)
+        is MediaId.Track -> trackDetail(id.id)?.let { track(it.toSummary(), id) }
+        is MediaId.QueueItem -> null
+    }
+
+    /** Local results only: a controller's search must not wait on (or reach) the server. */
+    suspend fun search(text: String, limit: Int = SEARCH_LIMIT): List<MediaItem> {
+        val results = searchResults(text, limit) ?: return emptyList()
+        return results.tracks.map { track(it, MediaId.Track(it.serverId, it.id)) } +
+            results.albums.map(::album) + results.artists.map(::artist) + results.playlists.map(::playlist)
+    }
+
+    private suspend fun searchResults(text: String, limit: Int): SearchResults? {
+        val server = serverId() ?: return null
+        if (text.isBlank()) return null
+        return (query(Queries.search(server, text.trim(), limit, includeServer = false, requestId = "browse-" + UUID.randomUUID())) as? QueryResult.Search)?.data
+    }
+
+    /**
+     * A voice or text "play …" request (Assistant, Auto's search button) as one playable item:
+     * blank asks to resume, the focus extra (`MediaStore.EXTRA_MEDIA_FOCUS`) prefers an artist,
+     * album, playlist or genre match, otherwise the best track, then album, artist, playlist.
+     */
+    suspend fun resolveSearch(text: String, extras: Bundle?): MediaItem? {
+        if (text.isBlank()) return MediaItem.Builder().setMediaId(RESUME).build()
+        val server = serverId() ?: return null
+        val focus = extras?.getString(MediaStore.EXTRA_MEDIA_FOCUS)
+        if (focus == MediaStore.Audio.Genres.ENTRY_CONTENT_TYPE) {
+            val genre = extras.getString(MediaStore.EXTRA_MEDIA_GENRE)?.takeIf { it.isNotBlank() } ?: text
+            val known = (query(Queries.genres(server)) as? QueryResult.Genres)?.data.orEmpty()
+            known.firstOrNull { it.name.equals(genre.trim(), ignoreCase = true) }?.let { return genre(server, it) }
+        }
+        val r = searchResults(text, SEARCH_LIMIT) ?: return null
+        val preferred = when (focus) {
+            MediaStore.Audio.Artists.ENTRY_CONTENT_TYPE -> r.artists.firstOrNull()?.let(::artist)
+            MediaStore.Audio.Albums.ENTRY_CONTENT_TYPE -> r.albums.firstOrNull()?.let(::album)
+            MediaStore.Audio.Playlists.ENTRY_CONTENT_TYPE -> r.playlists.firstOrNull()?.let(::playlist)
+            else -> null
+        }
+        return preferred
+            ?: r.tracks.firstOrNull()?.let { track(it, MediaId.Track(it.serverId, it.id)) }
+            ?: r.albums.firstOrNull()?.let(::album)
+            ?: r.artists.firstOrNull()?.let(::artist)
+            ?: r.playlists.firstOrNull()?.let(::playlist)
+    }
+
+    // -- requests from the session's player --------------------------------------------------------
+
+    override fun play(mediaIds: List<String>, startIndex: Int) {
+        scope.launch { runCatching { playNow(mediaIds, startIndex) }.onFailure { Log.w(TAG, "play failed: ${it.message}") } }
+    }
+
+    override fun enqueue(mediaIds: List<String>, next: Boolean) {
+        scope.launch { runCatching { enqueueNow(mediaIds, next) }.onFailure { Log.w(TAG, "enqueue failed: ${it.message}") } }
+    }
+
+    /** Dispatches the command for [mediaIds] (see the class docs); false when nothing is playable. */
+    suspend fun playNow(mediaIds: List<String>, startIndex: Int): Boolean {
+        if (mediaIds.isEmpty()) return false
+        val start = startIndex.coerceIn(0, mediaIds.lastIndex)
+        if (mediaIds[start] == RESUME) { dispatch(Commands.mediaSessionCommand(MediaSessionAction.Play)); return true }
+        val ids = mediaIds.map { MediaId.parse(it) }
+        // A list of lone tracks (a controller setting search results) plays as one ad-hoc list.
+        val tracks = ids.filterIsInstance<MediaId.Track>()
+        if (tracks.size == ids.size && tracks.size > 1 && tracks.all { it.serverId == tracks[0].serverId }) {
+            dispatch(Commands.playTracks(tracks[0].serverId, tracks.map { it.id }, start, label(tracks[start].id)))
+            return true
+        }
+        val command = when (val id = ids[start]) {
+            is MediaId.Album -> albumDetail(id.id)?.let { Commands.playContext(Commands.albumContext(id.serverId, id.id, it.name)) }
+            is MediaId.AlbumTrack -> albumDetail(id.albumId)?.let { Commands.playContext(Commands.albumContext(id.serverId, id.albumId, it.name), startIndex = id.index) }
+            is MediaId.Artist -> (query(Queries.artist(id.id)) as? QueryResult.ArtistDetail)?.data?.let { Commands.playContext(Commands.artistContext(id.serverId, id.id, it.name)) }
+            is MediaId.Playlist -> playlistDetail(id.id)?.let { Commands.playContext(Commands.playlistContext(id.serverId, id.id, it.name)) }
+            is MediaId.PlaylistTrack -> playlistDetail(id.playlistId)?.let { Commands.playContext(Commands.playlistContext(id.serverId, id.playlistId, it.name), startIndex = id.index) }
+            is MediaId.Genre -> Commands.playContext(Commands.genreContext(id.serverId, id.name))
+            is MediaId.Track -> Commands.playTracks(id.serverId, listOf(id.id), 0, label(id.id))
+            is MediaId.QueueItem -> Commands.jumpToQueueItem(id.key)
+            MediaId.Root, is MediaId.Section, null -> null
+        } ?: return false
+        dispatch(command)
+        return true
+    }
+
+    /** `PlayNext` / `PlayLater` with the tracks behind [mediaIds]; false when none resolve. */
+    suspend fun enqueueNow(mediaIds: List<String>, next: Boolean): Boolean {
+        val byServer = LinkedHashMap<String, MutableList<String>>()
+        for (raw in mediaIds) {
+            val (server, ids) = when (val id = MediaId.parse(raw)) {
+                is MediaId.Track -> id.serverId to listOf(id.id)
+                is MediaId.AlbumTrack -> id.serverId to listOfNotNull(albumTracks(id.albumId).getOrNull(id.index)?.id)
+                is MediaId.Album -> id.serverId to albumTracks(id.id).map { it.id }
+                is MediaId.PlaylistTrack -> id.serverId to listOfNotNull(playlistTrack(id.playlistId, id.index)?.id)
+                is MediaId.Playlist -> id.serverId to ((query(Queries.playlistTracks(id.id, Page(0u, PLAYLIST_ALL.toUInt()))) as? QueryResult.Tracks)?.data?.items.orEmpty().map { it.id })
+                else -> continue // artists, genres and sections are too broad to enqueue
+            }
+            byServer.getOrPut(server) { mutableListOf() } += ids
