Merge remote-tracking branch 'origin/main'

README.md

@@ -74,8 +74,8 @@ project boundaries, validation commands, and pull request checklist.
 ### [SpotiFLAC (Desktop)](https://github.com/afkarxyz/SpotiFLAC)
 Download music in true lossless FLAC from extension-provided sources on Windows, macOS & Linux.
 
-### [SpotiFLAC (Python Module)](https://github.com/ShuShuzinhuu/SpotiFLAC-Module-Version)
-Python library for SpotiFLAC integration, maintained by [@ShuShuzinhuu](https://github.com/ShuShuzinhuu).
+### [SpotiFLAC (Python Module)](https://github.com/BartolomeoRusso9/SpotiFLAC-Module-Version)
+Python library for SpotiFLAC integration, maintained by [@BartolomeoRusso9](https://github.com/BartolomeoRusso9).
 
 ---
 

android/app/src/main/kotlin/com/zarz/spotiflac/CoreBackend.kt

@@ -195,6 +195,7 @@ internal interface CoreBackend {
     fun sanitizeFilename(filename: String): String
     fun fileMetadataImplementation(path: String): String
     fun readFileMetadata(path: String, hint: String): String
+    fun checkHiResAuthenticity(path: String, optionsJson: String): String
     fun readAudioMetadata(path: String, hint: String, cacheKey: String): String
     fun setLibraryCoverCacheDirectory(path: String)
     fun scanLibraryFolder(folder: String): String

android/app/src/main/kotlin/com/zarz/spotiflac/MainActivity.kt

@@ -86,6 +86,7 @@ class MainActivity: FlutterFragmentActivity() {
         "runPostProcessingV2",
         "readAudioMetadata",
         "readFileMetadata",
+        "checkHiResAuthenticity",
         "editFileMetadata",
         "reEnrichFile",
         "setLibraryCoverCacheDir",
@@ -1442,6 +1443,24 @@ class MainActivity: FlutterFragmentActivity() {
                             }
                             result.success(response)
                         }
+                        "checkHiResAuthenticity" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val optionsJson = call.argument<String>("options_json") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                try {
+                                    if (filePath.startsWith("content://")) {
+                                        checkHiResAuthenticityFromUri(Uri.parse(filePath), optionsJson)
+                                            ?.toString()
+                                            ?: errorJson("Failed to read SAF audio file")
+                                    } else {
+                                        coreBackend.checkHiResAuthenticity(filePath, optionsJson)
+                                    }
+                                } catch (e: Exception) {
+                                    errorJson(e.message ?: "Hi-Res check failed")
+                                }
+                            }
+                            result.success(response)
+                        }
                         "editFileMetadata" -> {
                             val filePath = call.argument<String>("file_path") ?: ""
                             val metadataJson = call.argument<String>("metadata_json") ?: "{}"

android/app/src/main/kotlin/com/zarz/spotiflac/MainActivitySafIo.kt

@@ -299,6 +299,15 @@ internal fun MainActivity.readAudioMetadataFromUri(
     obj.takeUnless { it.has("error") }
 }
 
+/** The Hi-Res check reads only a window from the middle of the file, so a
+ * seekable descriptor avoids copying the whole track out of SAF. */
+internal fun MainActivity.checkHiResAuthenticityFromUri(
+    uri: Uri,
+    optionsJson: String,
+): JSONObject? = readMetadataFromUri(uri) { path, _ ->
+    JSONObject(coreBackend.checkHiResAuthenticity(path, optionsJson))
+}?.put("file_path", uri.toString())
+
 internal fun MainActivity.readCompleteMetadataFromUri(
     uri: Uri,
     displayNameHint: String? = null,

android/app/src/rust/kotlin/com/zarz/spotiflac/SelectedCoreBackend.kt

@@ -218,6 +218,9 @@ internal object RustCoreBackend : CoreBackend {
     override fun readFileMetadata(path: String, hint: String): String =
         com.spotiflac.backend.readFileMetadata(path, hint, null)
 
+    override fun checkHiResAuthenticity(path: String, optionsJson: String): String =
+        com.spotiflac.backend.checkHiresAuthenticity(path, optionsJson, null)
+
     override fun readAudioMetadata(path: String, hint: String, cacheKey: String): String =
         owner().readAudioMetadata(File(path).canonicalPath, hint, cacheKey, null)
 

ios/Runner/AppDelegate.swift

@@ -245,7 +245,8 @@ import UniformTypeIdentifiers
             "pickIosDirectory", "createIosBookmarkFromPath", "resolveIosBookmark", "startAccessingIosBookmark", "stopAccessingIosBookmark", "downloadCoverToFile", "releaseMemory", "releaseMemoryUnderPressure",
             "setLibraryCoverCacheDir", "scanLibraryFolder", "scanLibraryFolderToNDJSONFile", "scanLibraryFolderIncremental",
             "getLibraryScanProgress", "cancelLibraryScan", "parseCueSheet", "extractCoverToFile",
-            "rewriteSplitArtistTags", "writeM4AFreeformTags", "ensureAC4Config", "writeAC4Metadata", "reEnrichFile"]
+            "rewriteSplitArtistTags", "writeM4AFreeformTags", "ensureAC4Config", "writeAC4Metadata", "reEnrichFile",
+            "checkHiResAuthenticity"]
         if coreBackend.routesApplication && !osMethods.contains(call.method) {
             DispatchQueue.global(qos: .userInitiated).async {
                 do {
@@ -488,6 +489,11 @@ import UniformTypeIdentifiers
             let filePath = args["file_path"] as! String
             return try coreBackend.readFileMetadata(path: filePath, hint: args["display_name"] as? String ?? "")
 
+        case "checkHiResAuthenticity":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            return try coreBackend.checkHiResAuthenticity(path: filePath, optionsJson: args["options_json"] as? String ?? "")
+
         case "editFileMetadata":
             let args = call.arguments as! [String: Any]
             let filePath = args["file_path"] as! String

ios/Runner/CoreBackend.swift

@@ -164,6 +164,7 @@ protocol CoreBackend {
     func sanitizeFilename(filename: String) -> String
     func fileMetadataImplementation(path: String) -> String
     func readFileMetadata(path: String, hint: String) throws -> String
+    func checkHiResAuthenticity(path: String, optionsJson: String) throws -> String
     func editFileMetadata(path: String, metadataJson: String) throws -> String
     func reEnrichFile(requestJson: String) throws -> String
     func rewriteSplitArtistTags(path: String, artist: String, albumArtist: String) throws -> String
@@ -483,6 +484,10 @@ final class RustCoreBackend: CoreBackend {
         try SpotiFLACBackend.readFileMetadata(path: path, hint: hint, lease: nil)
     }
 
+    func checkHiResAuthenticity(path: String, optionsJson: String) throws -> String {
+        try SpotiFLACBackend.checkHiresAuthenticity(path: path, optionsJson: optionsJson, lease: nil)
+    }
+
     func editFileMetadata(path: String, metadataJson: String) throws -> String {
         try owner().editFileMetadata(path: URL(fileURLWithPath: path).resolvingSymlinksInPath().standardizedFileURL.path, metadataJson: metadataJson, lease: nil)
     }

lib/l10n/arb/app_en.arb

@@ -4856,6 +4856,131 @@
   "@audioAnalysisRescan": {
     "description": "Tooltip/label for the button that re-runs the audio analysis, discarding cached results"
   },
+  "downloadRedownloadFakeHiRes": "Re-download fake Hi-Res",
+  "@downloadRedownloadFakeHiRes": {
+    "description": "Setting title: automatically replace downloads that measure as fake Hi-Res"
+  },
+  "downloadRedownloadFakeHiResSubtitle": "Off by default. Check Hi-Res downloads and replace only when every audio sample is preserved. Keep the original if verification or processing fails",
+  "@downloadRedownloadFakeHiResSubtitle": {
+    "description": "Setting subtitle for the fake Hi-Res re-download toggle"
+  },
+  "hiResCheckVerdictFakeCertain": "Fake Hi-Res",
+  "@hiResCheckVerdictFakeCertain": {
+    "description": "Verdict: an exact fingerprint (padded bits or upsampling pattern) proves the file is not real Hi-Res"
+  },
+  "hiResCheckVerdictFakeSuspect": "Possibly a filtered master",
+  "@hiResCheckVerdictFakeSuspect": {
+    "description": "Verdict: fails the cutoff test but may be a genuine master low-pass filtered in mastering"
+  },
+  "hiResCheckReasonSampleHold": "Every sample is repeated: upsampled by duplication",
+  "@hiResCheckReasonSampleHold": {
+    "description": "Reason: sample-and-hold upsampling detected"
+  },
+  "hiResCheckReasonInterpolation": "In-between samples are linearly interpolated",
+  "@hiResCheckReasonInterpolation": {
+    "description": "Reason: linear-interpolation upsampling detected"
+  },
+  "hiResCheckReasonImaging": "Content above 22 kHz mirrors the audible band",
+  "@hiResCheckReasonImaging": {
+    "description": "Reason: spectral imaging from upsampling detected"
+  },
+  "hiResCheckMusicContent": "Musical content",
+  "@hiResCheckMusicContent": {
+    "description": "Label for the highest frequency that still moves with the music"
+  },
+  "hiResCheckUltrasonicNoise": "Above {cutoff} only steady noise (typical of DSD or analog tape transfers): a {rate} file would hold all the music",
+  "@hiResCheckUltrasonicNoise": {
+    "description": "Shown when the ultrasonic content of a Hi-Res file is noise rather than music",
+    "placeholders": {
+      "cutoff": {
+        "type": "String"
+      },
+      "rate": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckTitle": "Hi-Res Authenticity",
+  "@hiResCheckTitle": {
+    "description": "Title of the fake Hi-Res check card"
+  },
+  "hiResCheckDescription": "Detect upsampled or bit-padded fake Hi-Res files",
+  "@hiResCheckDescription": {
+    "description": "Explains what the Hi-Res authenticity check does"
+  },
+  "hiResCheckRun": "Check",
+  "@hiResCheckRun": {
+    "description": "Button that starts the Hi-Res authenticity check"
+  },
+  "hiResCheckChecking": "Checking Hi-Res authenticity...",
+  "@hiResCheckChecking": {
+    "description": "Loading text while the Hi-Res check runs"
+  },
+  "hiResCheckVerdictFake": "Likely fake Hi-Res",
+  "@hiResCheckVerdictFake": {
+    "description": "Verdict: the file claims Hi-Res but does not measure as it"
+  },
+  "hiResCheckVerdictGenuine": "Measures as genuine Hi-Res",
+  "@hiResCheckVerdictGenuine": {
+    "description": "Verdict: no upsampling or padded bit depth found"
+  },
+  "hiResCheckVerdictStandard": "Standard definition, nothing to flag",
+  "@hiResCheckVerdictStandard": {
+    "description": "Verdict: neither sample rate nor bit depth claims Hi-Res"
+  },
+  "hiResCheckVerdictInconclusive": "Inconclusive: the analyzed segment is too quiet or short",
+  "@hiResCheckVerdictInconclusive": {
+    "description": "Verdict: analysis could not reach a reliable conclusion"
+  },
+  "hiResCheckUnsupported": "Only FLAC and WAV files can be checked",
+  "@hiResCheckUnsupported": {
+    "description": "Shown when the file format cannot be decoded by the Hi-Res check"
+  },
+  "hiResCheckCutoff": "Content cutoff",
+  "@hiResCheckCutoff": {
+    "description": "Label for the highest frequency with real content"
+  },
+  "hiResCheckBitsInUse": "Bits in use",
+  "@hiResCheckBitsInUse": {
+    "description": "Label for effective vs declared bit depth"
+  },
+  "hiResCheckDisclaimer": "The spectrum stops early, but nothing proves it was upsampled: it may be a genuine master low-pass filtered in mastering. It is not replaced automatically.",
+  "@hiResCheckDisclaimer": {
+    "description": "Caveat shown under a fake Hi-Res verdict"
+  },
+  "hiResCheckFailed": "Hi-Res check failed: {error}",
+  "@hiResCheckFailed": {
+    "description": "Error shown when the Hi-Res check fails",
+    "placeholders": {
+      "error": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckReasonRate": "Declares {sampleRate} but content stops at ~{cutoff}",
+  "@hiResCheckReasonRate": {
+    "description": "Reason for a fake verdict caused by upsampling",
+    "placeholders": {
+      "sampleRate": {
+        "type": "String"
+      },
+      "cutoff": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckReasonDepth": "Declares {declared}-bit but only {effective} bits carry data",
+  "@hiResCheckReasonDepth": {
+    "description": "Reason for a fake verdict caused by padded bit depth",
+    "placeholders": {
+      "declared": {
+        "type": "int"
+      },
+      "effective": {
+        "type": "int"
+      }
+    }
+  },
   "audioAnalysisRescanning": "Re-analyzing audio...",
   "@audioAnalysisRescanning": {
     "description": "Loading text while audio is being re-analyzed after an explicit refresh"

lib/l10n/arb/app_it.arb

@@ -4732,6 +4732,131 @@
   "@audioAnalysisRescan": {
     "description": "Tooltip/label for the button that re-runs the audio analysis, discarding cached results"
   },
+  "downloadRedownloadFakeHiRes": "Riscarica i falsi Hi-Res",
+  "@downloadRedownloadFakeHiRes": {
+    "description": "Setting title: automatically replace downloads that measure as fake Hi-Res"
+  },
+  "downloadRedownloadFakeHiResSubtitle": "Disattivato per impostazione predefinita. Sostituisce i download Hi-Res solo se tutti i campioni audio sono preservati. Mantiene l’originale se la verifica o l’elaborazione non riesce",
+  "@downloadRedownloadFakeHiResSubtitle": {
+    "description": "Setting subtitle for the fake Hi-Res re-download toggle"
+  },
+  "hiResCheckVerdictFakeCertain": "Falso Hi-Res",
+  "@hiResCheckVerdictFakeCertain": {
+    "description": "Verdict: an exact fingerprint (padded bits or upsampling pattern) proves the file is not real Hi-Res"
+  },
+  "hiResCheckVerdictFakeSuspect": "Forse un master filtrato",
+  "@hiResCheckVerdictFakeSuspect": {
+    "description": "Verdict: fails the cutoff test but may be a genuine master low-pass filtered in mastering"
+  },
+  "hiResCheckReasonSampleHold": "Ogni campione è ripetuto: ricampionato per duplicazione",
+  "@hiResCheckReasonSampleHold": {
+    "description": "Reason: sample-and-hold upsampling detected"
+  },
+  "hiResCheckReasonInterpolation": "I campioni intermedi sono interpolati linearmente",
+  "@hiResCheckReasonInterpolation": {
+    "description": "Reason: linear-interpolation upsampling detected"
+  },
+  "hiResCheckReasonImaging": "Il contenuto sopra i 22 kHz è lo specchio della banda udibile",
+  "@hiResCheckReasonImaging": {
+    "description": "Reason: spectral imaging from upsampling detected"
+  },
+  "hiResCheckMusicContent": "Contenuto musicale",
+  "@hiResCheckMusicContent": {
+    "description": "Label for the highest frequency that still moves with the music"
+  },
+  "hiResCheckUltrasonicNoise": "Sopra {cutoff} solo rumore costante (tipico dei trasferimenti da DSD o nastro analogico): un file a {rate} conterrebbe tutta la musica",
+  "@hiResCheckUltrasonicNoise": {
+    "description": "Shown when the ultrasonic content of a Hi-Res file is noise rather than music",
+    "placeholders": {
+      "cutoff": {
+        "type": "String"
+      },
+      "rate": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckTitle": "Autenticità Hi-Res",
+  "@hiResCheckTitle": {
+    "description": "Title of the fake Hi-Res check card"
+  },
+  "hiResCheckDescription": "Rileva file Hi-Res falsi, ricampionati o con bit riempiti",
+  "@hiResCheckDescription": {
+    "description": "Explains what the Hi-Res authenticity check does"
+  },
+  "hiResCheckRun": "Verifica",
+  "@hiResCheckRun": {
+    "description": "Button that starts the Hi-Res authenticity check"
+  },
+  "hiResCheckChecking": "Verifica dell'autenticità Hi-Res...",
+  "@hiResCheckChecking": {
+    "description": "Loading text while the Hi-Res check runs"
+  },
+  "hiResCheckVerdictFake": "Probabile falso Hi-Res",
+  "@hiResCheckVerdictFake": {
+    "description": "Verdict: the file claims Hi-Res but does not measure as it"
+  },
+  "hiResCheckVerdictGenuine": "Risulta Hi-Res autentico",
+  "@hiResCheckVerdictGenuine": {
+    "description": "Verdict: no upsampling or padded bit depth found"
+  },
+  "hiResCheckVerdictStandard": "Definizione standard, niente da segnalare",
+  "@hiResCheckVerdictStandard": {
+    "description": "Verdict: neither sample rate nor bit depth claims Hi-Res"
+  },
+  "hiResCheckVerdictInconclusive": "Inconcludente: il segmento analizzato è troppo silenzioso o breve",
+  "@hiResCheckVerdictInconclusive": {
+    "description": "Verdict: analysis could not reach a reliable conclusion"
+  },
+  "hiResCheckUnsupported": "Si possono verificare solo file FLAC e WAV",
+  "@hiResCheckUnsupported": {
+    "description": "Shown when the file format cannot be decoded by the Hi-Res check"
+  },
+  "hiResCheckCutoff": "Taglio del contenuto",
+  "@hiResCheckCutoff": {
+    "description": "Label for the highest frequency with real content"
+  },
+  "hiResCheckBitsInUse": "Bit usati",
+  "@hiResCheckBitsInUse": {
+    "description": "Label for effective vs declared bit depth"
+  },
+  "hiResCheckDisclaimer": "Lo spettro si ferma presto, ma nulla prova che sia ricampionato: potrebbe essere un master autentico filtrato in mastering. Non viene sostituito automaticamente.",
+  "@hiResCheckDisclaimer": {
+    "description": "Caveat shown under a fake Hi-Res verdict"
+  },
+  "hiResCheckFailed": "Verifica Hi-Res non riuscita: {error}",
+  "@hiResCheckFailed": {
+    "description": "Error shown when the Hi-Res check fails",
+    "placeholders": {
+      "error": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckReasonRate": "Dichiara {sampleRate} ma il contenuto si ferma a ~{cutoff}",
+  "@hiResCheckReasonRate": {
+    "description": "Reason for a fake verdict caused by upsampling",
+    "placeholders": {
+      "sampleRate": {
+        "type": "String"
+      },
+      "cutoff": {
+        "type": "String"
+      }
+    }
+  },
+  "hiResCheckReasonDepth": "Dichiara {declared} bit ma solo {effective} contengono dati",
+  "@hiResCheckReasonDepth": {
+    "description": "Reason for a fake verdict caused by padded bit depth",
+    "placeholders": {
+      "declared": {
+        "type": "int"
+      },
+      "effective": {
+        "type": "int"
+      }
+    }
+  },
   "audioAnalysisRescanning": "Re-analyzing audio...",
   "@audioAnalysisRescanning": {
     "description": "Loading text while audio is being re-analyzed after an explicit refresh"