+        }
+        var any = false
+        for ((server, ids) in byServer) {
+            if (ids.isEmpty()) continue
+            dispatch(if (next) Commands.playNext(server, ids) else Commands.playLater(server, ids))
+            any = true
+        }
+        return any
+    }
+
+    private suspend fun label(trackId: String): String =
+        trackDetail(trackId)?.title ?: context.getString(R.string.browse_root)
+
+    // -- items -------------------------------------------------------------------------------------
+
+    private fun section(section: LibrarySection): MediaItem = when (section) {
+        LibrarySection.Albums -> folder(MediaId.Section(section), context.getString(R.string.browse_albums), MediaMetadata.MEDIA_TYPE_FOLDER_ALBUMS, style(STYLE_GRID))
+        LibrarySection.Artists -> folder(MediaId.Section(section), context.getString(R.string.browse_artists), MediaMetadata.MEDIA_TYPE_FOLDER_ARTISTS, style(STYLE_LIST))
+        LibrarySection.Playlists -> folder(MediaId.Section(section), context.getString(R.string.browse_playlists), MediaMetadata.MEDIA_TYPE_FOLDER_PLAYLISTS, style(STYLE_LIST))
+        LibrarySection.Genres -> folder(MediaId.Section(section), context.getString(R.string.browse_genres), MediaMetadata.MEDIA_TYPE_FOLDER_GENRES, style(STYLE_LIST))
+    }
+
+    private fun folder(id: MediaId, title: String, type: Int, extras: Bundle, playable: Boolean = false, artwork: Uri? = null, subtitle: String? = null): MediaItem =
+        MediaItem.Builder().setMediaId(id.format()).setMediaMetadata(
+            MediaMetadata.Builder()
+                .setTitle(title)
+                .setSubtitle(subtitle)
+                .setIsBrowsable(true)
+                .setIsPlayable(playable)
+                .setMediaType(type)
+                .setArtworkUri(artwork)
+                .setExtras(extras)
+                .build(),
+        ).build()
+
+    private fun album(a: Album): MediaItem =
+        folder(MediaId.Album(a.serverId, a.id), a.name, MediaMetadata.MEDIA_TYPE_ALBUM, style(STYLE_LIST), playable = true, artwork = art(a.coverArt), subtitle = a.artist)
+            .let { item -> item.buildUpon().setMediaMetadata(item.mediaMetadata.buildUpon().setArtist(a.artist).setAlbumTitle(a.name).setAlbumArtist(a.artist).setReleaseYear(a.year?.toInt()).build()).build() }
+
+    private fun artist(a: Artist): MediaItem =
+        folder(MediaId.Artist(a.serverId, a.id), a.name, MediaMetadata.MEDIA_TYPE_ARTIST, style(STYLE_GRID), playable = true, artwork = art(a.coverArt))
+            .let { item -> item.buildUpon().setMediaMetadata(item.mediaMetadata.buildUpon().setArtist(a.name).build()).build() }
+
+    private fun playlist(p: Playlist): MediaItem =
+        folder(MediaId.Playlist(p.serverId, p.id), p.name, MediaMetadata.MEDIA_TYPE_PLAYLIST, style(STYLE_LIST), playable = true, artwork = art(p.coverArt), subtitle = p.comment?.takeIf { it.isNotBlank() })
+
+    private fun genre(serverId: String, g: Genre): MediaItem =
+        folder(MediaId.Genre(serverId, g.name), g.name, MediaMetadata.MEDIA_TYPE_GENRE, style(STYLE_GRID), playable = true)
+
+    private fun track(t: TrackSummary, id: MediaId): MediaItem = trackItem(context, t, id.format())
+
+    private fun art(coverArt: String?): Uri? = coverArt?.let { ArtworkProvider.uri(context, it) }
+
+    // -- queries -----------------------------------------------------------------------------------
+
+    private suspend fun query(q: app.hocket.core.api.Query): QueryResult? =
+        runCatching { core().query(q) }.onFailure { Log.w(TAG, "query failed: ${it.message}") }.getOrNull()
+
+    private fun dispatch(command: Command) = core().dispatch(command)
+
+    private suspend fun albumDetail(id: String): Album? = (query(Queries.album(id)) as? QueryResult.AlbumDetail)?.data
+    private suspend fun albumTracks(id: String): List<Track> = (query(Queries.albumTracks(id)) as? QueryResult.TrackList)?.data.orEmpty()
+    private suspend fun playlistDetail(id: String): Playlist? = (query(Queries.playlist(id)) as? QueryResult.PlaylistDetail)?.data
+    private suspend fun trackDetail(id: String): Track? = (query(Queries.track(id)) as? QueryResult.TrackDetail)?.data
+    private suspend fun playlistTrack(id: String, index: Int): TrackSummary? =
+        (query(Queries.playlistTracks(id, Page(index.toUInt(), 1u))) as? QueryResult.Tracks)?.data?.items?.firstOrNull()?.toSummary()
+
+    private fun <T> List<T>.window(page: Page): List<T> {
+        val from = page.offset.toLong().coerceAtMost(size.toLong()).toInt()
+        val to = (from.toLong() + page.limit.toLong()).coerceAtMost(size.toLong()).toInt()
+        return subList(from, to)
+    }
+}
+
+/** A playable track item, shared by the browse tree and the session's queue timeline. */
+internal fun trackItem(context: Context, t: TrackSummary, mediaId: String): MediaItem =
+    MediaItem.Builder().setMediaId(mediaId).setMediaMetadata(trackMetadata(t, t.coverArt?.let { ArtworkProvider.uri(context, it) })).build()
+
+internal fun trackMetadata(t: TrackSummary, artwork: Uri?): MediaMetadata =
+    MediaMetadata.Builder()
+        .setTitle(t.title)
+        .setArtist(t.artist)
+        .setAlbumTitle(t.album)
+        .setDurationMs(t.durationMs.toLong())
+        .setArtworkUri(artwork)
+        .setIsBrowsable(false)
+        .setIsPlayable(true)
+        .setMediaType(MediaMetadata.MEDIA_TYPE_MUSIC)
+        .setUserRating(androidx.media3.common.HeartRating(t.loved))
+        .build()
diff --git a/android/playback/src/main/java/app/hocket/playback/MediaIds.kt b/android/playback/src/main/java/app/hocket/playback/MediaIds.kt
new file mode 100644
index 0000000..b190577
--- /dev/null
+++ b/android/playback/src/main/java/app/hocket/playback/MediaIds.kt
@@ -0,0 +1,89 @@
+package app.hocket.playback
+
+import java.net.URLDecoder
+import java.net.URLEncoder
+
+/**
+ * The media ids [LibraryBrowser] hands to other apps (Android Auto, Wear, Assistant, any
+ * `MediaBrowser`) and gets back in `getChildren`, `getItem` and `setMediaItems`.
+ *
+ * Every id is self-contained: it carries the server id and whatever else is needed to play it
+ * without remembering what was browsed, since a controller may play an id from an earlier connection
+ * (Auto keeps its own history). Segments are URL-encoded and joined with `/`, so a genre named
+ * "Drum/Bass" or an id with a colon round-trips.
+ *
+ * - `root`, `albums`, `artists`, `playlists`, `genres`
+ * - `album/<server>/<id>` (browsable, playable: the album), `album/<server>/<id>/<index>` (a track,
+ *   playing the album from there; the index is into `Query.AlbumTracks`, as the UI's)
+ * - `artist/<server>/<id>` (its albums; playable: the artist)
+ * - `playlist/<server>/<id>`, `playlist/<server>/<id>/<index>` (the index is into `PlaylistTracks`)
+ * - `genre/<server>/<name>` (its albums; playable: the genre)
+ * - `track/<server>/<id>` (a lone track: search results)
+ * - `queue/<key>` (a queue entry in the session's timeline)
+ */
+sealed class MediaId {
+    data object Root : MediaId()
+    data class Section(val section: LibrarySection) : MediaId()
+    data class Album(val serverId: String, val id: String) : MediaId()
+    data class AlbumTrack(val serverId: String, val albumId: String, val index: Int) : MediaId()
+    data class Artist(val serverId: String, val id: String) : MediaId()
+    data class Playlist(val serverId: String, val id: String) : MediaId()
+    data class PlaylistTrack(val serverId: String, val playlistId: String, val index: Int) : MediaId()
+    data class Genre(val serverId: String, val name: String) : MediaId()
+    data class Track(val serverId: String, val id: String) : MediaId()
+    data class QueueItem(val key: String) : MediaId()
+
+    fun format(): String = when (this) {
+        Root -> ROOT
+        is Section -> section.id
+        is Album -> join("album", serverId, id)
+        is AlbumTrack -> join("album", serverId, albumId, index.toString())
+        is Artist -> join("artist", serverId, id)
+        is Playlist -> join("playlist", serverId, id)
+        is PlaylistTrack -> join("playlist", serverId, playlistId, index.toString())
+        is Genre -> join("genre", serverId, name)
+        is Track -> join("track", serverId, id)
+        is QueueItem -> join("queue", key)
+    }
+
+    override fun toString(): String = format()
+
+    companion object {
+        const val ROOT = "root"
+
+        /** Null for anything this app did not hand out. */
+        fun parse(id: String): MediaId? {
+            if (id == ROOT) return Root
+            LibrarySection.entries.firstOrNull { it.id == id }?.let { return Section(it) }
+            val parts = id.split('/').map { runCatching { URLDecoder.decode(it, "UTF-8") }.getOrNull() ?: return null }
+            if (parts.any { it.isEmpty() }) return null
+            return when (parts.first()) {
+                "album" -> when (parts.size) {
+                    3 -> Album(parts[1], parts[2])
+                    4 -> parts[3].toIntOrNull()?.takeIf { it >= 0 }?.let { AlbumTrack(parts[1], parts[2], it) }
+                    else -> null
+                }
+                "playlist" -> when (parts.size) {
+                    3 -> Playlist(parts[1], parts[2])
+                    4 -> parts[3].toIntOrNull()?.takeIf { it >= 0 }?.let { PlaylistTrack(parts[1], parts[2], it) }
+                    else -> null
+                }
+                "artist" -> if (parts.size == 3) Artist(parts[1], parts[2]) else null
+                "genre" -> if (parts.size == 3) Genre(parts[1], parts[2]) else null
+                "track" -> if (parts.size == 3) Track(parts[1], parts[2]) else null
+                "queue" -> if (parts.size == 2) QueueItem(parts[1]) else null
+                else -> null
+            }
+        }
+
+        private fun join(vararg parts: String) = parts.joinToString("/") { URLEncoder.encode(it, "UTF-8") }
+    }
+}
+
+/** The top-level categories under the root (Auto shows up to four of them as tabs). */
+enum class LibrarySection(val id: String) {
+    Albums("albums"),
+    Artists("artists"),
+    Playlists("playlists"),
+    Genres("genres"),
+}
diff --git a/android/playback/src/main/java/app/hocket/playback/MediaSessionBridge.kt b/android/playback/src/main/java/app/hocket/playback/MediaSessionBridge.kt
index 73976ee..51eba68 100644
--- a/android/playback/src/main/java/app/hocket/playback/MediaSessionBridge.kt
+++ b/android/playback/src/main/java/app/hocket/playback/MediaSessionBridge.kt
@@ -4,29 +4,53 @@ import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.os.Bundle
+import androidx.media3.common.MediaItem
+import androidx.media3.common.Player
 import androidx.media3.session.CommandButton
+import androidx.media3.session.LibraryResult
+import androidx.media3.session.MediaLibraryService
 import androidx.media3.session.MediaSession
 import androidx.media3.session.SessionCommand
+import androidx.media3.session.SessionCommands
+import androidx.media3.session.SessionError
 import androidx.media3.session.SessionResult
 import app.hocket.core.Commands
 import app.hocket.core.api.Command
 import app.hocket.core.api.MediaSessionAction
 import app.hocket.core.api.MediaSessionState
+import app.hocket.core.api.QueueView
 import app.hocket.core.api.RepeatMode
+import com.google.common.collect.ImmutableList
 import com.google.common.util.concurrent.Futures
 import com.google.common.util.concurrent.ListenableFuture
+import com.google.common.util.concurrent.SettableFuture
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
 
 /**
- * Builds the Media3 [MediaSession] over a [CoreSessionPlayer] and keeps its custom button layout in
- * step with the core's customised action list (`MediaSessionState.actions`): love, shuffle, repeat
- * and rate as media button preferences, so they appear on the notification and on Wear/Auto surfaces
- * that honour them. Transport buttons come from the player's available commands.
+ * Builds the Media3 [MediaLibrarySession] over a [CoreSessionPlayer] and keeps its custom button
+ * layout in step with the core's customised action list (`MediaSessionState.actions`): love,
+ * shuffle, repeat and rate as media button preferences, so they appear on the notification and on
+ * Wear/Auto surfaces that honour them. Transport buttons come from the player's available commands.
+ *
+ * The library side ([browser]) answers other apps' browsing and search (Android Auto, Wear,
+ * Assistant, any `MediaBrowser`); a "play …" search request (voice, Auto's search) is resolved to one
+ * library item here, before the player dispatches it. Every connected controller may open artwork
+ * URIs ([ArtworkProvider.allow]). The "recent" root (system playback resumption) is refused, as
+ * resumption is.
+ *
+ * Who may connect is [control]'s ("Allow control by other apps"): with it off, only the system's own
+ * controls and Media3's notification controller are accepted, and every request is checked again,
+ * so turning it off also cuts off controllers that are already connected ([setExternalControl]).
  */
 class MediaSessionBridge(
     context: Context,
     val player: CoreSessionPlayer,
     private val dispatch: (Command) -> Unit,
     launchIntent: Intent?,
+    private val browser: LibraryBrowser,
+    private val scope: CoroutineScope,
+    private val control: ExternalControl,
 ) {
     companion object {
         const val CMD_LOVE = "app.hocket.LOVE"
@@ -37,19 +61,33 @@ class MediaSessionBridge(
     }
 
     private val customCommands = listOf(CMD_LOVE, CMD_SHUFFLE, CMD_REPEAT, CMD_RATE).map { SessionCommand(it, Bundle.EMPTY) }
+    /** Library commands too: without them a browser's root and children requests are refused. */
+    private val sessionCommands = MediaSession.ConnectionResult.DEFAULT_SESSION_AND_LIBRARY_COMMANDS.buildUpon().apply { customCommands.forEach { add(it) } }.build()
 
-    val session: MediaSession = MediaSession.Builder(context, player)
-        .setId("hocket")
-        .setCallback(object : MediaSession.Callback {
+    private fun permitted(session: MediaSession, controller: MediaSession.ControllerInfo): Boolean =
+        session.isMediaNotificationController(controller) || control.permits(controller.packageName, controller.uid)
+
+    private fun <T : Any> refused(): ListenableFuture<LibraryResult<T>> = Futures.immediateFuture(LibraryResult.ofError<T>(SessionError.ERROR_PERMISSION_DENIED))
+
+    /** Runs a browse request on [scope] and completes the future with its result. */
+    private fun <T> async(block: suspend () -> T): ListenableFuture<T> {
+        val future = SettableFuture.create<T>()
+        scope.launch { runCatching { block() }.fold({ future.set(it) }, { future.setException(it) }) }
+        return future
+    }
+
+    val session: MediaLibraryService.MediaLibrarySession = MediaLibraryService.MediaLibrarySession.Builder(context, player, object : MediaLibraryService.MediaLibrarySession.Callback {
             override fun onConnect(session: MediaSession, controller: MediaSession.ControllerInfo): MediaSession.ConnectionResult {
-                val commands = MediaSession.ConnectionResult.DEFAULT_SESSION_COMMANDS.buildUpon().apply { customCommands.forEach { add(it) } }.build()
+                if (!permitted(session, controller)) return MediaSession.ConnectionResult.reject()
+                ArtworkProvider.allow(controller.packageName)
                 return MediaSession.ConnectionResult.AcceptedResultBuilder(session)
-                    .setAvailableSessionCommands(commands)
+                    .setAvailableSessionCommands(sessionCommands)
                     .setMediaButtonPreferences(buttons(player.state))
                     .build()
             }
 
             override fun onCustomCommand(session: MediaSession, controller: MediaSession.ControllerInfo, customCommand: SessionCommand, args: Bundle): ListenableFuture<SessionResult> {
+                if (!permitted(session, controller)) return Futures.immediateFuture(SessionResult(SessionError.ERROR_PERMISSION_DENIED))
                 when (customCommand.customAction) {
                     CMD_LOVE -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Love))
                     CMD_SHUFFLE -> dispatch(Commands.mediaSessionCommand(MediaSessionAction.Shuffle))
@@ -65,7 +103,61 @@ class MediaSessionBridge(
                 // have so the notification can stay; the core decides whether anything plays.