lib/models/settings.dart

@@ -77,6 +77,8 @@ class AppSettings {
   final String locale;
   final String lyricsMode;
   final bool autoConvertDownloads;
+  // Re-download a Hi-Res request at LOSSLESS when the file measures as fake.
+  final bool redownloadFakeHiRes;
   final String autoConvertFormat; // 'mp3', 'aac' (M4A), or 'opus'
   final String autoConvertBitrate; // '128k', '192k', '256k', or '320k'
   final bool
@@ -172,6 +174,7 @@ class AppSettings {
     this.locale = 'system',
     this.lyricsMode = 'embed',
     this.autoConvertDownloads = false,
+    this.redownloadFakeHiRes = false,
     this.autoConvertFormat = 'mp3',
     this.autoConvertBitrate = '320k',
     this.useAllFilesAccess = false,
@@ -260,6 +263,7 @@ class AppSettings {
     String? locale,
     String? lyricsMode,
     bool? autoConvertDownloads,
+    bool? redownloadFakeHiRes,
     String? autoConvertFormat,
     String? autoConvertBitrate,
     bool? useAllFilesAccess,
@@ -353,6 +357,7 @@ class AppSettings {
       locale: locale ?? this.locale,
       lyricsMode: lyricsMode ?? this.lyricsMode,
       autoConvertDownloads: autoConvertDownloads ?? this.autoConvertDownloads,
+      redownloadFakeHiRes: redownloadFakeHiRes ?? this.redownloadFakeHiRes,
       autoConvertFormat: autoConvertFormat ?? this.autoConvertFormat,
       autoConvertBitrate: autoConvertBitrate ?? this.autoConvertBitrate,
       useAllFilesAccess: useAllFilesAccess ?? this.useAllFilesAccess,

lib/models/settings.g.dart

@@ -63,6 +63,7 @@ AppSettings _$AppSettingsFromJson(Map<String, dynamic> json) => AppSettings(
   locale: json['locale'] as String? ?? 'system',
   lyricsMode: json['lyricsMode'] as String? ?? 'embed',
   autoConvertDownloads: json['autoConvertDownloads'] as bool? ?? false,
+  redownloadFakeHiRes: json['redownloadFakeHiRes'] as bool? ?? false,
   autoConvertFormat: json['autoConvertFormat'] as String? ?? 'mp3',
   autoConvertBitrate: json['autoConvertBitrate'] as String? ?? '320k',
   useAllFilesAccess: json['useAllFilesAccess'] as bool? ?? false,
@@ -152,6 +153,7 @@ Map<String, dynamic> _$AppSettingsToJson(
   'locale': instance.locale,
   'lyricsMode': instance.lyricsMode,
   'autoConvertDownloads': instance.autoConvertDownloads,
+  'redownloadFakeHiRes': instance.redownloadFakeHiRes,
   'autoConvertFormat': instance.autoConvertFormat,
   'autoConvertBitrate': instance.autoConvertBitrate,
   'useAllFilesAccess': instance.useAllFilesAccess,

lib/providers/download_queue_provider.dart

@@ -25,6 +25,7 @@ import 'package:spotiflac_android/services/platform_bridge.dart';
 import 'package:spotiflac_android/services/download_request_payload.dart';
 import 'package:spotiflac_android/services/download_motion_artwork_source.dart';
 import 'package:spotiflac_android/services/ffmpeg_service.dart';
+import 'package:spotiflac_android/services/hires_check_service.dart';
 import 'package:spotiflac_android/services/replaygain_service.dart';
 import 'package:spotiflac_android/services/notification_service.dart';
 import 'package:spotiflac_android/services/verification_notification.dart';
@@ -57,6 +58,7 @@ part 'download_queue_provider_finalization.dart';
 part 'download_queue_provider_replaygain.dart';
 part 'download_queue_provider_embedding.dart';
 part 'download_queue_provider_single_item.dart';
+part 'download_queue_provider_hires_check.dart';
 
 final _log = AppLogger('DownloadQueue');
 

lib/providers/download_queue_provider_hires_check.dart

@@ -0,0 +1,250 @@
+part of 'download_queue_provider.dart';
+
+// Per-track fake Hi-Res check (AppSettings.redownloadFakeHiRes), ported from
+// SpotiFLAC-Module-Version's --redownload-fake-hires.
+//
+// Runs inside one _DownloadRun, right after the file is decoded and before
+// anything is published, tagged or converted: the verdict decides which file
+// the rest of the pipeline works on. A flagged file is set aside, the same
+// track is downloaded again at LOSSLESS. The original is only deleted after
+// full PCM verification and successful finalization, publication and history.
+// If any step fails, including cancellation, the original is restored.
+
+enum _FakeHiResOutcome {
+  /// Nothing to do, or the replacement failed: finish with the current file.
+  kept,
+
+  /// The verified replacement is already finalized and persisted.
+  completed,
+
+  /// The item was cancelled or paused mid-replacement; stop the run.
+  aborted,
+}
+
+/// Everything a replacement attempt may overwrite, so a failed one can put
+/// the run back exactly as it was.
+class _FakeHiResRunState {
+  _FakeHiResRunState(_DownloadRun run)
+    : result = Map<String, dynamic>.from(run.result),
+      quality = run.quality,
+      safOutputExt = run.safOutputExt,
+      safFileName = run.safFileName,
+      safBaseName = run.safBaseName,
+      finalSafFileName = run.finalSafFileName,
+      effectiveSafMode = run.effectiveSafMode,
+      effectiveOutputDir = run.effectiveOutputDir,
+      trackToDownload = run.trackToDownload,
+      appOutputDir = run.appOutputDir,
+      filePath = run.filePath,
+      wasExisting = run.wasExisting,
+      actualQuality = run.actualQuality,
+      resultOutputExt = run.resultOutputExt,
+      shouldPreserveNativeM4a = run.shouldPreserveNativeM4a,
+      decryptionDescriptor = run.decryptionDescriptor,
+      probedFinalMetadata = run.probedFinalMetadata,
+      externalLrcWritten = run.externalLrcWritten;
+
+  final Map<String, dynamic> result;
+  final String quality;
+  final String safOutputExt;
+  final String? safFileName;
+  final String? safBaseName;
+  final String? finalSafFileName;
+  final bool effectiveSafMode;
+  final String effectiveOutputDir;
+  final Track trackToDownload;
+  final String? appOutputDir;
+  final String? filePath;
+  final bool wasExisting;
+  final String actualQuality;
+  final String? resultOutputExt;
+  final bool shouldPreserveNativeM4a;
+  final DownloadDecryptionDescriptor? decryptionDescriptor;
+  final Map<String, dynamic>? probedFinalMetadata;
+  final bool externalLrcWritten;
+
+  void restore(_DownloadRun run) {
+    run.result = result;
+    run.quality = quality;
+    run.safOutputExt = safOutputExt;
+    run.safFileName = safFileName;
+    run.safBaseName = safBaseName;
+    run.finalSafFileName = finalSafFileName;
+    run.effectiveSafMode = effectiveSafMode;
+    run.effectiveOutputDir = effectiveOutputDir;
+    run.trackToDownload = trackToDownload;
+    run.appOutputDir = appOutputDir;
+    run.filePath = filePath;
+    run.wasExisting = wasExisting;
+    run.actualQuality = actualQuality;
+    run.resultOutputExt = resultOutputExt;
+    run.shouldPreserveNativeM4a = shouldPreserveNativeM4a;
+    run.decryptionDescriptor = decryptionDescriptor;
+    run.probedFinalMetadata = probedFinalMetadata;
+    run.externalLrcWritten = externalLrcWritten;
+  }
+}
+
+extension _DownloadRunFakeHiRes on _DownloadRun {
+  /// [requestTrack] is the track as it was sent to the backend, before the
+  /// first result was merged into it: the replacement gets the same brief
+  /// the first attempt did, not the first attempt's conclusions.
+  Future<_FakeHiResOutcome> _replaceFakeHiResIfNeeded(
+    Track requestTrack,
+  ) async {
+    final path = filePath;
+    if (!settings.redownloadFakeHiRes ||
+        wasExisting ||
+        path == null ||
+        !HiResCheckService.isHiResQuality(quality)) {
+      return _FakeHiResOutcome.kept;
+    }
+    if (isContentUri(path)) {
+      // Already published to SAF: there is no local file to set aside, and
+      // a heuristic is not worth deleting the only copy for.
+      _log.d('[hires-check] skipped: output already published to SAF');
+      return _FakeHiResOutcome.kept;
+    }
+    if (!_serviceOffersFakeHiResFallback()) {
+      _log.d(
+        '[hires-check] skipped: ${item.service} has no '
+        '${HiResCheckService.fakeHiResFallbackQuality} quality',
+      );
+      return _FakeHiResOutcome.kept;
+    }
+
+    final HiResCheckResult check;
+    try {
+      check = await HiResCheckService.check(path);
+    } catch (e) {
+      // Never a reason to fail a finished download.
+      _log.w('[hires-check] skipped for ${item.track.name}: $e');
+      return _FakeHiResOutcome.kept;
+    }
+    if (!check.supported || !check.isFake) {
+      _log.d(
+        '[hires-check] ${item.track.name}: '
+        '${check.supported ? check.verdict : 'unsupported format'}',
+      );
+      return _FakeHiResOutcome.kept;
+    }
+    if (!check.redownloadSafe) {
+      // Evidence on one axis cannot justify discarding the other axis.
+      _log.w(
+        '[hires-check] ${item.track.name} may be fake Hi-Res '
+        '(${check.reason}); kept, not certain enough to replace',
+      );
+      return _FakeHiResOutcome.kept;
+    }
+
+    _log.w(
+      '[hires-check] ${item.track.name} looks like fake Hi-Res '
+      '(${check.reason}); re-downloading as '
+      '${HiResCheckService.fakeHiResFallbackQuality}',
+    );
+
+    final saved = _FakeHiResRunState(this);
+    var completed = false;
+    var aborted = false;
+    try {
+      completed = await HiResCheckService.withOriginalBackup(path, (
+        backup,
+      ) async {
+        fakeHiResOriginalPath = backup;
+        trackToDownload = requestTrack;
+        result = <String, dynamic>{};
+        filePath = null;
+        probedFinalMetadata = null;
+        externalLrcWritten = false;
+        var finalized = false;
+        try {
+          await _useFakeHiResFallbackQuality();
+          n.updateItemStatus(item.id, DownloadStatus.downloading, progress: 0);
+          if (!await _downloadAndMaybeFallback()) {
+            aborted = true;
+            return false;
+          }
+          aborted = await _shouldAbort('during fake Hi-Res re-download');
+          if (aborted) return false;
+          final replacementPath = result['file_path'] as String?;
+          if (result['success'] != true ||
+              result['already_exists'] == true ||
+              normalizeOptionalString(replacementPath) == null ||
+              isContentUri(replacementPath!)) {
+            return false;
+          }
+          if (effectiveSafMode && result['saf_relative_dir'] is String) {
+            effectiveOutputDir = n._sanitizeSafRelativeDir(
+              result['saf_relative_dir'] as String,
+            );
+          }
+          finalized = await _handleDownloadSuccess();
+          return finalized;
+        } finally {
+          if (!finalized && result['already_exists'] != true) {
+            for (final failedPath in {
+              filePath,
+              result['file_path'] as String?,
+            }) {
+              if (failedPath != null && failedPath != backup) {
+                await deleteFile(failedPath);
+              }
+            }
+          }
+        }
+      });
+    } on HiResOriginalRestoreException {
+      rethrow;
+    } catch (e) {
+      _log.w('[hires-check] re-download of ${item.track.name} failed: $e');
+    } finally {
+      fakeHiResOriginalPath = null;
+      if (!completed) saved.restore(this);
+    }
+    if (completed) return _FakeHiResOutcome.completed;
+    if (aborted || await _shouldAbort('after fake Hi-Res rollback')) {
+      return _FakeHiResOutcome.aborted;
+    }
+    if (!await File(path).exists()) {
+      throw StateError('Could not restore the original Hi-Res file: $path');
+    }
+    n.updateItemStatus(item.id, DownloadStatus.downloading, progress: 1);
+    return _FakeHiResOutcome.kept;
+  }
+
+  /// Only LOSSLESS is a meaningful replacement. A provider that does not
+  /// list it would silently fall back to its default, which may be the very
+  /// Hi-Res tier that produced the fake.
+  bool _serviceOffersFakeHiResFallback() {
+    final service = item.service.trim().toLowerCase();
+    final extension = extensionState.extensions
+        .where((e) => e.id.toLowerCase() == service)
+        .firstOrNull;
+    final options = extension?.qualityOptions ?? const <QualityOption>[];
+    return options.isEmpty ||
+        options.any(
+          (o) =>
+              o.id.toUpperCase() == HiResCheckService.fakeHiResFallbackQuality,
+        );
+  }
+
+  /// Points the next backend request at LOSSLESS. The output folder stays
+  /// as resolved (including any storage fallback); only what depends on the
+  /// quality is rebuilt.
+  Future<void> _useFakeHiResFallbackQuality() async {
+    quality = HiResCheckService.fakeHiResFallbackQuality;
+    safOutputExt = n._determineOutputExt(quality, item.service);
+    if (effectiveSafMode) {
+      final name = await n._buildSafFileNameForItem(
+        item,
+        trackToDownload,
+        filenameFormat: effectiveFilenameFormat,
+        quality: quality,
+        outputExt: safOutputExt,
+      );
+      safFileName = name;
+      safBaseName = name.replaceFirst(RegExp(r'\.[^.]+$'), '');
+      finalSafFileName = name;
+    }
+  }
+}

lib/providers/download_queue_provider_native_worker.dart

@@ -869,6 +869,14 @@ extension _DownloadQueueNativeWorker on DownloadQueueNotifier {
     var quality = item.qualityOverride ?? state.audioQuality;
     if (quality == 'DEFAULT') quality = state.audioQuality;
 
+    // The fake Hi-Res check and its LOSSLESS re-download live in the Dart
+    // run (_DownloadRun._replaceFakeHiResIfNeeded); the native finalizer has
+    // no equivalent, so these items stay on the Dart queue.
+    if (settings.redownloadFakeHiRes &&
+        HiResCheckService.isHiResQuality(quality)) {
+      return null;
+    }
+
     final isSafMode = _isSafMode(settings);
     final rawOutputDir = isSafMode
         ? _buildRelativeOutputDir(

lib/providers/download_queue_provider_single_item.dart

@@ -132,6 +132,8 @@ class _DownloadRun {
   Map<String, dynamic>? probedFinalMetadata;
   bool externalLrcWritten = false;
   final Map<String, String> _directoryScopes = {};
+  bool fakeHiResChecked = false;
+  String? fakeHiResOriginalPath;
 
   Future<void> _run() async {
     final normalizedService = n._normalizeQueuedService(item.service);
@@ -729,6 +731,7 @@ class _DownloadRun {
     decryptionDescriptor = DownloadDecryptionDescriptor.fromDownloadResult(
       result,
     );
+    final requestTrack = trackToDownload;
     trackToDownload = buildTrackForMetadataEmbedding(
       trackToDownload,
       result,
@@ -741,6 +744,18 @@ class _DownloadRun {
     await _applyFormatHandling(actualService);
     stageCompleted('format and metadata');
 
+    final originalHiResPath = fakeHiResOriginalPath;
+    if (originalHiResPath != null &&
+        (filePath == null ||
+            !await HiResCheckService.replacementPreservesAudio(
+              originalHiResPath,
+              filePath!,
+            ))) {
+      throw StateError(
+        'Lossless replacement does not preserve the original audio',
+      );
+    }
+
     if (await _shouldAbort(
       'during finalization',
       deleteFileOnAbort: filePath,
@@ -748,6 +763,19 @@ class _DownloadRun {
       return false;
     }
 
+    // At most once per run: the LOSSLESS replacement is not checked again.
+    if (!fakeHiResChecked) {
+      fakeHiResChecked = true;
+      switch (await _replaceFakeHiResIfNeeded(requestTrack)) {
+        case _FakeHiResOutcome.completed:
+          return true;
+        case _FakeHiResOutcome.aborted:
+          return false;
+        case _FakeHiResOutcome.kept:
+          break;
+      }
+    }
+
     final deferredSafPublish =
         effectiveSafMode &&
         result['saf_deferred_publish'] == true &&
@@ -838,6 +866,23 @@ class _DownloadRun {
       );
     }
 
+    if (originalHiResPath != null &&
+        !await HiResCheckService.replacementPreservesAudio(
+          originalHiResPath,
+          filePath!,
+        )) {
+      throw StateError(
+        'Finalized replacement no longer preserves the original audio',
+      );
+    }
+
+    if (await _shouldAbort(
+      'before publishing finalized audio',
+      deleteFileOnAbort: wasExisting ? null : filePath,
+    )) {
+      return false;
+    }
+
     if (deferredSafPublish && !await _publishDeferredSafOutputOnce()) {
       throw StateError('Failed to publish deferred SAF output');
     }
@@ -1762,13 +1807,19 @@ class _DownloadRun {
           );
         },
       );
-      await n._notificationService.showDownloadComplete(
-        trackName: item.track.name,
-        artistName: item.track.artistName,
-        completedCount: n._completedInSession,
-        totalCount: n._totalQueuedAtStart,
-        alreadyInLibrary: wasExisting,
-      );
+      try {
+        await n._notificationService.showDownloadComplete(
+          trackName: item.track.name,
+          artistName: item.track.artistName,
+          completedCount: n._completedInSession,
+          totalCount: n._totalQueuedAtStart,
+          alreadyInLibrary: wasExisting,
+        );
+      } catch (e) {
+        // Audio and history are already committed. A notification failure
+        // must not roll back a valid replacement or its persisted history.
+        _log.w('Download completed but notification failed: $e');
+      }
       n.removeItem(item.id);
     }
   }

lib/providers/settings_provider.dart

@@ -792,6 +792,11 @@ class SettingsNotifier extends Notifier<AppSettings> {
     _saveSettings();
   }
 