                 return Futures.immediateFuture(MediaSession.MediaItemsWithStartPosition(emptyList(), 0, 0L))
             }
+
+            override fun onGetLibraryRoot(session: MediaLibraryService.MediaLibrarySession, browser: MediaSession.ControllerInfo, params: MediaLibraryService.LibraryParams?): ListenableFuture<LibraryResult<MediaItem>> {
+                if (!permitted(session, browser)) return refused()
+                if (params?.isRecent == true) return Futures.immediateFuture(LibraryResult.ofError(SessionError.ERROR_NOT_SUPPORTED))
+                return Futures.immediateFuture(LibraryResult.ofItem(this@MediaSessionBridge.browser.root(), MediaLibraryService.LibraryParams.Builder().setExtras(LibraryBrowser.rootExtras()).build()))
+            }
+
+            override fun onGetChildren(session: MediaLibraryService.MediaLibrarySession, browser: MediaSession.ControllerInfo, parentId: String, page: Int, pageSize: Int, params: MediaLibraryService.LibraryParams?): ListenableFuture<LibraryResult<ImmutableList<MediaItem>>> {
+                if (!permitted(session, browser)) return refused()
+                return async {
+                val children = this@MediaSessionBridge.browser.children(parentId, page, pageSize)
+                if (children == null) LibraryResult.ofError(SessionError.ERROR_BAD_VALUE) else LibraryResult.ofItemList(children, params)
+                }
+            }
+
+            override fun onGetItem(session: MediaLibraryService.MediaLibrarySession, browser: MediaSession.ControllerInfo, mediaId: String): ListenableFuture<LibraryResult<MediaItem>> {
+                if (!permitted(session, browser)) return refused()
+                return async { this@MediaSessionBridge.browser.item(mediaId)?.let { LibraryResult.ofItem(it, null) } ?: LibraryResult.ofError(SessionError.ERROR_BAD_VALUE) }
+            }
+
+            override fun onSearch(session: MediaLibraryService.MediaLibrarySession, browser: MediaSession.ControllerInfo, query: String, params: MediaLibraryService.LibraryParams?): ListenableFuture<LibraryResult<Void>> {
+                if (!permitted(session, browser)) return refused()
+                scope.launch {
+                    val count = runCatching { this@MediaSessionBridge.browser.search(query).size }.getOrDefault(0)
+                    session.notifySearchResultChanged(browser, query, count, params)
+                }
+                return Futures.immediateFuture(LibraryResult.ofVoid())
+            }
+
+            override fun onGetSearchResult(session: MediaLibraryService.MediaLibrarySession, browser: MediaSession.ControllerInfo, query: String, page: Int, pageSize: Int, params: MediaLibraryService.LibraryParams?): ListenableFuture<LibraryResult<ImmutableList<MediaItem>>> {
+                if (!permitted(session, browser)) return refused()
+                return async {
+                val all = this@MediaSessionBridge.browser.search(query)
+                val from = (page.toLong() * pageSize).coerceIn(0, all.size.toLong()).toInt()
+                LibraryResult.ofItemList(all.subList(from, (from + pageSize.coerceAtLeast(0)).coerceAtMost(all.size)), params)
+                }
+            }
+
+            override fun onAddMediaItems(mediaSession: MediaSession, controller: MediaSession.ControllerInfo, mediaItems: MutableList<MediaItem>): ListenableFuture<MutableList<MediaItem>> {
+                if (!permitted(mediaSession, controller)) return Futures.immediateFailedFuture(SecurityException("control by other apps is off"))
+                return async {
+                // Library ids pass through to the player; a search request ("play X") becomes the item
+                // it names. Anything unresolvable is dropped (the player then does nothing).
+                mediaItems.mapNotNull { item ->
+                    val search = item.requestMetadata.searchQuery
+                    when {
+                        search != null -> this@MediaSessionBridge.browser.resolveSearch(search, item.requestMetadata.extras)
+                        item.mediaId.isNotEmpty() -> item
+                        else -> null
+                    }
+                }.toMutableList()
+                }
+            }
         })
+        .setId("hocket")
         .apply {
             launchIntent?.let {
                 setSessionActivity(PendingIntent.getActivity(context, 0, it, PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT))
@@ -73,6 +165,38 @@ class MediaSessionBridge(
         }
         .build()
 
+    /**
+     * The core's "Allow control by other apps" value. Turning it off revokes artwork access and
+     * strips every connected controller that is not the system's of all commands; turning it on
+     * gives those controllers their commands back. Main thread.
+     */
+    fun setExternalControl(allowed: Boolean) {
+        if (!control.update(allowed)) return
+        if (!allowed) ArtworkProvider.revokeAll()
+        for (controller in session.connectedControllers) {
+            val system = session.isMediaNotificationController(controller) || control.isSystem(controller.packageName, controller.uid)
+            when {
+                system -> ArtworkProvider.allow(controller.packageName)
+                allowed -> {
+                    ArtworkProvider.allow(controller.packageName)
+                    session.setAvailableCommands(controller, sessionCommands, MediaSession.ConnectionResult.DEFAULT_PLAYER_COMMANDS)
+                }
+                else -> session.setAvailableCommands(controller, SessionCommands.EMPTY, Player.Commands.EMPTY)
+            }
+        }
+    }
+
+    /** Push a new queue view to the player (its playlist). Main thread. */
+    fun applyQueue(queue: QueueView) = player.applyQueue(queue)
+
+    /**
+     * The library changed: browsers subscribed to a section refetch it. The count is Media3's
+     * "unknown" (`Int.MAX_VALUE`): knowing it would take a query per section.
+     */
+    fun libraryChanged() {
+        for (section in LibrarySection.entries) session.notifyChildrenChanged(section.id, Int.MAX_VALUE, null)
+    }
+
     /** Push a new state to the player and refresh the custom layout. Main thread. */
     fun apply(state: MediaSessionState, clockOffsetMs: Double, remote: Boolean = player.isRemote) {
         player.apply(state, clockOffsetMs, remote)
diff --git a/android/playback/src/main/java/app/hocket/playback/PlaybackService.kt b/android/playback/src/main/java/app/hocket/playback/PlaybackService.kt
index 5a8966e..b751745 100644
--- a/android/playback/src/main/java/app/hocket/playback/PlaybackService.kt
+++ b/android/playback/src/main/java/app/hocket/playback/PlaybackService.kt
@@ -8,7 +8,7 @@ import android.os.IBinder
 import android.os.Looper
 import android.util.Log
 import androidx.media3.session.MediaSession
-import androidx.media3.session.MediaSessionService
+import androidx.media3.session.MediaLibraryService
 import app.hocket.core.CoreHandle
 import app.hocket.core.SettingKeys
 import app.hocket.core.api.Command
@@ -24,10 +24,14 @@ import kotlinx.coroutines.flow.collect
 import kotlinx.coroutines.launch
 
 /**
- * The Media3 [MediaSessionService] that owns the process's core.
+ * The Media3 [MediaLibraryService] that owns the process's core.
  *
  * - Creates the core (or the fake) through [CoreHost] and forwards its events:
- *   `Event.Backend` -> [ExoBackend], `Event.MediaSession` -> [MediaSessionBridge].
+ *   `Event.Backend` -> [ExoBackend], `Event.MediaSession` and `Event.QueueChanged` ->
+ *   [MediaSessionBridge] (the session's state and its queue timeline).
+ * - Publishes the library to other apps (Android Auto, Wear, Assistant, `MediaBrowser`s) through
+ *   [LibraryBrowser] on the first server, telling subscribed browsers when it changes, only while
+ *   "Allow control by other apps" (`media.externalControl`, [ExternalControl]) is on.
  * - Registers the [NetworkMonitor] and [BatterySaverMonitor].