+  void setRedownloadFakeHiRes(bool enabled) {
+    state = state.copyWith(redownloadFakeHiRes: enabled);
+    _saveSettings();
+  }
+
   void setAutoConvertFormat(String format) {
     state = state.copyWith(
       autoConvertFormat: normalizeAutoConvertFormat(format),

lib/screens/settings/download_settings_page.dart

@@ -107,6 +107,15 @@ class _DownloadSettingsPageState extends ConsumerState<DownloadSettingsPage> {
                         showDivider: true,
                       ),
                   ],
+                  SettingsSwitchItem(
+                    icon: Icons.verified_outlined,
+                    title: context.l10n.downloadRedownloadFakeHiRes,
+                    subtitle: context.l10n.downloadRedownloadFakeHiResSubtitle,
+                    value: settings.redownloadFakeHiRes,
+                    onChanged: (value) => ref
+                        .read(settingsProvider.notifier)
+                        .setRedownloadFakeHiRes(value),
+                  ),
                   SettingsSwitchItem(
                     icon: Icons.auto_fix_high_outlined,
                     title: context.l10n.downloadAutoConvert,

lib/screens/settings/settings_search_catalog.dart

@@ -330,6 +330,12 @@ class SettingsSearchCatalog {
           title: l10n.downloadLossyFormat,
           keywords: const ['mp3', 'aac', 'opus'],
         ),
+        SettingsSearchEntry(
+          icon: Icons.verified_outlined,
+          title: l10n.downloadRedownloadFakeHiRes,
+          subtitle: l10n.downloadRedownloadFakeHiResSubtitle,
+          keywords: const ['hi-res', 'hires', 'fake', 'upsampled', '24-bit'],
+        ),
         SettingsSearchEntry(
           icon: Icons.auto_fix_high_outlined,
           title: l10n.downloadAutoConvert,

lib/screens/track_metadata_cards.dart

@@ -88,6 +88,16 @@ extension _TrackMetadataCards on _TrackMetadataScreenState {
                 filePath: _filePath,
                 codecHint: _storedAudioFormat,
               ),
+              if (HiResCheckCard.isCandidate(
+                _filePath,
+                _storedAudioFormat,
+              )) ...[
+                const SizedBox(height: 16),
+                HiResCheckCard(
+                  filePath: _filePath,
+                  formatHint: _storedAudioFormat,
+                ),
+              ],
             ],
 
             if (!context.isMornye) ...[

lib/screens/track_metadata_screen.dart

@@ -64,6 +64,7 @@ import 'package:spotiflac_android/widgets/mornye_context_menu.dart';
 import 'package:spotiflac_android/widgets/mornye_metadata_row.dart';
 import 'package:spotiflac_android/widgets/player_artwork.dart';
 import 'package:spotiflac_android/widgets/audio_analysis_widget.dart';
+import 'package:spotiflac_android/widgets/hires_check_card.dart';
 import 'package:spotiflac_android/widgets/audio_quality_badges.dart';
 import 'package:spotiflac_android/widgets/batch_convert_sheet.dart';
 import 'package:spotiflac_android/widgets/cached_cover_image.dart';

lib/services/hires_check_service.dart

@@ -0,0 +1,162 @@
+import 'dart:io';
+
+import 'package:spotiflac_android/services/platform_bridge.dart';
+
+class HiResOriginalRestoreException implements Exception {
+  const HiResOriginalRestoreException(this.backupPath, this.cause);
+
+  final String backupPath;
+  final FileSystemException cause;
+
+  @override
+  String toString() => 'Original audio retained at $backupPath: $cause';
+}
+
+/// Evidence from the Rust Hi-Res checker's sampled analysis.
+class HiResCheckResult {
+  final bool supported;
+  final String verdict;
+  final int declaredSampleRate;
+  final double cutoffFrequencyHz;
+  final int declaredBitDepth;
+  final int effectiveBitDepth;
+  final bool paddedBitDepth;
+  final String reason;
+
+  /// For a fake: 'certain', 'likely' or 'suspect' (may be a genuine master
+  /// low-pass filtered in mastering). Empty otherwise.
+  final String confidence;
+
+  /// 'sample_hold', 'linear_interpolation', 'imaging', or empty.
+  final String upsamplingArtifact;
+
+  /// Eligible to try a replacement. Full-file verification is still required.
+  final bool redownloadSafe;
+
+  /// Highest frequency whose level still moves with the music; 0 when not
+  /// measured.
+  final double musicCutoffHz;
+
+  /// True when the content past [musicCutoffHz] is steady noise (a DSD or
+  /// analog tape transfer), so [cutoffFrequencyHz] is where noise ends.
+  final bool ultrasonicNoiseOnly;
+
+  /// With [ultrasonicNoiseOnly]: the lowest standard rate that holds all
+  /// the music. Otherwise the declared rate.
+  final int usefulSampleRate;
+
+  const HiResCheckResult({
+    required this.supported,
+    this.verdict = '',
+    this.declaredSampleRate = 0,
+    this.cutoffFrequencyHz = 0,
+    this.declaredBitDepth = 0,
+    this.effectiveBitDepth = 0,
+    this.paddedBitDepth = false,
+    this.reason = '',
+    this.confidence = '',
+    this.upsamplingArtifact = '',
+    this.redownloadSafe = false,
+    this.musicCutoffHz = 0,
+    this.ultrasonicNoiseOnly = false,
+    this.usefulSampleRate = 0,
+  });
+
+  factory HiResCheckResult.fromJson(Map<String, dynamic> json) {
+    return HiResCheckResult(
+      supported: json['supported'] == true,
+      verdict: json['verdict'] as String? ?? '',
+      declaredSampleRate: (json['declared_sample_rate'] as num?)?.toInt() ?? 0,
+      cutoffFrequencyHz: (json['cutoff_frequency_hz'] as num?)?.toDouble() ?? 0,
+      declaredBitDepth: (json['declared_bit_depth'] as num?)?.toInt() ?? 0,
+      effectiveBitDepth: (json['effective_bit_depth'] as num?)?.toInt() ?? 0,
+      paddedBitDepth: json['padded_bit_depth'] == true,
+      reason: json['reason'] as String? ?? '',
+      confidence: json['confidence'] as String? ?? '',
+      upsamplingArtifact: json['upsampling_artifact'] as String? ?? '',
+      redownloadSafe: json['redownload_safe'] == true,
+      musicCutoffHz: (json['music_cutoff_hz'] as num?)?.toDouble() ?? 0,
+      ultrasonicNoiseOnly: json['ultrasonic_noise_only'] == true,
+      usefulSampleRate: (json['useful_sample_rate'] as num?)?.toInt() ?? 0,
+    );
+  }
+
+  bool get isFake => verdict == 'fake_hires';
+
+  bool get isCertain => isFake && confidence == 'certain';
+  bool get isSuspect => isFake && confidence == 'suspect';
+
+  /// Mirrors the analysis thresholds: a rate claim above 48 kHz whose content
+  /// stops below 28 kHz. Recomputed here so the reason can be localized.
+  bool get upsampled =>
+      isFake && declaredSampleRate > 48000 && cutoffFrequencyHz < 28000;
+}
+
+class HiResCheckService {
+  /// The requested qualities that actually claim Hi-Res. A LOSSLESS request
+  /// answered with CD-range audio is not a fake: it is what was asked for.
+  static const hiResQualities = {'HI_RES', 'HI_RES_LOSSLESS'};
+
+  /// Requested fallback tier. Its name does not guarantee audio equivalence.
+  static const fakeHiResFallbackQuality = 'LOSSLESS';
+
+  static bool isHiResQuality(String quality) =>
+      hiResQualities.contains(quality.trim().toUpperCase());
+
+  /// Runs the check; throws on failure. `supported == false` for formats
+  /// the Rust checker cannot decode (anything but FLAC and PCM WAV).
+  static Future<HiResCheckResult> check(String filePath) async {
+    final json = await PlatformBridge.checkHiResAuthenticity(filePath);
+    final error = json['error'];
+    if (error != null) throw StateError(error.toString());
+    return HiResCheckResult.fromJson(json);
+  }
+
+  /// Every sample, channel and frame must match after removing only zero-bit
+  /// padding or exact sample repetition. Missing/old backend support fails closed.
+  static Future<bool> replacementPreservesAudio(
+    String originalPath,
+    String replacementPath,
+  ) async {
+    final result = await PlatformBridge.checkHiResAuthenticity(
+      originalPath,
+      options: {'verify_replacement_path': replacementPath},
+    );
+    return result['error'] == null && result['replacement_equivalent'] == true;
+  }
+
+  /// Keeps a unique backup on the same filesystem until [replaceAndFinalize]
+  /// has validated, processed, published and persisted the replacement.
+  /// False, cancellation or any exception restores the original atomically.
+  static Future<bool> withOriginalBackup(
+    String originalPath,
+    Future<bool> Function(String backupPath) replaceAndFinalize,
+  ) async {
+    final original = File(originalPath);
+    final directory = await original.parent.createTemp('.fake-hires-');
+    final backup = File('${directory.path}/${original.uri.pathSegments.last}');
+    var moved = false;
+    var committed = false;
+    try {
+      await original.rename(backup.path);
+      moved = true;
+      committed = await replaceAndFinalize(backup.path);
+      return committed;
+    } finally {
+      if (moved && !committed) {
+        // If restoration fails, retain the backup and surface the error.
+        try {
+          await backup.rename(originalPath);
+        } on FileSystemException catch (error) {
+          throw HiResOriginalRestoreException(backup.path, error);
+        }
+      }
+      // Cleanup failure must not roll back a successfully published file.
+      try {
+        await directory.delete(recursive: true);
+      } on FileSystemException {
+        // A leftover backup is preferable to losing the completed download.
+      }
+    }
+  }
+}

lib/services/platform_bridge.dart

@@ -1156,6 +1156,18 @@ class PlatformBridge {
     });
   }
 
+  /// Runs the Rust Hi-Res check (spectral cutoff + padded bit depth) on
+  /// a FLAC or WAV file. Returns `{"supported": false}` for other formats.
+  static Future<Map<String, dynamic>> checkHiResAuthenticity(
+    String filePath, {
+    Map<String, dynamic>? options,
+  }) {
+    return _invokeMap('checkHiResAuthenticity', {
+      'file_path': filePath,
+      'options_json': options == null ? '' : jsonEncode(options),
+    });
+  }
+
   /// Reads the tags and quality fields used for automatic Library display.
   ///
   /// Android's readAudioMetadata implementation can inspect most SAF files

lib/widgets/hires_check_card.dart

@@ -0,0 +1,308 @@
+import 'package:flutter/material.dart';
+import 'package:spotiflac_android/l10n/l10n.dart';
+import 'package:spotiflac_android/services/hires_check_service.dart';
+import 'package:spotiflac_android/widgets/settings_group.dart';
+
+/// On-demand fake Hi-Res check for one FLAC/WAV file: spectral cutoff for
+/// upsampling, and unused low bits for a 16-bit master padded to 24.
+class HiResCheckCard extends StatefulWidget {
+  final String filePath;
+  final String? formatHint;
+
+  const HiResCheckCard({super.key, required this.filePath, this.formatHint});
+
+  /// Only FLAC and PCM WAV are decoded by the Go checker.
+  static bool isCandidate(String filePath, String? formatHint) {
+    final format = formatHint?.toLowerCase().trim() ?? '';
+    if (format == 'flac' || format == 'wav') return true;
+    final lower = filePath.toLowerCase();
+    return lower.endsWith('.flac') || lower.endsWith('.wav');
+  }
+
+  @override
+  State<HiResCheckCard> createState() => _HiResCheckCardState();
+}
+
+class _HiResCheckCardState extends State<HiResCheckCard> {
+  HiResCheckResult? _result;
+  bool _checking = false;
+  String? _error;
+  int _requestId = 0;
+
+  @override
+  void didUpdateWidget(covariant HiResCheckCard oldWidget) {
+    super.didUpdateWidget(oldWidget);
+    if (oldWidget.filePath != widget.filePath) {
+      _requestId++;
+      _result = null;
+      _error = null;
+      _checking = false;
+    }
+  }
+
+  Future<void> _check() async {
+    final requestId = ++_requestId;
+    setState(() {
+      _checking = true;
+      _error = null;
+    });
+    String? error;
+    HiResCheckResult? result;
+    try {
+      result = await HiResCheckService.check(widget.filePath);
+    } on StateError catch (e) {
+      error = e.message;
+    } catch (e) {
+      error = e.toString();
+    }
+    if (!mounted || requestId != _requestId) return;
+    setState(() {
+      _checking = false;
+      _result = result;
+      _error = error;
+    });
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    if (!HiResCheckCard.isCandidate(widget.filePath, widget.formatHint)) {
+      return const SizedBox.shrink();
+    }
+    final cs = Theme.of(context).colorScheme;
+    final l10n = context.l10n;
+    final result = _result;
+
+    return Card(
+      elevation: 0,
+      color: settingsGroupColor(context),
+      shape: RoundedRectangleBorder(
+        borderRadius: BorderRadius.circular(20),
+        side: BorderSide(color: cs.outlineVariant.withValues(alpha: 0.5)),
+      ),
+      child: Padding(
+        padding: const EdgeInsets.all(16),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                Icon(Icons.verified_outlined, color: cs.primary, size: 20),
+                const SizedBox(width: 8),
+                Expanded(
+                  child: Text(
+                    l10n.hiResCheckTitle,
+                    style: TextStyle(
+                      color: cs.onSurface,
+                      fontWeight: FontWeight.w600,
+                      fontSize: 14,
+                    ),
+                  ),
+                ),
+                if (_checking)
+                  const SizedBox(
+                    width: 20,
+                    height: 20,
+                    child: CircularProgressIndicator(strokeWidth: 2.5),
+                  )
+                else if (result != null || _error != null)
+                  IconButton(
+                    icon: const Icon(Icons.refresh, size: 20),
+                    tooltip: l10n.audioAnalysisRescan,
+                    visualDensity: VisualDensity.compact,
+                    padding: EdgeInsets.zero,
+                    constraints: const BoxConstraints(
+                      minWidth: 48,
+                      minHeight: 48,
+                    ),
+                    color: cs.onSurfaceVariant,
+                    onPressed: _check,
+                  ),
+              ],
+            ),
+            const SizedBox(height: 8),
+            if (_checking)
+              _secondaryText(l10n.hiResCheckChecking, cs)
+            else if (_error != null)
+              Text(
+                l10n.hiResCheckFailed(_error!),
+                style: TextStyle(color: cs.error, fontSize: 13),
+              )
+            else if (result == null) ...[
+              _secondaryText(l10n.hiResCheckDescription, cs),
+              const SizedBox(height: 12),
+              FilledButton.tonalIcon(
+                onPressed: _check,
+                icon: const Icon(Icons.search, size: 18),
+                label: Text(l10n.hiResCheckRun),
+              ),
+            ] else if (!result.supported)
+              _secondaryText(l10n.hiResCheckUnsupported, cs)
+            else
+              ..._buildResult(context, result, cs),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _secondaryText(String text, ColorScheme cs) {
+    return Text(
+      text,
+      style: TextStyle(color: cs.onSurfaceVariant, fontSize: 13),
+    );
+  }
+
+  List<Widget> _buildResult(
+    BuildContext context,
+    HiResCheckResult result,
+    ColorScheme cs,
+  ) {
+    final l10n = context.l10n;
+    final (IconData icon, Color color, String label) = switch (result.verdict) {
+      'fake_hires' when result.isCertain => (
+        Icons.error_outline,
+        cs.error,
+        l10n.hiResCheckVerdictFakeCertain,
+      ),
+      'fake_hires' when result.isSuspect => (
+        Icons.help_outline,
+        cs.tertiary,
+        l10n.hiResCheckVerdictFakeSuspect,
+      ),
+      'fake_hires' => (
+        Icons.warning_amber_rounded,
+        cs.error,
+        l10n.hiResCheckVerdictFake,
+      ),
+      'genuine_hires' => (
+        Icons.check_circle_outline,
+        cs.primary,
+        l10n.hiResCheckVerdictGenuine,
+      ),
+      'standard_definition' => (
+        Icons.info_outline,
+        cs.onSurfaceVariant,
+        l10n.hiResCheckVerdictStandard,
+      ),
+      _ => (
+        Icons.help_outline,
+        cs.onSurfaceVariant,
+        l10n.hiResCheckVerdictInconclusive,
+      ),
+    };
+
+    final effectiveBits = result.effectiveBitDepth > 0
+        ? result.effectiveBitDepth
+        : null;
+    final reasons = <String>[
+      if (result.upsamplingArtifact == 'sample_hold')
+        l10n.hiResCheckReasonSampleHold,
+      if (result.upsamplingArtifact == 'linear_interpolation')
+        l10n.hiResCheckReasonInterpolation,
+      if (result.upsamplingArtifact == 'imaging') l10n.hiResCheckReasonImaging,
+      if (result.upsampled)
+        l10n.hiResCheckReasonRate(
+          _formatKHz(result.declaredSampleRate.toDouble()),
+          _formatKHz(result.cutoffFrequencyHz),
+        ),
+      if (result.isFake && result.paddedBitDepth)
+        l10n.hiResCheckReasonDepth(
+          result.declaredBitDepth,
+          result.effectiveBitDepth,
+        ),
+    ];
+
+    return [
+      Row(
+        children: [
+          Icon(icon, color: color, size: 18),
+          const SizedBox(width: 6),
+          Expanded(
+            child: Text(
+              label,
+              style: TextStyle(
+                color: color,
+                fontWeight: FontWeight.w600,
+                fontSize: 13,
+              ),
+            ),
+          ),
+        ],
+      ),
+      for (final reason in reasons) ...[
+        const SizedBox(height: 4),
+        _secondaryText('• $reason', cs),
+      ],
+      if (result.ultrasonicNoiseOnly) ...[
+        const SizedBox(height: 4),
+        _secondaryText(
+          '• ${l10n.hiResCheckUltrasonicNoise(_formatKHz(result.musicCutoffHz), _formatKHz(result.usefulSampleRate.toDouble()))}',
+          cs,
+        ),
+      ],
+      if (result.verdict != 'inconclusive') ...[
+        const SizedBox(height: 8),
+        Wrap(
+          spacing: 16,
+          runSpacing: 4,
+          children: [
+            // Past the music only steady noise remains, so where it ends
+            // says nothing about the music: show the music's own edge.
+            if (result.ultrasonicNoiseOnly)
+              _detail(
+                l10n.hiResCheckMusicContent,
+                '~${_formatKHz(result.musicCutoffHz)}',
+                cs,
+              )
+            else
+              _detail(
+                l10n.hiResCheckCutoff,
+                '~${_formatKHz(result.cutoffFrequencyHz)}',
+                cs,
+              ),
+            if (result.declaredBitDepth > 0)
+              _detail(
+                l10n.hiResCheckBitsInUse,
+                '${effectiveBits ?? '?'} / ${result.declaredBitDepth}-bit',
+                cs,
+              ),
+          ],
+        ),
+      ],
+      if (result.isSuspect) ...[
+        const SizedBox(height: 8),
+        Text(
+          l10n.hiResCheckDisclaimer,
+          style: TextStyle(
+            color: cs.onSurfaceVariant,
+            fontSize: 11,
+            fontStyle: FontStyle.italic,
+          ),
+        ),
+      ],
+    ];
+  }
+
+  Widget _detail(String label, String value, ColorScheme cs) {
+    return Text.rich(
+      TextSpan(
+        children: [
+          TextSpan(
+            text: '$label: ',
+            style: TextStyle(color: cs.onSurfaceVariant, fontSize: 12),
+          ),
+          TextSpan(
+            text: value,
+            style: TextStyle(
+              color: cs.onSurface,
+              fontSize: 12,
+              fontWeight: FontWeight.w600,
+            ),
+          ),
+        ],
+      ),
+    );
+  }
+
+  String _formatKHz(double hz) => '${(hz / 1000).toStringAsFixed(1)} kHz';
+}

rust_backend/Cargo.lock

@@ -474,6 +474,12 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
 
+[[package]]
+name = "claxon"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bfbf56724aa9eca8afa4fcfadeb479e722935bb2a0900c2d37e0cc477af0688"
+
 [[package]]
 name = "cmov"
 version = "0.5.4"
@@ -2366,6 +2372,7 @@ version = "0.1.0"
 dependencies = [
  "base64",
  "chrono",
+ "claxon",
  "image",
  "regex",
  "rustix",

rust_backend/Cargo.toml

@@ -58,6 +58,8 @@ html5ever = "=0.39.0"
 unicode-normalization = "=0.1.22"
 unicode-general-category = "=0.6.0"
 time = { version = "=0.3.55", features = ["parsing"] }
+# Pure-Rust FLAC decoder for the Hi-Res authenticity check.
+claxon = "=0.4.3"
 chrono = { version = "=0.4.45", default-features = false, features = ["clock"] }
 tz-rs = "=0.7.3"
 httpdate = "=1.0.3"

rust_backend/crates/core/Cargo.toml

@@ -16,6 +16,7 @@ unicode-normalization.workspace = true
 unicode-general-category.workspace = true
 chrono.workspace = true
 rustix.workspace = true
+claxon.workspace = true
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tz-rs.workspace = true

rust_backend/crates/core/src/media/hires/evidence.rs

@@ -0,0 +1,492 @@
+//! Evidence that separates a fake Hi-Res file from a genuine master that was
+//! merely low-pass filtered. Above ~22 kHz the two are the same signal, so no
+//! spectral rule can tell them apart everywhere; these tests answer instead
+//! how the sampled segment may have been made. They cannot prove that a
+//! separate LOSSLESS copy preserves the whole file.
+//!
+//! - Integer-ratio upsampling artifacts (sample-and-hold, linear
+//!   interpolation) and spectral imaging are exact fingerprints: "certain".
+//! - A brickwall right at a CD/DAT Nyquist (22.05 / 24 kHz) means a
+//!   44.1/48 kHz chain. With an in-band noise floor no lower than 16-bit
+//!   quantization noise, a CD-derived source is "likely". This remains a
+//!   heuristic and does not authorize automatic replacement.
+//! - Anything else that fails the cutoff test may be a genuine master:
+//!   "suspect", never replaced automatically.
+
+use super::fft::Radix2Fft;
+
+pub const CONFIDENCE_CERTAIN: &str = "certain";
+pub const CONFIDENCE_LIKELY: &str = "likely";
+pub const CONFIDENCE_SUSPECT: &str = "suspect";
+
+pub const ARTIFACT_SAMPLE_HOLD: &str = "sample_hold";
+pub const ARTIFACT_INTERPOLATION: &str = "linear_interpolation";
+pub const ARTIFACT_IMAGING: &str = "imaging";
+
+pub const FLOOR_BELOW_16BIT: &str = "below_16bit";
+pub const FLOOR_AT_16BIT: &str = "at_16bit";
+pub const FLOOR_MASKED: &str = "masked";
+
+/// Standard-definition rates a fake is made from; their Nyquist is where a
+/// resampler's anti-imaging filter leaves its cliff.
+const SOURCE_RATES: [u32; 2] = [44_100, 48_000];
+
+/// Band the in-band noise floor is measured over. Noise-shaped dither lowers
+/// the floor in the mid-band only by raising it above ~15 kHz, so averaging
+/// over the whole band keeps a shaped 16-bit floor at or above the flat one.
+const FLOOR_BAND_LOW_HZ: f64 = 500.0;
+const FLOOR_BAND_HIGH_HZ: f64 = 20_000.0;
+/// Fraction of fully-inside STFT frames, quietest first, the floor is read in.
+const QUIET_FRAME_FRACTION: f64 = 0.1;
+/// Floor against flat 16-bit quantization noise: below this there is
+/// resolution a 16-bit copy would lose; above FLOOR_MASKED_DB the quietest
+/// frames still carry music and the floor cannot be read.
+const FLOOR_BELOW_16BIT_DB: f64 = -6.0;
+const FLOOR_MASKED_DB: f64 = 20.0;
+/// Brickwall: flat passband before the source Nyquist, a cliff after it.
+const BRICKWALL_MAX_PASSBAND_DROP_DB: f64 = 20.0;
+const BRICKWALL_MIN_CLIFF_DB: f64 = 40.0;
+/// Within this, the passband counts as still flat at the edge.
+const BRICKWALL_FLAT_PASSBAND_DB: f64 = 6.0;
+/// Imaging: the band above the source Nyquist mirrors the one below.
+const IMAGING_MIN_CORRELATION: f64 = 0.9;
+/// Integer-upsampling artifacts: the signal must move at enough original
+/// samples, and (almost) never between them.
+const ARTIFACT_MIN_MOVING_ANCHORS: usize = 1000;
+const ARTIFACT_MAX_VIOLATION_RATE: f64 = 0.001;
+/// Music bandwidth: 1 kHz bands from MUSIC_BAND_START_HZ up are music while
+/// their level swings with it across frames (p95-p5 at least
+/// MUSIC_MIN_SPREAD_DB). Steady noise, such as the ultrasonic hump a DSD or
+/// tape transfer carries up to Nyquist, averages out to a few dB.
+const MUSIC_BAND_START_HZ: f64 = 16_000.0;
+const MUSIC_BAND_WIDTH_HZ: f64 = 1_000.0;
+const MUSIC_MIN_SPREAD_DB: f64 = 10.0;
+/// Active content this far past the music bandwidth is reported as steady
+/// noise rather than content.
+pub const ULTRASONIC_NOISE_MARGIN_HZ: f64 = 8_000.0;
+/// Standard rate families; a file's useful rate is looked up in its own.
+const RATE_FAMILIES: [[u32; 4]; 2] = [
+    [44_100, 88_200, 176_400, 352_800],
+    [48_000, 96_000, 192_000, 384_000],
+];
+
+/// The averaged spectrum plus what the quiet frames and the ultrasonic bands
+/// say, gathered in the same STFT pass.
+pub struct StftStats {
+    pub avg_magnitude: Vec<f64>,
+    /// Variance-equivalent (white noise) floor of the quietest frames in
+    /// full-scale units, or NaN when no frame qualified.
+    pub quiet_floor_var: f64,
+    /// p95-p5 spread across frames of each 1 kHz band's level, from 16 kHz
+    /// up, in order; see [`music_cutoff`].
+    pub music_band_spreads: Vec<f64>,
+}
+
+/// Matches `np.abs(librosa.stft(y, n_fft)).mean(axis=1)` for the averaged
+/// spectrum: periodic Hann window, hop n_fft/4, frames centred by
+/// zero-padding n_fft/2 at both ends.
+pub fn analyze_stft(
+    y: &[f32],
+    n_fft: usize,
+    sample_rate: u32,
+    check: &dyn Fn() -> Result<(), String>,
+) -> Result<StftStats, String> {
+    let hop = n_fft / 4;
+    let half = n_fft / 2;
+    let bins = half + 1;
+    let mut stats = StftStats {
+        avg_magnitude: vec![0.0; bins],
+        quiet_floor_var: f64::NAN,
+        music_band_spreads: Vec::new(),
+    };
+    let padded_len = y.len() + 2 * half;
+    if padded_len < n_fft {
+        return Ok(stats);
+    }
+    let frame_count = 1 + (padded_len - n_fft) / hop;
+
+    let window: Vec<f64> = (0..n_fft)
+        .map(|i| 0.5 - 0.5 * (2.0 * std::f64::consts::PI * i as f64 / n_fft as f64).cos())
+        .collect();
+    let window_power: f64 = window.iter().map(|w| w * w).sum();
+    let bin_hz = f64::from(sample_rate) / n_fft as f64;
+    let band_low = (FLOOR_BAND_LOW_HZ / bin_hz).ceil() as usize;
+    let band_high = ((FLOOR_BAND_HIGH_HZ / bin_hz) as usize).min(half);
+
+    // Per-frame level of each 1 kHz band above 16 kHz, for the music
+    // bandwidth. Only above a CD's Nyquist does the question arise.
+    let mut music_bands: Vec<(usize, usize)> = Vec::new();
+    let nyquist = f64::from(sample_rate) / 2.0;
+    if nyquist > f64::from(SOURCE_RATES[1]) / 2.0 {
+        let mut lo = MUSIC_BAND_START_HZ;
+        while lo + MUSIC_BAND_WIDTH_HZ <= nyquist {
+            let first = (lo / bin_hz).ceil() as usize;
+            let last = (((lo + MUSIC_BAND_WIDTH_HZ) / bin_hz).ceil() as usize).min(half + 1);
+            if last > first {
+                music_bands.push((first, last));
+            }
+            lo += MUSIC_BAND_WIDTH_HZ;
+        }
+    }
+    let mut music_levels: Vec<Vec<f64>> = vec![Vec::new(); music_bands.len()];
+
+    let fft = Radix2Fft::new(n_fft);
+    let mut re = vec![0.0; n_fft];
+    let mut im = vec![0.0; n_fft];
+    let mut band_power: Vec<f64> = Vec::with_capacity(band_high.saturating_sub(band_low) + 1);
+    // (mean, median) band power of each fully-inside, non-silent frame.
+    let mut frames: Vec<(f64, f64)> = Vec::new();
+
+    for f in 0..frame_count {
+        if f.is_multiple_of(256) {
+            check()?;
+        }
+        // Index into y of the frame's first sample.
+        let start = (f * hop) as isize - half as isize;
+        for (i, (r, w)) in re.iter_mut().zip(&window).enumerate() {
+            let j = start + i as isize;
+            *r = if j >= 0 && (j as usize) < y.len() {
+                f64::from(y[j as usize]) * w
+            } else {
+                0.0
+            };
+        }
+        im.fill(0.0);
+        fft.transform(&mut re, &mut im);
+        for (k, avg) in stats.avg_magnitude.iter_mut().enumerate() {
+            *avg += re[k].hypot(im[k]);
+        }
+
+        // Frames that overlap the zero padding would read as quiet for the
+        // wrong reason; only frames fully inside the signal are candidates.
+        if start < 0 || start as usize + n_fft > y.len() || band_high <= band_low {
+            continue;
+        }
+        band_power.clear();
+        let mut sum = 0.0;
+        for k in band_low..=band_high {
+            let p = re[k] * re[k] + im[k] * im[k];
+            band_power.push(p);
+            sum += p;
+        }
+        if sum == 0.0 {
+            continue; // digital silence carries no floor to measure
+        }
+        let mean = sum / band_power.len() as f64;
+        frames.push((mean, median_in_place(&mut band_power)));
+        for (levels, &(first, last)) in music_levels.iter_mut().zip(&music_bands) {
+            let power: f64 = (first..last)
+                .map(|k| re[k] * re[k] + im[k] * im[k])
+                .sum::<f64>()
+                / (last - first) as f64;
+            levels.push(10.0 * power.max(1e-30).log10());
+        }
+    }
+    for avg in &mut stats.avg_magnitude {
+        *avg /= frame_count as f64;
+    }
+
+    if !frames.is_empty() {
+        frames.sort_by(|a, b| a.0.total_cmp(&b.0));
+        let count = ((frames.len() as f64 * QUIET_FRAME_FRACTION) as usize).max(1);
+        // |X|^2 of white noise is exponential with mean sigma^2 * sum(w^2), so
+        // its median is ln 2 times that. The median ignores tonal peaks.
+        let mut estimates: Vec<f64> = frames[..count]
+            .iter()
+            .map(|&(_, median)| median / std::f64::consts::LN_2 / window_power)
+            .collect();
+        stats.quiet_floor_var = median_in_place(&mut estimates);
+    }
+    for mut levels in music_levels {
+        if levels.len() < 2 {
+            break;
+        }
+        levels.sort_by(f64::total_cmp);
+        stats
+            .music_band_spreads
+            .push(percentile_sorted(&levels, 0.95) - percentile_sorted(&levels, 0.05));
+    }
+    Ok(stats)
+}
+
+/// Compares the measured floor with flat 16-bit quantization noise: LSB^2/12
+/// per channel, divided by the channel count for the mono downmix of
+/// independent channels, which is the lowest it can be.
+pub fn classify_noise_floor(floor_var: f64, channels: u32) -> (&'static str, f64) {
+    if floor_var.is_nan() || floor_var <= 0.0 {
+        return ("", 0.0);
+    }
+    let lsb = 2f64.powi(-15);
+    let reference = lsb * lsb / 12.0 / f64::from(channels.max(1));
+    let vs_16bit_db = 10.0 * (floor_var / reference).log10();
+    let class = if vs_16bit_db < FLOOR_BELOW_16BIT_DB {
+        FLOOR_BELOW_16BIT
+    } else if vs_16bit_db > FLOOR_MASKED_DB {
+        FLOOR_MASKED
+    } else {
+        FLOOR_AT_16BIT
+    };
+    (class, vs_16bit_db)
+}
+
+/// Converts the averaged magnitude spectrum to dB below its peak.
+pub fn spectrum_db(avg: &[f64]) -> Vec<f64> {
+    let peak = avg.iter().copied().fold(0.0, f64::max).max(1e-30);
+    avg.iter()
+        .map(|&v| 20.0 * (v.max(1e-30) / peak).log10())
+        .collect()
+}
+
+/// The bins between `low_hz` and `high_hz` inclusive.
+fn spectrum_band(
+    spec_db: &[f64],
+    sample_rate: u32,
+    n_fft: usize,
+    low_hz: f64,
+    high_hz: f64,
+) -> Vec<f64> {
+    let bin_hz = f64::from(sample_rate) / n_fft as f64;
+    let lo = (low_hz / bin_hz).ceil().max(0.0) as usize;
+    let hi = ((high_hz / bin_hz) as usize).min(spec_db.len().saturating_sub(1));
+    if hi < lo {
+        return Vec::new();
+    }
+    spec_db[lo..=hi].to_vec()
+}
+
+/// The source Nyquist (22050 or 24000 Hz) at which the spectrum stays flat
+/// right up to the edge and then falls off a cliff: the shape a resampler's
+/// anti-imaging filter leaves. A mastering low-pass rolls off gradually and is
+/// already well down before the edge. 0 if neither.
+///
+/// A 48 kHz source passes the test at 22.05 kHz too (its cliff lies beyond
+/// that edge as well), so the highest edge the passband still reaches flat
+/// wins; a 44.1 kHz source is already sloping into its transition band there.
+pub fn detect_brickwall(
+    spec_db: &[f64],
+    sample_rate: u32,
+    n_fft: usize,
+    noise_floor_db: f64,
+) -> f64 {
+    let mut best = 0.0;
+    let mut best_drop = f64::INFINITY;
+    for rate in SOURCE_RATES {
+        let edge = f64::from(rate) / 2.0;
+        if edge + 5000.0 > f64::from(sample_rate) / 2.0 {
+            continue;
+        }
+        let mut passband = spectrum_band(spec_db, sample_rate, n_fft, edge - 8000.0, edge - 5000.0);
+        let mut below = spectrum_band(spec_db, sample_rate, n_fft, edge - 2500.0, edge - 500.0);
+        let mut above = spectrum_band(spec_db, sample_rate, n_fft, edge + 2500.0, edge + 5000.0);
+        if passband.is_empty() || below.is_empty() || above.is_empty() {
+            continue;
+        }
+        let below_level = median_in_place(&mut below);
+        let drop = median_in_place(&mut passband) - below_level;
+        let cliff = below_level - median_in_place(&mut above);
+        if below_level <= noise_floor_db
+            || drop > BRICKWALL_MAX_PASSBAND_DROP_DB
+            || cliff < BRICKWALL_MIN_CLIFF_DB
+        {
+            continue;
+        }
+        let flat = drop <= BRICKWALL_FLAT_PASSBAND_DB;
+        let best_flat = best_drop <= BRICKWALL_FLAT_PASSBAND_DB;
+        if best == 0.0
+            || (flat && (!best_flat || edge > best))
+            || (!flat && !best_flat && drop < best_drop)
+        {
+            best = edge;
+            best_drop = drop;
+        }
+    }
+    best
+}
+
+/// Whether the band above a source Nyquist mirrors the band below it, which
+/// is what upsampling without (or with a poor) anti-imaging filter leaves.
+/// Genuine content keeps falling with frequency, so its mirror correlation is
+/// near zero or negative.
+pub fn detect_imaging(
+    spec_db: &[f64],
+    sample_rate: u32,
+    n_fft: usize,
+    noise_floor_db: f64,
+) -> bool {
+    let bin_hz = f64::from(sample_rate) / n_fft as f64;
+    for rate in SOURCE_RATES {
+        let rate = f64::from(rate);
+        let low_hz = rate / 2.0 + 500.0;
+        let high_hz = (rate - 500.0).min(f64::from(sample_rate) / 2.0 - 500.0);
+        if high_hz - low_hz < 2000.0 {
+            continue;
+        }
+        let mut image = Vec::new();
+        let mut mirror = Vec::new();
+        let mut k = (low_hz / bin_hz).ceil() as usize;
+        while k as f64 * bin_hz <= high_hz {
+            // Rounded half away from zero, as Go's math.Round does.
+            let m = ((rate - k as f64 * bin_hz) / bin_hz).round();
+            if k < spec_db.len() && m >= 0.0 && (m as usize) < spec_db.len() {
+                image.push(spec_db[k]);
+                mirror.push(spec_db[m as usize]);
+            }
+            k += 1;
+        }
+        if image.len() < 16 || image.iter().sum::<f64>() / image.len() as f64 <= noise_floor_db {
+            continue; // no content above the edge: nothing was mirrored
+        }
+        if pearson(&image, &mirror) >= IMAGING_MIN_CORRELATION {
+            return true;
+        }
+    }
+    false
+}
+
+/// The exact fingerprints of upsampling by an integer ratio from 44.1/48 kHz:
+/// every sample repeated (sample-and-hold) or the in-between samples on a
+/// straight line (linear interpolation). `samples` is one channel,
+/// right-justified; `or_bits` is the OR over the whole window.
+pub fn detect_integer_upsampling(samples: &[i32], or_bits: u32, sample_rate: u32) -> &'static str {
+    if or_bits == 0 || samples.len() < 4 {
+        return "";
+    }
+    // Measure in units of the bits actually used, so a padded source's
+    // rounding stays within a couple of its own LSBs.
+    let unused = or_bits.trailing_zeros();
+    for rate in SOURCE_RATES {
+        if !sample_rate.is_multiple_of(rate) {
+            continue;
+        }
+        let ratio = (sample_rate / rate) as usize;
+        if !(2..=8).contains(&ratio) {
+            continue;
+        }
+        for phase in 0..ratio {
+            let artifact = integer_upsampling_at_phase(samples, unused, ratio, phase);
+            if !artifact.is_empty() {
+                return artifact;
+            }
+        }
+    }
+    ""
+}
+
+fn integer_upsampling_at_phase(
+    samples: &[i32],
+    unused: u32,
+    ratio: usize,
+    phase: usize,
+) -> &'static str {
+    let at = |i: usize| i64::from(samples[i] >> unused);
+    let (mut inner, mut hold_violations, mut hold_moving) = (0usize, 0usize, 0usize);
+    let (mut line_violations, mut line_moving) = (0usize, 0usize);
+    for i in 1..samples.len() - 1 {
+        let d1 = at(i) - at(i - 1);
+        let d2 = (at(i - 1) - 2 * at(i) + at(i + 1)).abs();
+        if !(i + ratio - phase).is_multiple_of(ratio) {
+            // Between two original samples.
+            inner += 1;
+            hold_violations += usize::from(d1 != 0);
+            line_violations += usize::from(d2 > 2);
+        } else {
+            // An original sample.
+            hold_moving += usize::from(d1 != 0);
+            line_moving += usize::from(d2 > 2);
+        }
+    }
+    let max_violations = inner as f64 * ARTIFACT_MAX_VIOLATION_RATE;
+    if hold_moving >= ARTIFACT_MIN_MOVING_ANCHORS && hold_violations as f64 <= max_violations {
+        return ARTIFACT_SAMPLE_HOLD;
+    }
+    if line_moving >= ARTIFACT_MIN_MOVING_ANCHORS && line_violations as f64 <= max_violations {
+        return ARTIFACT_INTERPOLATION;
+    }
+    ""
+}
+
+/// Upper edge of the last contiguous 1 kHz band, from 16 kHz up, that both
+/// carries active content (its level in the averaged spectrum above
+/// `noise_floor_db`) and moves with the music. The level test keeps a
+/// resampler's leakage, which swings with the music too but sits far below
+/// it, from counting. 0 when even the first band fails.
+pub fn music_cutoff(
+    spreads: &[f64],
+    spec_db: &[f64],
+    sample_rate: u32,
+    n_fft: usize,
+    noise_floor_db: f64,
+) -> f64 {
+    let mut cutoff = 0.0;
+    for (index, &spread) in spreads.iter().enumerate() {
+        let lo = MUSIC_BAND_START_HZ + index as f64 * MUSIC_BAND_WIDTH_HZ;
+        let band = spectrum_band(spec_db, sample_rate, n_fft, lo, lo + MUSIC_BAND_WIDTH_HZ);
+        if band.is_empty() || spread < MUSIC_MIN_SPREAD_DB {
+            break;
+        }
+        if band.iter().sum::<f64>() / band.len() as f64 <= noise_floor_db {
+            break;
+        }
+        cutoff = lo + MUSIC_BAND_WIDTH_HZ;
+    }
+    cutoff
+}
+
+/// The lowest standard rate in the declared rate's family whose Nyquist
+/// still holds `music_cutoff_hz`; the declared rate itself when none below it
+/// does, or when the rate is not a standard one.
+pub fn useful_sample_rate(declared: u32, music_cutoff_hz: f64) -> u32 {
+    for family in RATE_FAMILIES {
+        if !declared.is_multiple_of(family[0]) {
+            continue;
+        }
+        for rate in family {
+            if rate >= declared {
+                break;
+            }
+            if f64::from(rate) / 2.0 >= music_cutoff_hz {
+                return rate;
+            }
+        }
+    }
+    declared
+}
+
+fn pearson(a: &[f64], b: &[f64]) -> f64 {
+    let n = a.len() as f64;
+    let mean_a = a.iter().sum::<f64>() / n;
+    let mean_b = b.iter().sum::<f64>() / n;
+    let (mut cov, mut var_a, mut var_b) = (0.0, 0.0, 0.0);
+    for (&x, &y) in a.iter().zip(b) {
+        let (da, db) = (x - mean_a, y - mean_b);
+        cov += da * db;
+        var_a += da * da;
+        var_b += db * db;
+    }
+    if var_a == 0.0 || var_b == 0.0 {
+        return 0.0;
+    }
+    cov / (var_a * var_b).sqrt()
+}
+
+/// Sorts `values` and returns their median.
+pub(super) fn median_in_place(values: &mut [f64]) -> f64 {
+    if values.is_empty() {
+        return f64::NAN;
+    }
+    values.sort_by(f64::total_cmp);
+    let mid = values.len() / 2;
+    if values.len() % 2 == 1 {
+        values[mid]
+    } else {
+        (values[mid - 1] + values[mid]) / 2.0
+    }
+}
+
+/// numpy's default (linear) percentile of sorted values.
+fn percentile_sorted(sorted: &[f64], q: f64) -> f64 {
+    let pos = q * (sorted.len() - 1) as f64;
+    let lo = pos.floor() as usize;
+    let hi = (lo + 1).min(sorted.len() - 1);
+    sorted[lo] + (sorted[hi] - sorted[lo]) * (pos - lo as f64)
+}