  * - Feeds [ConnectRoutes] (devices, lease owner, session state) so that while another device plays
  *   the session reports remote playback and [ConnectRouteProvider] names that device as the output;
@@ -44,12 +48,14 @@ import kotlinx.coroutines.launch
  *   app's own bind counts as a UI client: the service is exported for Media3, so the bind intent
  *   carries [CoreHost.bindToken], which no other process can know.
  */
-class PlaybackService : MediaSessionService() {
+class PlaybackService : MediaLibraryService() {
     companion object {
         private const val TAG = "PlaybackService"
         const val IDLE_TIMEOUT_MS = 5 * 60_000L
         const val ACTION_BIND_CORE = "app.hocket.playback.BIND_CORE"
         const val EXTRA_BIND_TOKEN = "app.hocket.playback.BIND_TOKEN"
+        /** Library changes arrive in bursts (a sync); browsers hear about them once they settle. */
+        const val LIBRARY_NOTIFY_DEBOUNCE_MS = 2_000L
 
         /**
          * True for this process's own core bind. `onBind` runs outside a binder transaction, so
@@ -79,13 +85,17 @@ class PlaybackService : MediaSessionService() {
     private var boundClients = 0
     private var clockOffsetMs = 0.0
     private var routeDiscovery: Any? = null
+    private var serverId: String? = null
+    private var libraryNotify: Job? = null
 
     override fun onCreate() {
         super.onCreate()
         core = CoreHost.acquire(this)
         backend = ExoBackend(this, scope, ::dispatch)
         val launch = packageManager.getLaunchIntentForPackage(packageName)
-        bridge = MediaSessionBridge(this, CoreSessionPlayer(Looper.getMainLooper(), ::dispatch), ::dispatch, launch)
+        val browser = LibraryBrowser(this, { core }, { serverId }, scope)
+        val player = CoreSessionPlayer(Looper.getMainLooper(), ::dispatch, media = browser, artwork = { t -> t.coverArt?.let { ArtworkProvider.uri(this, it) } })
+        bridge = MediaSessionBridge(this, player, ::dispatch, launch, browser, scope, ExternalControl(this))
         addSession(bridge.session)
         network = NetworkMonitor(this, ::dispatch)
         battery = BatterySaverMonitor(this, ::dispatch)
@@ -119,10 +129,16 @@ class PlaybackService : MediaSessionService() {
                 ConnectRoutes.onOwner(event.data.transport.lease.owner)
                 if (ConnectRoutes.state.value.remote != wasRemote) applySession(bridge.player.state)
             }
+            is Event.QueueChanged -> bridge.applyQueue(event.data.queue)
+            is Event.ServersChanged -> serverId = event.data.servers.firstOrNull()?.id
+            is Event.LibraryChanged -> scheduleLibraryNotify()
             is Event.ConnectionChanged -> clockOffsetMs = event.data.state.clockOffsetMs
             is Event.Started -> applySnapshot(event.data.snapshot)
             is Event.Snapshot -> applySnapshot(event.data.snapshot)
-            is Event.SettingChanged -> if (event.data.setting.key == SettingKeys.BATTERY_AUTO_ENGAGE) battery.automatic = event.data.setting.value.trim() != "false"
+            is Event.SettingChanged -> when (event.data.setting.key) {
+                SettingKeys.BATTERY_AUTO_ENGAGE -> battery.automatic = event.data.setting.value.trim() != "false"
+                SettingKeys.MEDIA_EXTERNAL_CONTROL -> bridge.setExternalControl(event.data.setting.value.trim() == "true")
+            }
             else -> Unit
         }
     }
@@ -130,10 +146,13 @@ class PlaybackService : MediaSessionService() {
     /** `Started` (once per core) and `Snapshot` (every RequestSnapshot) carry the same state. */
     private fun applySnapshot(snapshot: app.hocket.core.api.Snapshot) {
         clockOffsetMs = snapshot.connection.clockOffsetMs
+        serverId = snapshot.servers.firstOrNull()?.id
+        bridge.applyQueue(snapshot.queue)
         ConnectRoutes.onDevices(snapshot.devices)
         ConnectRoutes.onOwner(snapshot.transport.lease.owner)
         applySession(snapshot.mediaSession)
         battery.automatic = snapshot.settings.firstOrNull { it.key == SettingKeys.BATTERY_AUTO_ENGAGE }?.value?.trim() != "false"
+        bridge.setExternalControl(snapshot.settings.firstOrNull { it.key == SettingKeys.MEDIA_EXTERNAL_CONTROL }?.value?.trim() == "true")
     }
 
     /** Session state to the bridge, remote when another Connect device plays it. */
@@ -142,6 +161,14 @@ class PlaybackService : MediaSessionService() {
         bridge.apply(state, clockOffsetMs, remote = ConnectRoutes.state.value.remote != null)
     }
 
+    private fun scheduleLibraryNotify() {
+        libraryNotify?.cancel()
+        libraryNotify = scope.launch {
+            delay(LIBRARY_NOTIFY_DEBOUNCE_MS)
+            bridge.libraryChanged()
+        }
+    }
+
     private fun scheduleIdleStop() {
         idleJob?.cancel()
         idleJob = scope.launch {
@@ -153,7 +180,7 @@ class PlaybackService : MediaSessionService() {
         }
     }
 
-    override fun onGetSession(controllerInfo: MediaSession.ControllerInfo): MediaSession = bridge.session
+    override fun onGetSession(controllerInfo: MediaSession.ControllerInfo): MediaLibrarySession = bridge.session
 
     override fun onBind(intent: Intent?): IBinder? {
         if (isLocalBind(intent)) {
diff --git a/android/playback/src/main/res/values/strings.xml b/android/playback/src/main/res/values/strings.xml
new file mode 100644
index 0000000..ed65d19
--- /dev/null
+++ b/android/playback/src/main/res/values/strings.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- The library as other apps browse it (Android Auto tabs, a media browser's folders). -->
+    <string name="browse_root">Hocket</string>
+    <string name="browse_albums">Albums</string>
+    <string name="browse_artists">Artists</string>
+    <string name="browse_playlists">Playlists</string>
+    <string name="browse_genres">Genres</string>
+</resources>
diff --git a/android/playback/src/test/java/app/hocket/playback/ConnectRoutesTest.kt b/android/playback/src/test/java/app/hocket/playback/ConnectRoutesTest.kt
index 8d5a576..c2dcbbd 100644
--- a/android/playback/src/test/java/app/hocket/playback/ConnectRoutesTest.kt
+++ b/android/playback/src/test/java/app/hocket/playback/ConnectRoutesTest.kt
@@ -68,7 +68,9 @@ class ConnectRoutesTest {
     @Test
     fun remotePlaybackCarriesTheRoutingSessionId() {
         val player = CoreSessionPlayer(Looper.getMainLooper(), {})
-        val bridge = MediaSessionBridge(ApplicationProvider.getApplicationContext(), player, {}, null)
+        val context = ApplicationProvider.getApplicationContext<android.content.Context>()
+        val scope = kotlinx.coroutines.CoroutineScope(kotlinx.coroutines.Dispatchers.Unconfined)
+        val bridge = MediaSessionBridge(context, player, {}, null, LibraryBrowser(context, { error("unused") }, { null }, scope), scope, ExternalControl(context))
         try {
             bridge.apply(state(owns = false), 0.0, remote = true)
             shadowOf(Looper.getMainLooper()).idle()
diff --git a/android/playback/src/test/java/app/hocket/playback/CoreSessionQueueTest.kt b/android/playback/src/test/java/app/hocket/playback/CoreSessionQueueTest.kt
new file mode 100644
index 0000000..7f4b123
--- /dev/null
+++ b/android/playback/src/test/java/app/hocket/playback/CoreSessionQueueTest.kt
@@ -0,0 +1,137 @@
+package app.hocket.playback
+
+import android.app.Application
+import android.os.Looper
+import androidx.media3.common.MediaItem
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import app.hocket.core.api.Command
+import app.hocket.core.api.MediaSessionAction
+import app.hocket.core.api.MediaSessionMetadata
+import app.hocket.core.api.MediaSessionState
+import app.hocket.core.api.OfflineState
+import app.hocket.core.api.PositionStamp
+import app.hocket.core.api.QueueEntry
+import app.hocket.core.api.QueueItem
+import app.hocket.core.api.QueueMode
+import app.hocket.core.api.QueueSource
+import app.hocket.core.api.QueueView
+import app.hocket.core.api.RepeatMode
+import app.hocket.core.api.TrackSummary
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.Shadows.shadowOf
+import org.robolectric.annotation.Config
+
+/**
+ * The session's playlist is the core's queue: controllers see history, the current entry and what
+ * comes next, and picking, moving, removing or adding entries sends the queue commands.