rust_backend/crates/core/src/media/hires/fft.rs

@@ -0,0 +1,53 @@
+//! In-place iterative Cooley-Tukey FFT with precomputed twiddles and
+//! bit-reversal permutation, reused across all STFT frames. The same
+//! algorithm as SpotiFLAC-Module-Version's checker, so both agree bin for bin.
+
+pub struct Radix2Fft {
+    n: usize,
+    twiddle_re: Vec<f64>,
+    twiddle_im: Vec<f64>,
+    reversed: Vec<usize>,
+}
+
+impl Radix2Fft {
+    /// `n` must be a power of two.
+    pub fn new(n: usize) -> Self {
+        let angle = |k: usize| -2.0 * std::f64::consts::PI * k as f64 / n as f64;
+        let shift = usize::BITS - n.trailing_zeros();
+        Self {
+            n,
+            twiddle_re: (0..n / 2).map(|k| angle(k).cos()).collect(),
+            twiddle_im: (0..n / 2).map(|k| angle(k).sin()).collect(),
+            reversed: (0..n)
+                .map(|i| i.reverse_bits().checked_shr(shift).unwrap_or(0))
+                .collect(),
+        }
+    }
+
+    pub fn transform(&self, re: &mut [f64], im: &mut [f64]) {
+        for (i, &j) in self.reversed.iter().enumerate() {
+            if i < j {
+                re.swap(i, j);
+                im.swap(i, j);
+            }
+        }
+        let mut size = 2;
+        while size <= self.n {
+            let half = size / 2;
+            let step = self.n / size;
+            for start in (0..self.n).step_by(size) {
+                for k in 0..half {
+                    let (w_re, w_im) = (self.twiddle_re[k * step], self.twiddle_im[k * step]);
+                    let (a, b) = (start + k, start + k + half);
+                    let t_re = w_re * re[b] - w_im * im[b];
+                    let t_im = w_re * im[b] + w_im * re[b];
+                    re[b] = re[a] - t_re;
+                    im[b] = im[a] - t_im;
+                    re[a] += t_re;
+                    im[a] += t_im;
+                }
+            }
+            size <<= 1;
+        }
+    }
+}

rust_backend/crates/core/src/media/hires/mod.rs

@@ -0,0 +1,659 @@
+//! Hi-Res authenticity check, in lockstep with SpotiFLAC-Module-Version's
+//! `core/hires_check.py`: same thresholds, same verdicts.
+//!
+//! A file can claim Hi-Res along two independent axes, and each is checked on
+//! its own terms:
+//!
+//! - Sample rate: it declares e.g. 96 kHz but its spectral content stops at,
+//!   or just above, the ~22.05 kHz Nyquist of a 44.1 kHz source, the
+//!   fingerprint of upsampling. Measuring it is a heuristic.
+//! - Bit depth: it declares 24-bit but only 16 of those bits ever carry data,
+//!   the low 8 being zero in every sample: a CD master padded out. Unlike the
+//!   spectral test this one is exact, and it is the only test that can judge
+//!   a 24-bit/44.1 kHz file.
+//!
+//! The cutoff alone cannot tell an upsampled CD from a genuine master that
+//! was low-pass filtered in mastering, so every `fake_hires` verdict is graded
+//! ("certain", "likely", "suspect") by the evidence in `evidence`. These
+//! confidence levels describe the sampled evidence, not permission to discard
+//! audio. Replacement additionally requires a full, exact PCM comparison.
+//!
+//! Only FLAC and PCM WAV are decoded. Anything else is
+//! [`HiResCheckError::Unsupported`], which callers treat as "check skipped".
+
+mod evidence;
+mod fft;
+mod replacement;
+pub use replacement::replacement_preserves_audio;
+#[cfg(test)]
+mod tests;
+
+use evidence::*;
+use serde::{Deserialize, Serialize};
+use std::fs::File;
+use std::io::{BufReader, Read, Seek, SeekFrom};
+
+pub const VERDICT_FAKE: &str = "fake_hires";
+pub const VERDICT_STANDARD: &str = "standard_definition";
+pub const VERDICT_GENUINE: &str = "genuine_hires";
+pub const VERDICT_INCONCLUSIVE: &str = "inconclusive";
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum HiResCheckError {
+    /// A container this checker cannot decode; never a reason to treat the
+    /// file itself as broken.
+    Unsupported,
+    Failed(String),
+}
+
+impl std::fmt::Display for HiResCheckError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Unsupported => f.write_str("hi-res check: unsupported audio format"),
+            Self::Failed(message) => write!(f, "hi-res check: {message}"),
+        }
+    }
+}
+
+impl From<String> for HiResCheckError {
+    fn from(message: String) -> Self {
+        Self::Failed(message)
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(default)]
+pub struct HiResCheckOptions {
+    /// Length of the segment analysed from the middle of the track.
+    pub sample_seconds: i64,
+    /// dB relative to the segment's spectral peak above which a bin is
+    /// considered active content rather than noise.
+    pub noise_floor_db: f64,
+    /// Sample rate above which a file claims Hi-Res.
+    pub hires_sample_rate_threshold: i64,
+    /// Minimum active-content cutoff a genuine Hi-Res file must reach. Sits
+    /// well above 22.05 kHz on purpose: a resampler upsampling from CD leaves
+    /// a transition-band tail a couple of kHz wide (a measured 44.1 -> 176.4
+    /// kHz upsample reached ~24.7 kHz).
+    pub hires_cutoff_threshold_hz: f64,
+    /// STFT window size; must be a power of two. Shrunk for short segments.
+    pub n_fft: i64,
+}
+
+impl Default for HiResCheckOptions {
+    fn default() -> Self {
+        Self {
+            sample_seconds: 30,
+            noise_floor_db: -80.0,
+            hires_sample_rate_threshold: 48_000,
+            hires_cutoff_threshold_hz: 28_000.0,
+            n_fft: 4096,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Serialize)]
+pub struct HiResCheckResult {
+    pub file_path: String,
+    pub declared_sample_rate: u32,
+    pub total_duration_s: f64,
+    pub analyzed_duration_s: f64,
+    pub cutoff_frequency_hz: f64,
+    pub noise_floor_db: f64,
+    pub verdict: String,
+    /// Bits per sample the container declares; 0 when the format has no
+    /// fixed-point depth to declare (float PCM).
+    pub declared_bit_depth: u32,
+    /// Bits per sample that actually carry data; 0 when not measured.
+    pub effective_bit_depth: u32,
+    /// Why the file was flagged, in one clause; empty when it was not.
+    pub reason: String,
+    /// How sure a fake_hires verdict is: "certain" (exact fingerprint),
+    /// "likely" (a resampler's cliff over a 16-bit floor) or "suspect" (may be
+    /// a genuine low-pass filtered master). Empty for other verdicts.
+    pub confidence: String,
+    /// Exact upsampling fingerprint found, if any: "sample_hold",
+    /// "linear_interpolation" or "imaging".
+    pub upsampling_artifact: String,
+    /// Source Nyquist (22050 / 24000) with a resampler-style cliff; 0 if none.
+    pub brickwall_hz: f64,
+    /// In-band floor of the quietest frames against flat 16-bit quantization
+    /// noise: "below_16bit", "at_16bit", "masked" (music never quiet enough),
+    /// or empty when not measured.
+    pub noise_floor_class: String,
+    pub noise_floor_vs_16bit_db: f64,
+    /// Highest frequency whose level still moves with the music, for a file
+    /// claiming Hi-Res by rate; 0 when not measured. Informational: the
+    /// verdict rests on the tests above.
+    pub music_cutoff_hz: f64,
+    /// True when the active content past `music_cutoff_hz` is steady noise,
+    /// like the ultrasonic hump of a DSD or analog tape transfer, so
+    /// `cutoff_frequency_hz` marks where that noise ends rather than the music.
+    pub ultrasonic_noise_only: bool,
+    /// With `ultrasonic_noise_only`: the lowest standard rate of the same
+    /// family that holds all the music (e.g. 88200 for a 176.4 kHz file whose
+    /// music stops at 34 kHz). Otherwise the declared rate.
+    pub useful_sample_rate: u32,
+}
+
+impl HiResCheckResult {
+    /// True for any "fake hi-res" verdict, whatever its confidence.
+    pub fn is_suspicious(&self) -> bool {
+        self.verdict == VERDICT_FAKE
+    }
+
+    /// A conservative candidate filter, not proof that a replacement is safe.
+    /// Both depth and rate must fit CD quality; spectral heuristics cannot
+    /// establish that. The caller must still compare every decoded sample.
+    pub fn redownload_safe(&self) -> bool {
+        self.is_suspicious()
+            && self.confidence == CONFIDENCE_CERTAIN
+            && self.declared_bit_depth > 0
+            && self.effective_bit_depth > 0
+            && self.effective_bit_depth <= 16
+            && (self.declared_sample_rate <= 44_100
+                || (self.upsampling_artifact == ARTIFACT_SAMPLE_HOLD
+                    && self.declared_sample_rate.is_multiple_of(44_100)))
+    }
+
+    /// True when the declared depth is bits the file never uses.
+    pub fn padded_bit_depth(&self) -> bool {
+        self.declared_bit_depth > 16
+            && self.effective_bit_depth > 0
+            && self.effective_bit_depth <= 16
+    }
+}
+
+/// One decoded segment: the mono signal for the spectrum and the OR of every
+/// raw sample for the bit-depth test, gathered in one pass.
+#[derive(Default)]
+struct Window {
+    mono: Vec<f32>,
+    /// OR of all raw integer samples, right-justified at the declared depth.
+    or_bits: u32,
+    /// First channel's raw integer samples, for the upsampling-artifact
+    /// tests; empty for float PCM.
+    first_channel: Vec<i32>,
+}
+
+/// Analyses one file and returns a populated result. Only a short segment from
+/// the middle of the track is decoded, never the whole file.
+pub fn check_file(
+    mut file: File,
+    file_path: &str,
+    options: &HiResCheckOptions,
+    check: &dyn Fn() -> Result<(), String>,
+) -> Result<HiResCheckResult, HiResCheckError> {
+    if options.sample_seconds <= 0 {
+        return Err("sample_seconds must be positive".to_string().into());
+    }
+    if options.n_fft <= 0 || (options.n_fft & (options.n_fft - 1)) != 0 {
+        return Err("n_fft must be a positive power of two".to_string().into());
+    }
+    let size = file.metadata().map_err(|e| e.to_string())?.len();
+    if size == 0 {
+        return Err(format!("file is empty: {file_path}").into());
+    }
+    check()?;
+
+    let mut source = Source::open(&mut file)?;
+    let sr = source.sample_rate();
+    if sr == 0 {
+        return Err("invalid declared sample rate 0".to_string().into());
+    }
+    let total_duration = source.total_frames() as f64 / f64::from(sr);
+    if total_duration <= 0.0 {
+        return Err("file reports no duration, likely corrupt"
+            .to_string()
+            .into());
+    }
+
+    let analyzed_duration = (options.sample_seconds as f64).min(total_duration);
+    let offset = ((total_duration - analyzed_duration) / 2.0).max(0.0);
+    let start_frame = (offset * f64::from(sr)) as u64;
+    let window_frames = (analyzed_duration * f64::from(sr)) as u64;
+
+    let window = source
+        .read_window(start_frame, window_frames, check)
+        .map_err(|e| HiResCheckError::Failed(format!("could not decode audio: {e}")))?;
+    let y = &window.mono;
+    if y.is_empty() {
+        return Err("decoded audio segment is empty".to_string().into());
+    }
+
+    let mut result = HiResCheckResult {
+        file_path: file_path.to_string(),
+        declared_sample_rate: sr,
+        total_duration_s: total_duration,
+        analyzed_duration_s: analyzed_duration,
+        noise_floor_db: options.noise_floor_db,
+        verdict: VERDICT_INCONCLUSIVE.into(),
+        ..HiResCheckResult::default()
+    };
+
+    // A silent segment makes spectral analysis meaningless rather than wrong.
+    if !y.iter().any(|v| f64::from(v.abs()) > 1e-9) {
+        return Ok(result);
+    }
+
+    // Shrink n_fft for very short segments so the window does not end up
+    // measuring its own zero padding.
+    let mut n_fft = options.n_fft as usize;
+    while n_fft > 256 && n_fft > y.len() * 2 {
+        n_fft /= 2;
+    }
+
+    let stats = analyze_stft(y, n_fft, sr, check)?;
+    if !stats.avg_magnitude.iter().any(|&v| v > 0.0) {
+        return Ok(result);
+    }
+
+    // Deliberately unclamped: flooring at the noise floor itself would make
+    // every floored bin count as active at any lower threshold.
+    let spec_db = spectrum_db(&stats.avg_magnitude);
+    let cutoff = spec_db
+        .iter()
+        .rposition(|&db| db > options.noise_floor_db)
+        .map_or(0.0, |k| k as f64 * f64::from(sr) / n_fft as f64);
+    result.cutoff_frequency_hz = cutoff;
+
+    let declared_bits = source.declared_bits();
+    let mut effective_bits = 0;
+    if declared_bits > 0 && window.or_bits != 0 {
+        // Digital silence carries no bits at all; leaving it at 0 keeps it
+        // out of the padded-depth test.
+        effective_bits = declared_bits.saturating_sub(window.or_bits.trailing_zeros());
+    }
+    result.declared_bit_depth = declared_bits;
+    result.effective_bit_depth = effective_bits;
+
+    // A file can claim Hi-Res by rate, by depth, or both, and each claim is
+    // answered by the test that can actually judge it.
+    let claims_by_rate = i64::from(sr) > options.hires_sample_rate_threshold;
+    let claims_by_depth = declared_bits > 16;
+    result.useful_sample_rate = sr;
+    if claims_by_rate {
+        result.music_cutoff_hz = music_cutoff(
+            &stats.music_band_spreads,
+            &spec_db,
+            sr,
+            n_fft,
+            options.noise_floor_db,
+        );
+        if result.music_cutoff_hz > 0.0
+            && cutoff - result.music_cutoff_hz >= ULTRASONIC_NOISE_MARGIN_HZ
+        {
+            result.ultrasonic_noise_only = true;
+            result.useful_sample_rate = useful_sample_rate(sr, result.music_cutoff_hz);
+        }
+        // A resampler's cliff at 22.05/24 kHz betrays a 44.1/48 kHz chain
+        // even when a weak stopband leaves a flat plateau above it that reads
+        // as "content" to the cutoff test (ffmpeg's default resampler does).
+        result.brickwall_hz = detect_brickwall(&spec_db, sr, n_fft, options.noise_floor_db);
+    }
+    let cutoff_is_low = claims_by_rate && cutoff < options.hires_cutoff_threshold_hz;
+    let rate_is_fake = cutoff_is_low || result.brickwall_hz > 0.0;
+    let depth_is_fake = claims_by_depth && effective_bits > 0 && effective_bits <= 16;
+
+    // Exact fingerprints of a conversion. Imaging puts content back above
+    // 22 kHz, so such a file can pass the cutoff test and still be a fake.
+    let mut artifact = "";
+    if claims_by_rate {
+        artifact = detect_integer_upsampling(&window.first_channel, window.or_bits, sr);
+        if artifact.is_empty() && detect_imaging(&spec_db, sr, n_fft, options.noise_floor_db) {
+            artifact = ARTIFACT_IMAGING;
+        }
+    }
+    result.upsampling_artifact = artifact.into();
+    if rate_is_fake {
+        let (class, vs_16bit_db) =
+            classify_noise_floor(stats.quiet_floor_var, source.channel_count());
+        result.noise_floor_class = class.into();
+        result.noise_floor_vs_16bit_db = vs_16bit_db;
+    }
+
+    result.verdict = if !claims_by_rate && !claims_by_depth {
+        VERDICT_STANDARD
+    } else if rate_is_fake || depth_is_fake || !artifact.is_empty() {
+        VERDICT_FAKE
+    } else {
+        VERDICT_GENUINE
+    }
+    .into();
+
+    if result.verdict == VERDICT_FAKE {
+        result.confidence = if depth_is_fake || !artifact.is_empty() {
+            CONFIDENCE_CERTAIN
+        } else if result.brickwall_hz > 0.0 && result.noise_floor_class == FLOOR_AT_16BIT {
+            CONFIDENCE_LIKELY
+        } else {
+            CONFIDENCE_SUSPECT
+        }
+        .into();
+    }
+
+    let mut findings: Vec<String> = Vec::new();
+    match artifact {
+        ARTIFACT_SAMPLE_HOLD => {
+            findings.push("every sample is repeated (sample-and-hold upsampling)".into());
+        }
+        ARTIFACT_INTERPOLATION => {
+            findings.push("in-between samples are linearly interpolated".into());
+        }
+        ARTIFACT_IMAGING => {
+            findings.push("content above the source Nyquist mirrors the audible band".into());
+        }
+        _ => {}
+    }
+    if cutoff_is_low {
+        findings.push(format!(
+            "declares {sr} Hz but content stops at ~{cutoff:.0} Hz"
+        ));
+    } else if rate_is_fake {
+        findings.push(format!(
+            "declares {sr} Hz but the spectrum falls off a cliff at {:.0} Hz",
+            result.brickwall_hz
+        ));
+    }
+    if depth_is_fake {
+        findings.push(format!(
+            "declares {declared_bits}-bit but only {effective_bits} bits carry data"
+        ));
+    }
+    if result.confidence == CONFIDENCE_SUSPECT {
+        findings.push("may be a genuine master low-pass filtered in mastering".into());
+    }
+    result.reason = findings.join("; ");
+    Ok(result)
+}
+
+/// The containers the checker decodes, sniffed from their magic bytes rather
+/// than the extension so Android descriptor paths without a suffix work too.
+enum Source<'a> {
+    Flac(Box<claxon::FlacReader<BufReader<&'a mut File>>>),
+    Wav(WavSource<'a>),
+}
+
+impl<'a> Source<'a> {
+    fn open(file: &'a mut File) -> Result<Self, HiResCheckError> {
+        let mut head = [0u8; 12];
+        let mut read = 0;
+        while read < head.len() {
+            match file.read(&mut head[read..]) {
+                Ok(0) => break,
+                Ok(n) => read += n,
+                Err(e) => return Err(e.to_string().into()),
+            }
+        }
+        file.seek(SeekFrom::Start(0)).map_err(|e| e.to_string())?;
+        if read >= 4 && &head[..4] == b"fLaC" {
+            return claxon::FlacReader::new(BufReader::new(file))
+                .map(|reader| Source::Flac(Box::new(reader)))
+                .map_err(|e| HiResCheckError::Failed(format!("could not read audio header: {e}")));
+        }
+        if read >= 12 && &head[..4] == b"RIFF" && &head[8..12] == b"WAVE" {
+            return WavSource::open(file).map(Source::Wav);
+        }
+        Err(HiResCheckError::Unsupported)
+    }
+
+    fn sample_rate(&self) -> u32 {
+        match self {
+            Source::Flac(reader) => reader.streaminfo().sample_rate,
+            Source::Wav(wav) => wav.sample_rate,
+        }
+    }
+
+    fn total_frames(&self) -> u64 {
+        match self {
+            Source::Flac(reader) => reader.streaminfo().samples.unwrap_or(0),
+            Source::Wav(wav) => wav.data_size / wav.frame_bytes(),
+        }
+    }
+
+    /// 0 for formats without a fixed-point depth.
+    fn declared_bits(&self) -> u32 {
+        match self {
+            Source::Flac(reader) => reader.streaminfo().bits_per_sample,
+            Source::Wav(wav) if wav.is_float => 0,
+            Source::Wav(wav) => wav.container_bits,
+        }
+    }
+
+    fn channel_count(&self) -> u32 {
+        match self {
+            Source::Flac(reader) => reader.streaminfo().channels,
+            Source::Wav(wav) => wav.channels,
+        }
+    }
+
+    fn read_window(
+        &mut self,
+        start_frame: u64,
+        frames: u64,
+        check: &dyn Fn() -> Result<(), String>,
+    ) -> Result<Window, String> {
+        match self {
+            Source::Flac(reader) => read_flac_window(reader, start_frame, frames, check),
+            Source::Wav(wav) => wav.read_window(start_frame, frames, check),
+        }
+    }
+}
+
+/// Decodes [start_frame, start_frame + frames). claxon hands back samples
+/// right-justified with wasted bits already shifted back in and inter-channel
+/// decorrelation undone, so each value is the stored sample. It cannot seek,
+/// so the frames before the window are decoded and skipped.
+fn read_flac_window(
+    reader: &mut claxon::FlacReader<BufReader<&mut File>>,
+    start_frame: u64,
+    frames: u64,
+    check: &dyn Fn() -> Result<(), String>,
+) -> Result<Window, String> {
+    let bits = reader.streaminfo().bits_per_sample;
+    let scale = 1.0 / 2f64.powi(bits as i32 - 1);
+    let capacity = usize::try_from(frames).unwrap_or(0);
+    let mut out = Window {
+        mono: Vec::with_capacity(capacity),
+        first_channel: Vec::with_capacity(capacity),
+        ..Window::default()
+    };
+    let end = start_frame + frames;
+    let mut blocks = reader.blocks();
+    let mut buffer = Vec::new();
+    let mut decoded = 0u64;
+    while (out.mono.len() as u64) < frames {
+        if decoded.is_multiple_of(64) {
+            check()?;
+        }
+        decoded += 1;
+        let block = match blocks.read_next_or_eof(buffer) {
+            Ok(Some(block)) => block,
+            Ok(None) => break,
+            // A truncated tail still leaves a usable window.
+            Err(_) if !out.mono.is_empty() => break,
+            Err(e) => return Err(e.to_string()),
+        };
+        let first = block.time();
+        let n = u64::from(block.duration());
+        if first + n > start_frame {
+            let channels = block.channels();
+            let from = start_frame.saturating_sub(first);
+            let to = n.min(end - first);
+            for i in from..to {
+                let i = i as usize;
+                let mut sum = 0.0;
+                for ch in 0..channels {
+                    let v = block.channel(ch)[i];
+                    out.or_bits |= v as u32;
+                    sum += f64::from(v);
+                }
+                out.first_channel.push(block.channel(0)[i]);
+                out.mono.push((sum / f64::from(channels) * scale) as f32);
+            }
+        }
+        buffer = block.into_buffer();
+    }
+    Ok(out)
+}
+
+const WAV_FORMAT_PCM: u16 = 1;
+const WAV_FORMAT_FLOAT: u16 = 3;
+const WAV_FORMAT_EXTENSIBLE: u16 = 0xFFFE;
+
+struct WavSource<'a> {
+    file: &'a mut File,
+    sample_rate: u32,
+    channels: u32,
+    /// Bits per sample as stored.
+    container_bits: u32,
+    is_float: bool,
+    data_offset: u64,
+    data_size: u64,
+}
+
+impl<'a> WavSource<'a> {
+    fn open(file: &'a mut File) -> Result<Self, HiResCheckError> {
+        let file_size = file.metadata().map_err(|e| e.to_string())?.len();
+        file.seek(SeekFrom::Start(12)).map_err(|e| e.to_string())?;
+        let (mut sample_rate, mut channels, mut container_bits) = (0u32, 0u32, 0u32);
+        let mut format = 0u16;
+        let (mut data_offset, mut data_size) = (0u64, 0u64);
+        let mut header = [0u8; 8];
+        while data_offset == 0 {
+            if file.read_exact(&mut header).is_err() {
+                break;
+            }
+            let size = u64::from(u32::from_le_bytes([
+                header[4], header[5], header[6], header[7],
+            ]));
+            let pad = size & 1;
+            let chunk_start = file.stream_position().map_err(|e| e.to_string())?;
+            let chunk_end = chunk_start + size;
+            // Only the data chunk may use a streaming-size placeholder.
+            if &header[..4] != b"data" && chunk_end + pad > file_size {
+                return Err("truncated WAV chunk".to_string().into());
+            }
+            match &header[..4] {
+                b"fmt " => {
+                    // The format prefix is at most 40 bytes. Never allocate
+                    // from an untrusted 32-bit chunk length.
+                    let mut chunk = [0u8; 40];
+                    let prefix_len = size.min(chunk.len() as u64) as usize;
+                    if prefix_len < 16 || file.read_exact(&mut chunk[..prefix_len]).is_err() {
+                        return Err("truncated WAV fmt chunk".to_string().into());
+                    }
+                    format = u16::from_le_bytes([chunk[0], chunk[1]]);
+                    channels = u32::from(u16::from_le_bytes([chunk[2], chunk[3]]));
+                    sample_rate = u32::from_le_bytes([chunk[4], chunk[5], chunk[6], chunk[7]]);
+                    container_bits = u32::from(u16::from_le_bytes([chunk[14], chunk[15]]));
+                    if format == WAV_FORMAT_EXTENSIBLE {
+                        if prefix_len < 40 || u16::from_le_bytes([chunk[16], chunk[17]]) < 22 {
+                            return Err("truncated extensible WAV fmt chunk".to_string().into());
+                        }
+                        // SubFormat GUID's leading format tag.
+                        format = u16::from_le_bytes([chunk[24], chunk[25]]);
+                    }
+                    file.seek(SeekFrom::Start(chunk_end + pad))
+                        .map_err(|e| e.to_string())?;
+                }
+                b"data" => {
+                    data_offset = file.stream_position().map_err(|e| e.to_string())?;
+                    // Streamed WAVs often carry a placeholder data size.
+                    if size != u64::from(u32::MAX) && chunk_end > file_size {
+                        return Err("truncated WAV data chunk".to_string().into());
+                    }
+                    data_size = size.min(file_size.saturating_sub(data_offset));
+                }
+                _ => {
+                    file.seek(SeekFrom::Start(chunk_end + pad))
+                        .map_err(|e| e.to_string())?;
+                }
+            }
+        }
+
+        if data_offset == 0 || channels == 0 || sample_rate == 0 {
+            return Err("WAV has no usable fmt/data chunk".to_string().into());
+        }
+        let is_float = match (format, container_bits) {
+            (WAV_FORMAT_PCM, 8 | 16 | 24 | 32) => false,
+            (WAV_FORMAT_FLOAT, 32 | 64) => true,
+            _ => return Err(HiResCheckError::Unsupported),
+        };
+        Ok(Self {
+            file,
+            sample_rate,
+            channels,
+            container_bits,
+            is_float,
+            data_offset,
+            data_size,
+        })
+    }
+
+    fn frame_bytes(&self) -> u64 {
+        u64::from(self.channels * self.container_bits / 8)
+    }
+
+    fn read_window(
+        &mut self,
+        start_frame: u64,
+        frames: u64,
+        check: &dyn Fn() -> Result<(), String>,
+    ) -> Result<Window, String> {
+        let total = self.data_size / self.frame_bytes();
+        let frames = frames.min(total.saturating_sub(start_frame));
+        let mut out = Window::default();
+        if frames == 0 {
+            return Ok(out);
+        }
+        let frame_bytes = self.frame_bytes() as usize;
+        self.file
+            .seek(SeekFrom::Start(
+                self.data_offset + start_frame * frame_bytes as u64,
+            ))
+            .map_err(|e| e.to_string())?;
+        let capacity = usize::try_from(frames).unwrap_or(0);
+        out.mono.reserve(capacity);
+        if !self.is_float {
+            out.first_channel.reserve(capacity);
+        }
+        let bytes_per_sample = (self.container_bits / 8) as usize;
+        let scale = 1.0 / 2f64.powi(self.container_bits as i32 - 1);
+        let mut reader = BufReader::with_capacity(1 << 16, &mut *self.file);
+        let mut frame = vec![0u8; frame_bytes];
+
+        for index in 0..frames {
+            if index.is_multiple_of(65_536) {
+                check()?;
+            }
+            if reader.read_exact(&mut frame).is_err() {
+                break;
+            }
+            let mut sum = 0.0;
+            for (c, b) in frame.chunks_exact(bytes_per_sample).enumerate() {
+                if self.is_float {
+                    sum += if self.container_bits == 32 {
+                        f64::from(f32::from_le_bytes([b[0], b[1], b[2], b[3]]))
+                    } else {
+                        f64::from_le_bytes([b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7]])
+                    };
+                    continue;
+                }
+                let v: i32 = match self.container_bits {
+                    8 => i32::from(b[0]) - 128, // 8-bit WAV is unsigned
+                    16 => i32::from(i16::from_le_bytes([b[0], b[1]])),
+                    24 => i32::from_le_bytes([0, b[0], b[1], b[2]]) >> 8,
+                    _ => i32::from_le_bytes([b[0], b[1], b[2], b[3]]),
+                };
+                out.or_bits |= v as u32;
+                if c == 0 {
+                    out.first_channel.push(v);
+                }
+                sum += f64::from(v) * scale;
+            }
+            out.mono.push((sum / f64::from(self.channels)) as f32);
+        }
+        Ok(out)
+    }
+}