+ */
+@RunWith(AndroidJUnit4::class)
+@Config(sdk = [34], application = Application::class)
+class CoreSessionQueueTest {
+    private val sent = mutableListOf<Command>()
+    private val requests = mutableListOf<Pair<String, List<String>>>()
+    private val media = object : CoreSessionPlayer.MediaRequests {
+        override fun play(mediaIds: List<String>, startIndex: Int) { requests += "play@$startIndex" to mediaIds }
+        override fun enqueue(mediaIds: List<String>, next: Boolean) { requests += (if (next) "next" else "later") to mediaIds }
+    }
+    private val player = CoreSessionPlayer(Looper.getMainLooper(), { sent += it }, media = media)
+
+    private fun entry(n: Int) = QueueEntry(
+        QueueItem("k$n", "t$n", QueueSource.Inserted, false),
+        TrackSummary("t$n", "s1", "Track $n", "Artist", "Album", "al1", "ar1", 180_000u, null, 0u, false, OfflineState.None),
+    )
+
+    private fun state(trackId: String) = MediaSessionState(
+        MediaSessionMetadata("Track now", "Artist", "Album", 200_000u, null, trackId, false, 0u), true,
+        PositionStamp(0u, 0.0, 1.0, true), false, RepeatMode.Off, 1.0,
+        listOf(MediaSessionAction.Play, MediaSessionAction.Pause, MediaSessionAction.Next, MediaSessionAction.Previous, MediaSessionAction.Seek), true,
+    )
+
+    /** History k0,k1; current k2; playing next k3; upcoming k4,k5. */
+    private val queue = QueueView("Album", listOf(entry(0), entry(1)), entry(2), listOf(entry(3)), listOf(entry(4), entry(5)), false, RepeatMode.Off, false, QueueMode.Apple, 2u)
+
+    private fun settle() = shadowOf(Looper.getMainLooper()).idle()
+
+    private fun setUp() {
+        player.apply(state("t2"))
+        player.applyQueue(queue)
+        settle()
+    }
+
+    @Test
+    fun thePlaylistIsTheQueueAroundTheCurrentEntry() {
+        setUp()
+        assertEquals(6, player.mediaItemCount)
+        assertEquals(2, player.currentMediaItemIndex)
+        assertEquals("Track now", player.currentMediaItem?.mediaMetadata?.title.toString())
+        assertEquals("Track 4", player.getMediaItemAt(4).mediaMetadata.title.toString())
+        assertEquals(MediaId.QueueItem("k5").format(), player.getMediaItemAt(5).mediaId)
+    }
+
+    @Test
+    fun aQueueThatHasNotCaughtUpShowsOnlyTheCurrentTrack() {
+        player.apply(state("t9"))
+        player.applyQueue(queue)
+        settle()
+        assertEquals(1, player.mediaItemCount)
+        assertEquals("t9", player.currentMediaItem?.mediaId)
+    }
+
+    @Test
+    fun historyIsCapped() {
+        val long = queue.copy(history = (100 until 160).map(::entry))
+        assertEquals(CoreSessionPlayer.HISTORY_SHOWN, CoreSessionPlayer.timeline(long, "t2").currentIndex)
+        assertEquals("k159", CoreSessionPlayer.timeline(long, "t2").entries[CoreSessionPlayer.HISTORY_SHOWN - 1].item.key)
+    }
+
+    @Test
+    fun pickingAnEntryJumpsToIt() {
+        setUp()
+        player.seekTo(4, 0)
+        assertEquals("k4", (sent.single() as Command.JumpToQueueItem).data.key)
+        sent.clear()
+        player.seekTo(0, 0)
+        assertEquals("k0", (sent.single() as Command.JumpToQueueItem).data.key)
+    }
+
+    @Test
+    fun nextAndPreviousStayTheCoresEvenWithAPlaylist() {
+        setUp()
+        player.seekToNext()
+        assertEquals(MediaSessionAction.Next, (sent.single() as Command.MediaSessionCommand).data.action)
+    }
+
+    @Test
+    fun movingAnUpcomingEntryUsesTheCombinedUpcomingIndex() {
+        setUp()
+        player.moveMediaItem(5, 3)
+        val move = sent.single() as Command.MoveQueueItem
+        assertEquals("k5", move.data.key)
+        assertEquals(0u, move.data.to_index)
+        sent.clear()
+        setUp()
+        player.moveMediaItem(3, 1)
+        assertTrue("history and the current entry are not reorderable", sent.isEmpty())
+    }
+
+    @Test
+    fun removingSkipsTheCurrentEntry() {
+        setUp()
+        player.removeMediaItems(2, 5)
+        assertEquals(listOf("k3", "k4"), (sent.single() as Command.RemoveQueueItems).data.keys)
+    }
+
+    @Test
+    fun addedAndSetItemsGoToTheLibrary() {
+        setUp()
+        player.addMediaItem(3, MediaItem.Builder().setMediaId("track/s1/t9").build())
+        assertEquals("next" to listOf("track/s1/t9"), requests.last())
+        player.addMediaItem(MediaItem.Builder().setMediaId("track/s1/t8").build())
+        assertEquals("later" to listOf("track/s1/t8"), requests.last())
+        player.setMediaItems(listOf(MediaItem.Builder().setMediaId("album/s1/al1").build()), 0, 0)
+        assertEquals("play@0" to listOf("album/s1/al1"), requests.last())
+    }
+}
diff --git a/android/playback/src/test/java/app/hocket/playback/ExternalControlTest.kt b/android/playback/src/test/java/app/hocket/playback/ExternalControlTest.kt
new file mode 100644
index 0000000..d9d801d
--- /dev/null
+++ b/android/playback/src/test/java/app/hocket/playback/ExternalControlTest.kt
@@ -0,0 +1,59 @@
+package app.hocket.playback
+
+import android.app.Application
+import android.content.Context
+import android.os.Build
+import android.os.Process
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.annotation.Config
+
+/**
+ * "Allow control by other apps": off by default; the system's own controls always get in; the last
+ * value survives a restart so an early controller is judged by it.