rust_backend/crates/core/src/media/hires/replacement.rs

@@ -0,0 +1,137 @@
+use super::{HiResCheckError, Source};
+use std::fs::File;
+use std::io::{Read, Seek, SeekFrom};
+
+/// Checks all channels and the entire duration, without a spectral heuristic
+/// or floating-point tolerance. Only padding and exact sample repetition can
+/// be removed. A different master, dither, resampling or truncated file fails
+/// closed. Memory is bounded by one decoded block from each file.
+pub fn replacement_preserves_audio(
+    mut original: File,
+    mut replacement: File,
+    check: &dyn Fn() -> Result<(), String>,
+) -> Result<bool, HiResCheckError> {
+    check()?;
+    let original = Source::open(&mut original)?;
+    let replacement = Source::open(&mut replacement)?;
+    let rate = replacement.sample_rate();
+    if rate == 0
+        || original.sample_rate() < rate
+        || !original.sample_rate().is_multiple_of(rate)
+        || original.channel_count() != replacement.channel_count()
+        || original.channel_count() == 0
+        || !(1..=32).contains(&original.declared_bits())
+        || !(1..=32).contains(&replacement.declared_bits())
+    {
+        return Ok(false);
+    }
+    let ratio = u64::from(original.sample_rate() / rate);
+    let frames = replacement.total_frames();
+    if frames == 0 || frames.checked_mul(ratio) != Some(original.total_frames()) {
+        return Ok(false);
+    }
+    let mut original = PcmStream::new(original)?;
+    let mut replacement = PcmStream::new(replacement)?;
+    for index in 0..frames {
+        if index.is_multiple_of(4096) {
+            check()?;
+        }
+        let Some(expected) = replacement.next_frame()? else {
+            return Ok(false);
+        };
+        for _ in 0..ratio {
+            if original.next_frame()? != Some(expected) {
+                return Ok(false);
+            }
+        }
+    }
+    Ok(original.next_frame()?.is_none() && replacement.next_frame()?.is_none())
+}
+
+struct PcmStream<'a> {
+    source: Source<'a>,
+    samples: Vec<i32>,
+    buffer: Vec<i32>,
+    cursor: usize,
+    frames_read: u64,
+    channels: usize,
+    shift: u32,
+}
+
+impl<'a> PcmStream<'a> {
+    fn new(mut source: Source<'a>) -> Result<Self, HiResCheckError> {
+        if let Source::Wav(wav) = &mut source {
+            if !wav.data_size.is_multiple_of(wav.frame_bytes()) {
+                return Err("partial WAV audio frame".to_string().into());
+            }
+            wav.file
+                .seek(SeekFrom::Start(wav.data_offset))
+                .map_err(|e| e.to_string())?;
+        }
+        Ok(Self {
+            channels: source.channel_count() as usize,
+            shift: 32 - source.declared_bits(),
+            source,
+            samples: Vec::new(),
+            buffer: Vec::new(),
+            cursor: 0,
+            frames_read: 0,
+        })
+    }
+
+    fn next_frame(&mut self) -> Result<Option<&[i32]>, HiResCheckError> {
+        if self.cursor == self.samples.len() {
+            self.samples.clear();
+            self.cursor = 0;
+            match &mut self.source {
+                Source::Flac(reader) => {
+                    let block = reader
+                        .blocks()
+                        .read_next_or_eof(std::mem::take(&mut self.buffer))
+                        .map_err(|e| e.to_string())?;
+                    let Some(block) = block else { return Ok(None) };
+                    if block.channels() as usize != self.channels {
+                        return Err("inconsistent FLAC channel count".to_string().into());
+                    }
+                    // Decode in stream order. Claxon's time() multiplies a
+                    // fixed-block frame number by the current block's size,
+                    // so it is inaccurate for a shorter final block.
+                    for frame in 0..block.duration() as usize {
+                        for channel in 0..self.channels {
+                            self.samples
+                                .push(block.channel(channel as u32)[frame] << self.shift);
+                        }
+                    }
+                    self.frames_read += u64::from(block.duration());
+                    self.buffer = block.into_buffer();
+                }
+                Source::Wav(wav) => {
+                    let remaining = wav.data_size / wav.frame_bytes() - self.frames_read;
+                    if remaining == 0 {
+                        return Ok(None);
+                    }
+                    let frames = remaining.min(4096).min(65_536 / self.channels as u64);
+                    let bytes_per_sample = (wav.container_bits / 8) as usize;
+                    let mut bytes = vec![0u8; (frames * wav.frame_bytes()) as usize];
+                    wav.file.read_exact(&mut bytes).map_err(|e| e.to_string())?;
+                    for sample in bytes.chunks_exact(bytes_per_sample) {
+                        let value = match bytes_per_sample {
+                            1 => i32::from(sample[0]) - 128,
+                            2 => i32::from(i16::from_le_bytes([sample[0], sample[1]])),
+                            3 => i32::from_le_bytes([0, sample[0], sample[1], sample[2]]) >> 8,
+                            _ => i32::from_le_bytes(sample.try_into().expect("32-bit PCM")),
+                        };
+                        self.samples.push(value << self.shift);
+                    }
+                    self.frames_read += frames;
+                }
+            }
+        }
+        if self.samples.is_empty() {
+            return Err("empty audio block".to_string().into());
+        }
+        let frame = &self.samples[self.cursor..self.cursor + self.channels];
+        self.cursor += self.channels;
+        Ok(Some(frame))
+    }
+}