+ */
+@RunWith(AndroidJUnit4::class)
+@Config(sdk = [34], application = Application::class)
+class ExternalControlTest {
+    private val app: Application get() = ApplicationProvider.getApplicationContext()
+    private val systemUiUid = 10_050
+    private val otherAppUid = 10_200
+
+    private fun control(sdk: Int = 34) = ExternalControl(app, sdk) { uid -> uid == systemUiUid }
+
+    @Before
+    fun clear() { app.getSharedPreferences(ExternalControl.PREFS, Context.MODE_PRIVATE).edit().clear().commit() }
+
+    @Test
+    fun otherAppsAreRefusedByDefault() {
+        val c = control()
+        assertFalse(c.allowed)
+        assertFalse(c.permits("com.google.android.projection.gearhead", otherAppUid))
+        assertFalse("an unknown uid is not trusted", c.permits("com.example", -1))
+    }
+
+    @Test
+    fun theSystemsControlsAlwaysWork() {
+        val c = control()
+        assertTrue("SystemUI / Bluetooth hold MEDIA_CONTENT_CONTROL", c.permits("com.android.systemui", systemUiUid))
+        assertTrue("this app", c.permits(app.packageName, Process.myUid()))
+        assertFalse("an anonymous legacy controller is identifiable from API 28", c.permits(ExternalControl.LEGACY_CONTROLLER, -1))
+        assertTrue("before API 28 it cannot be told apart from the system", control(Build.VERSION_CODES.O_MR1).permits(ExternalControl.LEGACY_CONTROLLER, -1))
+    }
+
+    @Test
+    fun turningItOnLetsOtherAppsInAndIsRemembered() {
+        val c = control()
+        assertTrue(c.update(true))
+        assertFalse("no change", c.update(true))
+        assertTrue(c.permits("com.example.browser", otherAppUid))
+        assertTrue("a restarted service starts from the last value", control().allowed)
+        assertTrue(c.update(false))
+        assertFalse(control().permits("com.example.browser", otherAppUid))
+    }
+}
diff --git a/android/playback/src/test/java/app/hocket/playback/LibraryBrowserTest.kt b/android/playback/src/test/java/app/hocket/playback/LibraryBrowserTest.kt
new file mode 100644
index 0000000..2f6f53f
--- /dev/null
+++ b/android/playback/src/test/java/app/hocket/playback/LibraryBrowserTest.kt
@@ -0,0 +1,163 @@
+package app.hocket.playback
+
+import android.app.Application
+import android.os.Bundle
+import android.provider.MediaStore
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import app.hocket.core.CoreHandle
+import app.hocket.core.api.Command
+import app.hocket.core.api.ContextKind
+import app.hocket.core.api.MediaSessionAction
+import app.hocket.core.fake.FakeCore
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.annotation.Config
+
+/**
+ * The browse tree, search and play/enqueue resolution over the fake core's library: what Android
+ * Auto or any MediaBrowser sees, and the commands a tap there sends.
+ */
+@RunWith(AndroidJUnit4::class)
+@Config(sdk = [34], application = Application::class)
+class LibraryBrowserTest {
+    private val app: Application get() = ApplicationProvider.getApplicationContext()
+    private val fake = FakeCore(timers = false)
+    private val sent = mutableListOf<Command>()
+    private val core = object : CoreHandle by fake {
+        override fun dispatch(command: Command) { sent += command }
+    }
+    private val server = fake.library.serverId
+    private var serverId: String? = server
+    private val browser = LibraryBrowser(app, { core }, { serverId }, CoroutineScope(SupervisorJob() + Dispatchers.Unconfined))
+
+    @Test
+    fun rootListsTheFourSections() = runBlocking {
+        val sections = browser.children(MediaId.ROOT, 0, 100)!!
+        assertEquals(listOf("albums", "artists", "playlists", "genres"), sections.map { it.mediaId })
+        assertTrue(sections.all { it.mediaMetadata.isBrowsable == true && it.mediaMetadata.isPlayable == false })
+        assertEquals("Albums", sections[0].mediaMetadata.title.toString())
+    }
+
+    @Test
+    fun sectionsPageThroughTheLibrary() = runBlocking {
+        val first = browser.children("albums", 0, 5)!!
+        val second = browser.children("albums", 1, 5)!!
+        assertEquals(5, first.size)
+        assertTrue("pages do not overlap", first.map { it.mediaId }.intersect(second.map { it.mediaId }.toSet()).isEmpty())
+        val album = fake.library.albums.first()
+        val item = first.first { it.mediaId == MediaId.Album(server, album.id).format() }
+        assertEquals(album.name, item.mediaMetadata.title.toString())
+        assertTrue(item.mediaMetadata.isBrowsable == true && item.mediaMetadata.isPlayable == true)
+        assertEquals("content", item.mediaMetadata.artworkUri?.scheme)
+        assertEquals(fake.library.genres.size, browser.children("genres", 0, 1000)!!.size)
+        assertEquals(fake.library.playlists.size, browser.children("playlists", 0, 1000)!!.size)
+        assertTrue(browser.children("artists", 0, 10)!!.isNotEmpty())
+    }
+
+    @Test
+    fun noServerMeansEmptySectionsAndUnknownIdsAreErrors() = runBlocking {
+        serverId = null
+        assertEquals(emptyList<Any>(), browser.children("albums", 0, 10))
+        assertNull(browser.children("nonsense", 0, 10))
+        assertNull(browser.item("album/x"))
+    }
+
+    @Test
+    fun anAlbumsChildrenAreItsTracksInOrder() = runBlocking {
+        val album = fake.library.albums.first()
+        val tracks = browser.children(MediaId.Album(server, album.id).format(), 0, 100)!!
+        assertEquals(fake.library.albumTracks(album.id).map { it.title }, tracks.map { it.mediaMetadata.title.toString() })
+        assertEquals(MediaId.AlbumTrack(server, album.id, 1).format(), tracks[1].mediaId)
+        assertTrue(tracks.all { it.mediaMetadata.isPlayable == true && it.mediaMetadata.isBrowsable == false })
+        assertEquals(tracks[1].mediaMetadata.title, browser.item(tracks[1].mediaId)?.mediaMetadata?.title)
+    }
+
+    @Test
+    fun aTrackInsideAnAlbumPlaysTheAlbumFromThere() = runBlocking {
+        val album = fake.library.albums.first()
+        assertTrue(browser.playNow(listOf(MediaId.AlbumTrack(server, album.id, 2).format()), 0))
+        val play = sent.single() as Command.PlayContext
+        assertEquals(2u, play.data.args.startIndex)
+        assertEquals(album.name, play.data.args.context.label)
+        assertEquals(album.id, (play.data.args.context.kind as ContextKind.Album).data.id)
+    }
+
+    @Test
+    fun playlistsGenresAndQueueEntriesPlay() = runBlocking {
+        val playlist = fake.library.playlists.first()
+        assertTrue(browser.playNow(listOf(MediaId.Playlist(server, playlist.id).format()), 0))
+        assertTrue((sent.last() as Command.PlayContext).data.args.context.kind is ContextKind.Playlist)
+        assertTrue(browser.playNow(listOf(MediaId.Genre(server, "Rock").format()), 0))
+        assertEquals("Rock", ((sent.last() as Command.PlayContext).data.args.context.kind as ContextKind.Genre).data.name)
+        assertTrue(browser.playNow(listOf(MediaId.QueueItem("k1").format()), 0))
+        assertEquals("k1", (sent.last() as Command.JumpToQueueItem).data.key)
+        assertFalse("a section is not playable", browser.playNow(listOf("albums"), 0))
+    }
+
+    @Test
+    fun aListOfLoneTracksPlaysAsOneList() = runBlocking {
+        val ids = fake.library.tracks.take(3).map { MediaId.Track(server, it.id).format() }
+        assertTrue(browser.playNow(ids, 1))
+        val play = sent.single() as Command.PlayTracks
+        assertEquals(fake.library.tracks.take(3).map { it.id }, play.data.track_ids)
+        assertEquals(1u, play.data.start_index)
+    }
+
+    @Test
+    fun enqueueingAnAlbumAddsItsTracks() = runBlocking {
+        val album = fake.library.albums.first()
+        assertTrue(browser.enqueueNow(listOf(MediaId.Album(server, album.id).format()), next = true))
+        assertEquals(fake.library.albumTracks(album.id).map { it.id }, (sent.single() as Command.PlayNext).data.track_ids)
+        val t = fake.library.tracks.first()
+        assertTrue(browser.enqueueNow(listOf(MediaId.Track(server, t.id).format()), next = false))
+        assertEquals(listOf(t.id), (sent.last() as Command.PlayLater).data.track_ids)
+        assertFalse("artists are too broad to enqueue", browser.enqueueNow(listOf(MediaId.Artist(server, "ar0").format()), next = false))
+    }
+
+    @Test
+    fun searchReturnsPlayableLocalResults() = runBlocking {
+        val track = fake.library.tracks.first()
+        val results = browser.search(track.title)
+        assertTrue(results.any { it.mediaId == MediaId.Track(server, track.id).format() })
+        assertTrue(browser.search("  ").isEmpty())
+    }
+
+    @Test
+    fun voiceRequestsResolveToOneItem() = runBlocking {
+        assertEquals(LibraryBrowser.RESUME, browser.resolveSearch("", null)?.mediaId)
+        assertTrue(browser.playNow(listOf(LibraryBrowser.RESUME), 0))
+        assertEquals(MediaSessionAction.Play, (sent.last() as Command.MediaSessionCommand).data.action)
+
+        val album = fake.library.albums.first()
+        val focusAlbum = Bundle().apply { putString(MediaStore.EXTRA_MEDIA_FOCUS, MediaStore.Audio.Albums.ENTRY_CONTENT_TYPE) }
+        assertEquals(MediaId.Album(server, album.id).format(), browser.resolveSearch(album.name, focusAlbum)?.mediaId)
+
+        val genre = fake.library.genres.first()
+        val focusGenre = Bundle().apply { putString(MediaStore.EXTRA_MEDIA_FOCUS, MediaStore.Audio.Genres.ENTRY_CONTENT_TYPE); putString(MediaStore.EXTRA_MEDIA_GENRE, genre.name.uppercase()) }
+        assertEquals(MediaId.Genre(server, genre.name).format(), browser.resolveSearch(genre.name, focusGenre)?.mediaId)
+
+        assertNotNull(browser.resolveSearch(fake.library.tracks.first().title, null))
+        assertNull(browser.resolveSearch("zzzz-no-such-thing", null))
+    }
+
+    @Test
+    fun artworkIsOnlyForThisAppAndConnectedControllers() {
+        ArtworkProvider.revokeAll()
+        assertTrue(ArtworkProvider.isAllowed(app.packageName, app.packageName))
+        assertFalse(ArtworkProvider.isAllowed("com.example.snoop", app.packageName))
+        assertFalse(ArtworkProvider.isAllowed(null, app.packageName))
+        ArtworkProvider.allow("com.google.android.projection.gearhead")
+        assertTrue(ArtworkProvider.isAllowed("com.google.android.projection.gearhead", app.packageName))
+        assertEquals("content://${app.packageName}.artwork/320/al%2F1", ArtworkProvider.uri(app, "al/1").toString())
+    }
+}
diff --git a/android/playback/src/test/java/app/hocket/playback/MediaIdsTest.kt b/android/playback/src/test/java/app/hocket/playback/MediaIdsTest.kt
new file mode 100644
index 0000000..0996f35
--- /dev/null
+++ b/android/playback/src/test/java/app/hocket/playback/MediaIdsTest.kt
@@ -0,0 +1,33 @@
+package app.hocket.playback
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/** The ids other apps hold on to: every kind round-trips, whatever its segments contain. */
+class MediaIdsTest {
+    @Test
+    fun everyKindRoundTrips() {
+        val ids = listOf(
+            MediaId.Root,
+            MediaId.Section(LibrarySection.Albums), MediaId.Section(LibrarySection.Genres),
+            MediaId.Album("s1", "al1"), MediaId.AlbumTrack("s1", "al1", 3),
+            MediaId.Artist("s1", "ar/1"), MediaId.Playlist("s1", "pl:9"), MediaId.PlaylistTrack("s1", "pl:9", 0),
+            MediaId.Genre("s1", "Drum/Bass & Jungle"), MediaId.Genre("s1", "Électro 100%"),
+            MediaId.Track("server with spaces", "t1"), MediaId.QueueItem("k-42"),
+        )
+        for (id in ids) assertEquals(id, MediaId.parse(id.format()))
+    }
+
+    @Test
+    fun segmentsAreEncodedSoSlashesCannotShiftFields() {
+        assertEquals("genre/s1/Drum%2FBass", MediaId.Genre("s1", "Drum/Bass").format())
+        assertEquals(MediaId.Artist("a/b", "c"), MediaId.parse(MediaId.Artist("a/b", "c").format()))
+    }
+
+    @Test
+    fun foreignOrMalformedIdsAreRejected() {
+        for (bad in listOf("", "album", "album/s1", "album/s1/al1/x", "album/s1/al1/-1", "album//al1", "track/s1", "queue", "unknown/a/b", "album/s1/%zz"))
+            assertNull(bad, MediaId.parse(bad))
+    }
+}
diff --git a/crates/hocket-core/src/settings/registry.rs b/crates/hocket-core/src/settings/registry.rs
index c5d210e..a201eb5 100644
--- a/crates/hocket-core/src/settings/registry.rs
+++ b/crates/hocket-core/src/settings/registry.rs
@@ -63,6 +63,9 @@ pub mod keys {
     pub const RATINGS_LOVE_BRIDGE_ENABLED: &str = "ratings.loveBridge.enabled";
     pub const RATINGS_LOVE_BRIDGE_THRESHOLD: &str = "ratings.loveBridge.threshold";
     pub const BATTERY_AUTO_ENGAGE: &str = "battery.autoEngage";
+    /// Whether other apps (Android Auto, Wear, media browsers) may browse the library and control
+    /// playback. The system's own controls (notification, lock screen, Bluetooth) always work.
+    pub const MEDIA_EXTERNAL_CONTROL: &str = "media.externalControl";
     pub const BATTERY_LYRICS_FPS: &str = "battery.lyricsFps";
     pub const BATTERY_SMALL_ARTWORK: &str = "battery.smallArtwork";
     pub const BATTERY_PAUSE_PREFETCH: &str = "battery.pausePrefetch";
@@ -335,6 +338,10 @@ pub static REGISTRY: &[SettingDef] = &[
     def(BATTERY_AUTO_ENGAGE, Local, SettingKind::Bool, || {
         json!(true)
     }),
+    // Device-local: letting other apps in is a decision about this device, never synced.
+    def(MEDIA_EXTERNAL_CONTROL, Local, SettingKind::Bool, || {
+        json!(false)
+    }),
     def(
         BATTERY_LYRICS_FPS,
         Local,
diff --git a/crates/hocket-core/src/settings/strings.rs b/crates/hocket-core/src/settings/strings.rs
index 8e05c65..17217de 100644
--- a/crates/hocket-core/src/settings/strings.rs
+++ b/crates/hocket-core/src/settings/strings.rs
@@ -23,6 +23,7 @@ pub const TEXTS: &[SettingText] = &[
     t("lyrics.showTranslations", "Show translations", "Show translated lines under the original when the server provides them."),
     t("ratings.loveBridge.enabled", "Love highly rated tracks", "When you rate a track at or above the threshold, also mark it loved. One-way; lowering a rating never unloves."),
     t("ratings.loveBridge.threshold", "Love threshold", "Star rating at or above which a track is marked loved."),
+    t("media.externalControl", "Allow control by other apps", "Let other apps such as Android Auto, Wear and media browsers browse your library, see the queue and control playback. The system's own media controls always work."),
     t("battery.autoEngage", "Battery saver on battery", "Engage battery saver automatically when running on battery."),
     t("battery.lyricsFps", "Battery saver lyrics frame rate", "Frame rate cap for lyric animations while battery saver is engaged."),
     t("battery.smallArtwork", "Battery saver small artwork", "Use the smaller artwork size while battery saver is engaged."),
diff --git a/desktop/src/main/fake-core/index.ts b/desktop/src/main/fake-core/index.ts
index a26a0b5..cd723be 100644
--- a/desktop/src/main/fake-core/index.ts
+++ b/desktop/src/main/fake-core/index.ts
@@ -1789,6 +1789,7 @@ export class FakeCore implements CoreHandle {
       ["ratings.loveBridge.enabled", false, "accountSynced"],
       ["ratings.loveBridge.threshold", 4, "accountSynced"],
       ["battery.autoEngage", true, "deviceLocal"],
+      ["media.externalControl", false, "deviceLocal"],
       ["battery.lyricsFps", 30, "deviceLocal"],
       ["battery.smallArtwork", true, "deviceLocal"],
       ["battery.pausePrefetch", true, "deviceLocal"],