rust_backend/crates/core/src/media/hires/tests.rs

@@ -0,0 +1,920 @@
+//! Port of SpotiFLAC-Module-Version's tests/test_hires_check.py. Signals are
+//! synthesised rather than fixtured: a "fake Hi-Res" file is exactly a
+//! band-limited 44.1 kHz signal carried at a higher rate, which a few lines
+//! build more clearly than any committed binary could describe.
+
+use super::fft::Radix2Fft;
+use super::*;
+use std::path::{Path, PathBuf};
+
+const HIRES_SR: u32 = 176_400;
+const CD_SR: u32 = 44_100;
+/// A power of two so the frequency-domain construction can use the checker's
+/// own FFT; ~3 s at 176.4 kHz.
+const HIRES_FRAMES: usize = 1 << 19;
+/// ~3 s at 44.1 kHz; x4 is HIRES_FRAMES.
+const CD_SOURCE_FRAMES: usize = HIRES_FRAMES / 4;
+
+/// SplitMix64: deterministic noise without a dependency.
+struct Rng(u64);
+
+impl Rng {
+    fn next_u64(&mut self) -> u64 {
+        self.0 = self.0.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        let mut z = self.0;
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// Uniform in [0, 1).
+    fn uniform(&mut self) -> f64 {
+        (self.next_u64() >> 11) as f64 / (1u64 << 53) as f64
+    }
+
+    /// Standard normal via Box-Muller.
+    fn normal(&mut self) -> f64 {
+        let u1 = self.uniform().max(1e-300);
+        let u2 = self.uniform();
+        (-2.0 * u1.ln()).sqrt() * (2.0 * std::f64::consts::PI * u2).cos()
+    }
+}
+
+fn full_band_noise(n: usize, seed: u64) -> Vec<f64> {
+    let mut rng = Rng(seed);
+    (0..n).map(|_| rng.normal() * 0.2).collect()
+}
+
+/// Applies `gain(freq)` to `y`'s spectrum; `y.len()` must be a power of two.
+fn shape_spectrum(y: &[f64], sample_rate: u32, gain: impl Fn(f64) -> f64) -> Vec<f64> {
+    let n = y.len();
+    let mut re = y.to_vec();
+    let mut im = vec![0.0; n];
+    let fft = Radix2Fft::new(n);
+    fft.transform(&mut re, &mut im);
+    for k in 0..=n / 2 {
+        let g = gain(k as f64 * f64::from(sample_rate) / n as f64);
+        re[k] *= g;
+        im[k] *= g;
+        if k > 0 && k < n / 2 {
+            re[n - k] = re[k];
+            im[n - k] = -im[k];
+        }
+    }
+    // Inverse FFT via conjugation.
+    im.iter_mut().for_each(|v| *v = -*v);
+    fft.transform(&mut re, &mut im);
+    re.iter().map(|v| v / n as f64).collect()
+}
+
+/// CD-bandwidth noise in a 176.4 kHz container. Everything above 22.05 kHz is
+/// zeroed, then a raised-cosine taper runs up to ~24.5 kHz: the
+/// transition-band tail a real resampler leaves behind.
+fn upsampled_from_cd() -> Vec<f64> {
+    let (cd_nyquist, taper_end) = (f64::from(CD_SR) / 2.0, 24_500.0);
+    shape_spectrum(&full_band_noise(HIRES_FRAMES, 0), HIRES_SR, |freq| {
+        if freq >= taper_end {
+            0.0
+        } else if freq >= cd_nyquist {
+            let ramp = (freq - cd_nyquist) / (taper_end - cd_nyquist);
+            0.5 * (1.0 + (std::f64::consts::PI * ramp).cos()) * 1e-3
+        } else {
+            1.0
+        }
+    })
+}
+
+/// Band-limited interpolation by an integer ratio: nothing at all above the
+/// source Nyquist.
+fn ideal_upsample(x: &[f64], ratio: usize) -> Vec<f64> {
+    let (n, m) = (x.len(), x.len() * ratio);
+    let mut re = x.to_vec();
+    let mut im = vec![0.0; n];
+    Radix2Fft::new(n).transform(&mut re, &mut im);
+    let (mut out_re, mut out_im) = (vec![0.0; m], vec![0.0; m]);
+    for k in 0..n / 2 {
+        out_re[k] = re[k];
+        out_im[k] = im[k];
+        if k > 0 {
+            out_re[m - k] = re[n - k];
+            out_im[m - k] = im[n - k];
+        }
+    }
+    out_re[n / 2] = re[n / 2] / 2.0;
+    out_re[m - n / 2] = re[n / 2] / 2.0;
+    out_im.iter_mut().for_each(|v| *v = -*v);
+    Radix2Fft::new(m).transform(&mut out_re, &mut out_im);
+    out_re.iter().map(|v| v / n as f64).collect()
+}
+
+/// Loud noise, then a half holding only `quiet_noise`: the gaps real music
+/// leaves, where a noise floor shows through.
+fn cd_source_with_quiet_half(quiet_noise: f64) -> Vec<f64> {
+    let mut rng = Rng(3);
+    (0..CD_SOURCE_FRAMES)
+        .map(|i| {
+            rng.normal()
+                * if i < CD_SOURCE_FRAMES / 2 {
+                    0.2
+                } else {
+                    quiet_noise
+                }
+        })
+        .collect()
+}
+
+/// What a CD master is: TPDF-dithered 16-bit, as floats.
+fn dither_to_16_bit(y: &[f64]) -> Vec<f64> {
+    let mut rng = Rng(4);
+    y.iter()
+        .map(|v| {
+            let dither = (rng.uniform() - rng.uniform()) / 32768.0;
+            ((v + dither) * 32768.0).round() / 32768.0
+        })
+        .collect()
+}
+
+/// Maps [-1, 1) floats to integers of the given depth.
+fn quantize(y: &[f64], bits: u32) -> Vec<i32> {
+    let full = 2f64.powi(bits as i32 - 1);
+    y.iter()
+        .map(|v| (v * full).round().clamp(-full, full - 1.0) as i32)
+        .collect()
+}
+
+/// Noise occupying exactly `used_bits`, stored right-justified at
+/// `container_bits`: a 16-bit master padded into 24 bits has its low 8 bits
+/// zero.
+fn pcm_using_bits(used_bits: u32, container_bits: u32, n: usize, seed: u64) -> Vec<i32> {
+    let mut rng = Rng(seed);
+    let span = 1i64 << used_bits;
+    (0..n)
+        .map(|_| {
+            let v = (rng.next_u64() % span as u64) as i64 - span / 2;
+            (v << (container_bits - used_bits)) as i32
+        })
+        .collect()
+}
+
+fn fade(signal: &mut [f64]) {
+    const FADE: usize = 2048;
+    let n = signal.len();
+    for i in 0..FADE {
+        let ramp = 0.5 - 0.5 * (std::f64::consts::PI * i as f64 / FADE as f64).cos();
+        signal[i] *= ramp;
+        signal[n - 1 - i] *= ramp;
+    }
+}
+
+struct TempDir(PathBuf);
+
+impl TempDir {
+    fn new(name: &str) -> Self {
+        let path = std::env::temp_dir().join(format!(
+            "spotiflac-hires-{name}-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |d| d.as_nanos())
+        ));
+        std::fs::create_dir_all(&path).expect("temp dir");
+        Self(path)
+    }
+
+    fn file(&self, name: &str) -> PathBuf {
+        self.0.join(name)
+    }
+}
+
+impl Drop for TempDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+struct BitWriter {
+    bytes: Vec<u8>,
+    bit: u32,
+}
+
+impl BitWriter {
+    fn new() -> Self {
+        Self {
+            bytes: Vec::new(),
+            bit: 0,
+        }
+    }
+
+    fn put(&mut self, value: u64, width: u32) {
+        for shift in (0..width).rev() {
+            if self.bit == 0 {
+                self.bytes.push(0);
+            }
+            let last = self.bytes.len() - 1;
+            self.bytes[last] |= (((value >> shift) & 1) as u8) << (7 - self.bit);
+            self.bit = (self.bit + 1) % 8;
+        }
+    }
+}
+
+fn crc8(data: &[u8]) -> u8 {
+    data.iter().fold(0u8, |mut crc, &byte| {
+        crc ^= byte;
+        for _ in 0..8 {
+            crc = if crc & 0x80 != 0 {
+                (crc << 1) ^ 0x07
+            } else {
+                crc << 1
+            };
+        }
+        crc
+    })
+}
+
+fn crc16(data: &[u8]) -> u16 {
+    data.iter().fold(0u16, |mut crc, &byte| {
+        crc ^= u16::from(byte) << 8;
+        for _ in 0..8 {
+            crc = if crc & 0x8000 != 0 {
+                (crc << 1) ^ 0x8005
+            } else {
+                crc << 1
+            };
+        }
+        crc
+    })
+}
+
+/// FLAC's UTF-8-like coding of the frame number.
+fn utf8_number(value: u64) -> Vec<u8> {
+    if value < 0x80 {
+        return vec![value as u8];
+    }
+    let mut continuation = Vec::new();
+    let mut rest = value;
+    let mut payload_bits = 6; // bits left for the leading byte's payload
+    while rest >= 1 << payload_bits {
+        continuation.push(0x80 | (rest & 0x3F) as u8);
+        rest >>= 6;
+        payload_bits -= 1;
+    }
+    let count = continuation.len() + 1;
+    let lead = (0xFFu16 << (8 - count)) as u8 | rest as u8;
+    std::iter::once(lead)
+        .chain(continuation.into_iter().rev())
+        .collect()
+}
+
+/// Encodes `samples` (identical on every channel) as FLAC with verbatim
+/// subframes: no compression, but every CRC valid, so any decoder reads it.
+fn write_flac(path: &Path, samples: &[i32], sample_rate: u32, bits: u32, channels: u32) {
+    const BLOCK: usize = 4096;
+    let mut out = b"fLaC".to_vec();
+    let mut info = BitWriter::new();
+    info.put(BLOCK as u64, 16);
+    info.put(BLOCK as u64, 16);
+    info.put(0, 24);
+    info.put(0, 24);
+    info.put(u64::from(sample_rate), 20);
+    info.put(u64::from(channels - 1), 3);
+    info.put(u64::from(bits - 1), 5);
+    info.put(samples.len() as u64, 36);
+    info.put(0, 64);
+    info.put(0, 64);
+    out.extend_from_slice(&[0x80, 0, 0, 34]); // last metadata block, STREAMINFO
+    out.extend_from_slice(&info.bytes);
+
+    for (number, block) in samples.chunks(BLOCK).enumerate() {
+        // Fixed blocking; 16-bit block size; sample rate from STREAMINFO;
+        // independent channels; the depth spelled out, as encoders do.
+        let depth_code = match bits {
+            8 => 0b001,
+            12 => 0b010,
+            16 => 0b100,
+            20 => 0b101,
+            _ => 0b110, // 24
+        };
+        let mut frame = vec![
+            0xFF,
+            0xF8,
+            0x70,
+            (((channels - 1) << 4) | (depth_code << 1)) as u8,
+        ];
+        frame.extend(utf8_number(number as u64));
+        frame.extend_from_slice(&((block.len() - 1) as u16).to_be_bytes());
+        frame.push(crc8(&frame));
+        let mut body = BitWriter::new();
+        for _ in 0..channels {
+            body.put(0b0000_0010, 8); // verbatim, no wasted bits
+            for &sample in block {
+                body.put(u64::from(sample as u32) & ((1u64 << bits) - 1), bits);
+            }
+        }
+        frame.extend(body.bytes);
+        let crc = crc16(&frame);
+        frame.extend_from_slice(&crc.to_be_bytes());
+        out.extend(frame);
+    }
+    std::fs::write(path, out).expect("write flac");
+}
+
+fn write_wav(path: &Path, samples: &[i32], sample_rate: u32, bits: u32) {
+    let bytes_per = (bits / 8) as usize;
+    let data: Vec<u8> = samples
+        .iter()
+        .flat_map(|v| v.to_le_bytes()[..bytes_per].to_vec())
+        .collect();
+    let mut out = Vec::new();
+    out.extend_from_slice(b"RIFF");
+    out.extend_from_slice(&(36 + data.len() as u32).to_le_bytes());
+    out.extend_from_slice(b"WAVEfmt ");
+    out.extend_from_slice(&16u32.to_le_bytes());
+    out.extend_from_slice(&1u16.to_le_bytes());
+    out.extend_from_slice(&1u16.to_le_bytes());
+    out.extend_from_slice(&sample_rate.to_le_bytes());
+    out.extend_from_slice(&(sample_rate * bytes_per as u32).to_le_bytes());
+    out.extend_from_slice(&(bytes_per as u16).to_le_bytes());
+    out.extend_from_slice(&(bits as u16).to_le_bytes());
+    out.extend_from_slice(b"data");
+    out.extend_from_slice(&(data.len() as u32).to_le_bytes());
+    out.extend(data);
+    std::fs::write(path, out).expect("write wav");
+}
+
+fn run_check(
+    path: &Path,
+    options: &HiResCheckOptions,
+) -> Result<HiResCheckResult, HiResCheckError> {
+    let file = File::open(path).expect("open fixture");
+    check_file(file, &path.to_string_lossy(), options, &|| Ok(()))
+}
+
+fn check(path: &Path) -> HiResCheckResult {
+    run_check(path, &HiResCheckOptions::default()).expect("check")
+}
+
+fn flac(dir: &TempDir, name: &str, samples: &[i32], sample_rate: u32, bits: u32) -> PathBuf {
+    let path = dir.file(name);
+    write_flac(&path, samples, sample_rate, bits, 1);
+    path
+}
+
+#[test]
+fn radix2_fft_matches_a_direct_dft() {
+    const N: usize = 64;
+    let mut rng = Rng(2);
+    let input: Vec<f64> = (0..N).map(|_| rng.uniform() - 0.5).collect();
+    let (mut re, mut im) = (input.clone(), vec![0.0; N]);
+    Radix2Fft::new(N).transform(&mut re, &mut im);
+    for k in 0..N {
+        let (mut want_re, mut want_im) = (0.0, 0.0);
+        for (j, v) in input.iter().enumerate() {
+            let angle = -2.0 * std::f64::consts::PI * (k * j) as f64 / N as f64;
+            want_re += v * angle.cos();
+            want_im += v * angle.sin();
+        }
+        assert!((re[k] - want_re).hypot(im[k] - want_im) < 1e-9, "bin {k}");
+    }
+}
+
+#[test]
+fn flac_frame_numbers_use_the_utf8_like_coding() {
+    assert_eq!(utf8_number(0x7F), vec![0x7F]);
+    assert_eq!(utf8_number(0x80), vec![0xC2, 0x80]);
+    assert_eq!(utf8_number(0x7FF), vec![0xDF, 0xBF]);
+    assert_eq!(utf8_number(0x800), vec![0xE0, 0xA0, 0x80]);
+}
+
+#[test]
+fn genuine_hires_is_not_flagged() {
+    let dir = TempDir::new("genuine");
+    let samples = quantize(&full_band_noise(HIRES_FRAMES, 0), 24);
+    let r = check(&flac(&dir, "genuine.flac", &samples, HIRES_SR, 24));
+    assert_eq!(r.verdict, VERDICT_GENUINE);
+    assert_eq!(r.upsampling_artifact, "");
+    assert_eq!(r.brickwall_hz, 0.0);
+    assert_eq!(r.confidence, "");
+}
+
+#[test]
+fn an_upsampled_cd_signal_that_is_never_quiet_is_only_suspect() {
+    let dir = TempDir::new("upsampled");
+    let samples = quantize(&upsampled_from_cd(), 24);
+    let r = check(&flac(&dir, "fake.flac", &samples, HIRES_SR, 24));
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert!(r.is_suspicious());
+    assert!(
+        r.cutoff_frequency_hz > 22_000.0 && r.cutoff_frequency_hz < 28_000.0,
+        "{}",
+        r.cutoff_frequency_hz
+    );
+    assert!(r.reason.contains("content stops"), "{}", r.reason);
+    // Loud from start to end: the floor cannot be read, so a genuine master
+    // filtered at 22 kHz would look the same. Flagged, never replaced.
+    assert_eq!(r.brickwall_hz, 22_050.0);
+    assert_eq!(r.noise_floor_class, FLOOR_MASKED);
+    assert_eq!(r.confidence, CONFIDENCE_SUSPECT);
+    assert!(!r.redownload_safe());
+}
+
+#[test]
+fn a_cd_file_claims_nothing() {
+    let dir = TempDir::new("cd");
+    let samples = quantize(&full_band_noise(CD_SR as usize * 3, 0), 16);
+    let r = check(&flac(&dir, "cd.flac", &samples, CD_SR, 16));
+    assert_eq!(r.verdict, VERDICT_STANDARD);
+    assert!(!r.is_suspicious());
+}
+
+/// 24-bit/44.1 kHz claims Hi-Res by depth alone, which no spectral test can
+/// judge: what gives a padded CD master away is its always-zero low 8 bits.
+#[test]
+fn a_padded_24_bit_cd_master_is_certain() {
+    let dir = TempDir::new("padded");
+    let samples = pcm_using_bits(16, 24, CD_SR as usize * 3, 1);
+    let r = check(&flac(&dir, "padded.flac", &samples, CD_SR, 24));
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert_eq!((r.declared_bit_depth, r.effective_bit_depth), (24, 16));
+    assert!(r.padded_bit_depth());
+    assert!(
+        r.reason.contains("24-bit") && r.reason.contains("16 bits"),
+        "{}",
+        r.reason
+    );
+    // The spectral half made no finding, so it must not appear in the reason.
+    assert!(!r.reason.contains("content stops"), "{}", r.reason);
+    assert_eq!(r.confidence, CONFIDENCE_CERTAIN);
+    assert!(r.redownload_safe());
+}
+
+#[test]
+fn a_real_24_bit_cd_rate_file_is_not_flagged() {
+    let dir = TempDir::new("real24");
+    let samples = pcm_using_bits(24, 24, CD_SR as usize * 3, 1);
+    let r = check(&flac(&dir, "real24.flac", &samples, CD_SR, 24));
+    assert_eq!(r.verdict, VERDICT_GENUINE);
+    assert_eq!((r.declared_bit_depth, r.effective_bit_depth), (24, 24));
+    assert!(!r.padded_bit_depth());
+}
+
+/// A 16-bit container declares no Hi-Res depth, so the spectral verdict is the
+/// whole answer.
+#[test]
+fn sixteen_bit_makes_no_depth_claim() {
+    let dir = TempDir::new("hires16");
+    let samples = quantize(&full_band_noise(HIRES_FRAMES, 0), 16);
+    let r = check(&flac(&dir, "hires16.flac", &samples, HIRES_SR, 16));
+    assert_eq!(r.declared_bit_depth, 16);
+    assert!(!r.padded_bit_depth());
+    assert_eq!(r.verdict, VERDICT_GENUINE);
+}
+
+#[test]
+fn silence_is_inconclusive() {
+    let dir = TempDir::new("silent");
+    let r = check(&flac(
+        &dir,
+        "silent.flac",
+        &vec![0; HIRES_FRAMES],
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(r.verdict, VERDICT_INCONCLUSIVE);
+}
+
+/// A floor below -80 dB must still measure the spectrum rather than report
+/// the full Nyquist frequency as content for every file.
+#[test]
+fn a_lower_noise_floor_still_measures() {
+    let dir = TempDir::new("floor");
+    let samples = quantize(&upsampled_from_cd(), 24);
+    let path = flac(&dir, "fake.flac", &samples, HIRES_SR, 24);
+    let options = HiResCheckOptions {
+        noise_floor_db: -90.0,
+        ..HiResCheckOptions::default()
+    };
+    let r = run_check(&path, &options).expect("check");
+    assert!(
+        r.cutoff_frequency_hz < f64::from(HIRES_SR) / 2.0,
+        "{}",
+        r.cutoff_frequency_hz
+    );
+}
+
+/// Real-world FLACs are stereo and longer than the 30 s window, which must be
+/// taken from the middle.
+#[test]
+fn a_long_stereo_flac_is_read_from_the_middle() {
+    let dir = TempDir::new("stereo");
+    let path = dir.file("stereo.flac");
+    let samples = pcm_using_bits(16, 24, CD_SR as usize * 70, 1);
+    write_flac(&path, &samples, CD_SR, 24, 2);
+    let r = check(&path);
+    assert_eq!(r.analyzed_duration_s, 30.0);
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert_eq!(r.effective_bit_depth, 16);
+}
+
+#[test]
+fn wav_is_checked_too() {
+    let dir = TempDir::new("wav");
+    let padded = dir.file("padded.wav");
+    write_wav(
+        &padded,
+        &pcm_using_bits(16, 24, CD_SR as usize * 3, 1),
+        CD_SR,
+        24,
+    );
+    let r = check(&padded);
+    assert_eq!(
+        (r.verdict.as_str(), r.effective_bit_depth),
+        (VERDICT_FAKE, 16)
+    );
+
+    let fake = dir.file("fake.wav");
+    write_wav(&fake, &quantize(&upsampled_from_cd(), 24), HIRES_SR, 24);
+    let r = check(&fake);
+    assert_eq!(
+        (r.verdict.as_str(), r.effective_bit_depth),
+        (VERDICT_FAKE, 24)
+    );
+}
+
+#[test]
+fn errors_and_unsupported_formats() {
+    let dir = TempDir::new("errors");
+    let empty = dir.file("empty.flac");
+    std::fs::write(&empty, b"").expect("write");
+    let mp3 = dir.file("song.mp3");
+    std::fs::write(&mp3, b"ID3\x04\x00\x00\x00\x00\x00\x00junk").expect("write");
+    let corrupt = dir.file("corrupt.flac");
+    std::fs::write(&corrupt, b"fLaC\x00\x00").expect("write");
+    let options = HiResCheckOptions::default();
+
+    assert!(matches!(
+        run_check(&empty, &options),
+        Err(HiResCheckError::Failed(_))
+    ));
+    assert_eq!(run_check(&mp3, &options), Err(HiResCheckError::Unsupported));
+    assert!(matches!(
+        run_check(&corrupt, &options),
+        Err(HiResCheckError::Failed(_))
+    ));
+    let bad = HiResCheckOptions {
+        n_fft: 1000,
+        ..HiResCheckOptions::default()
+    };
+    assert!(matches!(
+        run_check(&mp3, &bad),
+        Err(HiResCheckError::Failed(_))
+    ));
+}
+
+#[test]
+fn a_cancelled_check_stops() {
+    let dir = TempDir::new("cancel");
+    let samples = quantize(&full_band_noise(HIRES_FRAMES, 0), 24);
+    let path = flac(&dir, "genuine.flac", &samples, HIRES_SR, 24);
+    let file = File::open(&path).expect("open");
+    let result = check_file(file, "x", &HiResCheckOptions::default(), &|| {
+        Err("cancelled".into())
+    });
+    assert_eq!(result, Err(HiResCheckError::Failed("cancelled".into())));
+}
+
+/// A dithered 16-bit CD master upsampled cleanly: the cliff sits at 22.05 kHz
+/// and the quiet half shows 16-bit dither noise. This supports a likely
+/// verdict, but cannot prove that a separately downloaded copy is equivalent.
+#[test]
+fn an_upsampled_16_bit_master_is_likely() {
+    let dir = TempDir::new("likely");
+    let signal = ideal_upsample(&dither_to_16_bit(&cd_source_with_quiet_half(0.0)), 4);
+    let r = check(&flac(
+        &dir,
+        "cd16.flac",
+        &quantize(&signal, 24),
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert_eq!(r.brickwall_hz, 22_050.0);
+    assert_eq!(
+        r.noise_floor_class, FLOOR_AT_16BIT,
+        "{} dB",
+        r.noise_floor_vs_16bit_db
+    );
+    assert_eq!(r.confidence, CONFIDENCE_LIKELY);
+    assert!(
+        !r.redownload_safe(),
+        "Spectral evidence cannot authorize replacement"
+    );
+}
+
+/// The same cliff, but the quiet half carries detail far below 16-bit noise:
+/// a 24-bit master made at 44.1 kHz. LOSSLESS would lose that depth.
+#[test]
+fn a_24_bit_master_made_at_44k_is_only_suspect() {
+    let dir = TempDir::new("master24");
+    let signal = ideal_upsample(&cd_source_with_quiet_half(1e-6), 4);
+    let r = check(&flac(
+        &dir,
+        "master24.flac",
+        &quantize(&signal, 24),
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert_eq!(
+        r.noise_floor_class, FLOOR_BELOW_16BIT,
+        "{} dB",
+        r.noise_floor_vs_16bit_db
+    );
+    assert_eq!(r.confidence, CONFIDENCE_SUSPECT);
+    assert!(!r.redownload_safe());
+    assert!(r.reason.contains("genuine master"), "{}", r.reason);
+}
+
+/// A gradual mastering roll-off that still ends below 28 kHz: no resampler
+/// cliff, so at most a suspect. Faded in and out: an abrupt start inside the
+/// analyzed window is a step, whose broadband splatter reads as content.
+#[test]
+fn a_gradual_mastering_roll_off_is_only_suspect() {
+    let dir = TempDir::new("lpf");
+    let mut signal = shape_spectrum(&full_band_noise(HIRES_FRAMES, 0), HIRES_SR, |freq| {
+        let gain_db = if freq > 16_000.0 {
+            -10.0 * (freq - 16_000.0) / 1000.0
+        } else {
+            0.0
+        };
+        10f64.powf(gain_db / 20.0)
+    });
+    fade(&mut signal);
+    let r = check(&flac(
+        &dir,
+        "lpf.flac",
+        &quantize(&signal, 24),
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(r.verdict, VERDICT_FAKE);
+    assert_eq!(r.brickwall_hz, 0.0);
+    assert_eq!(r.confidence, CONFIDENCE_SUSPECT);
+}
+
+/// 24-bit source samples (so the depth test passes) taken to 176.4 kHz by the
+/// cheap upsamplers whose output is an exact, checkable pattern.
+#[test]
+fn integer_upsampling_artifacts_are_certain() {
+    let source = pcm_using_bits(24, 24, CD_SOURCE_FRAMES + 1, 1);
+    let (mut hold, mut line, mut zero_stuffed) = (Vec::new(), Vec::new(), Vec::new());
+    for pair in source.windows(2) {
+        let (a, b) = (f64::from(pair[0]), f64::from(pair[1]));
+        for j in 0..4 {
+            hold.push(pair[0]);
+            line.push((a + (b - a) * f64::from(j) / 4.0).round() as i32);
+            zero_stuffed.push(if j == 0 { pair[0] / 2 } else { 0 });
+        }
+    }
+    let dir = TempDir::new("artifacts");
+    for (name, samples, artifact) in [
+        ("hold", hold, ARTIFACT_SAMPLE_HOLD),
+        ("linear", line, ARTIFACT_INTERPOLATION),
+        ("zero", zero_stuffed, ARTIFACT_IMAGING),
+    ] {
+        let r = check(&flac(&dir, &format!("{name}.flac"), &samples, HIRES_SR, 24));
+        assert_eq!(r.upsampling_artifact, artifact, "{name}");
+        assert_eq!(r.verdict, VERDICT_FAKE, "{name}");
+        assert_eq!(r.confidence, CONFIDENCE_CERTAIN, "{name}");
+    }
+}
+
+/// A DSD or analog-tape transfer: music that stops around 30 kHz, and a steady
+/// ultrasonic noise hump running on to ~80 kHz. The active-content cutoff
+/// marks the end of the hump; the music bandwidth must not, and the useful
+/// rate is the 88.2 kHz that holds all the music.
+#[test]
+fn music_is_told_apart_from_ultrasonic_noise() {
+    let band = |seed, low: f64, high: f64| {
+        shape_spectrum(&full_band_noise(HIRES_FRAMES, seed), HIRES_SR, |freq| {
+            if (low..=high).contains(&freq) {
+                1.0
+            } else {
+                0.0
+            }
+        })
+    };
+    let (music, hump) = (band(5, 20.0, 30_000.0), band(6, 40_000.0, 80_000.0));
+    let mut signal: Vec<f64> = music
+        .iter()
+        .zip(&hump)
+        .enumerate()
+        .map(|(i, (m, h))| {
+            // A 3 Hz swell swings the music ~20 dB; the hump never moves.
+            let phase = 2.0 * std::f64::consts::PI * 3.0 * i as f64 / f64::from(HIRES_SR);
+            m * (0.55 + 0.45 * phase.cos()) + 0.02 * h
+        })
+        .collect();
+    fade(&mut signal);
+    let dir = TempDir::new("dsd");
+    let r = check(&flac(
+        &dir,
+        "dsd.flac",
+        &quantize(&signal, 24),
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(r.verdict, VERDICT_GENUINE);
+    assert!(
+        r.cutoff_frequency_hz > 70_000.0,
+        "{}",
+        r.cutoff_frequency_hz
+    );
+    assert!(
+        (28_000.0..=33_000.0).contains(&r.music_cutoff_hz),
+        "{}",
+        r.music_cutoff_hz
+    );
+    assert!(r.ultrasonic_noise_only);
+    assert_eq!(r.useful_sample_rate, 88_200);
+}
+
+#[test]
+fn padded_depth_does_not_make_high_rate_content_safe_to_replace_with_cd() {
+    let dir = TempDir::new("review-high-rate");
+    let samples: Vec<i32> = quantize(&full_band_noise(HIRES_FRAMES, 17), 16)
+        .into_iter()
+        .map(|sample| sample << 8)
+        .collect();
+    let result = check(&flac(&dir, "high-rate-padded.flac", &samples, HIRES_SR, 24));
+    assert_eq!(result.effective_bit_depth, 16);
+    assert!(result.cutoff_frequency_hz > 30_000.0);
+    assert!(
+        !result.redownload_safe(),
+        "Full-rate content would be lost: {result:?}"
+    );
+}
+
+#[test]
+fn rate_upsampling_does_not_make_real_24_bit_depth_safe_to_replace_with_cd() {
+    let dir = TempDir::new("review-full-depth");
+    let source = pcm_using_bits(24, 24, CD_SOURCE_FRAMES, 1);
+    let samples: Vec<i32> = source.into_iter().flat_map(|sample| [sample; 4]).collect();
+    let result = check(&flac(
+        &dir,
+        "full-depth-upsampled.flac",
+        &samples,
+        HIRES_SR,
+        24,
+    ));
+    assert_eq!(result.effective_bit_depth, 24);
+    assert_eq!(result.upsampling_artifact, ARTIFACT_SAMPLE_HOLD);
+    assert!(
+        !result.redownload_safe(),
+        "Real 24-bit depth would be lost: {result:?}"
+    );
+}
+
+fn preserves(original: &Path, replacement: &Path) -> bool {
+    replacement_preserves_audio(
+        File::open(original).expect("original"),
+        File::open(replacement).expect("replacement"),
+        &|| Ok(()),
+    )
+    .unwrap_or(false)
+}
+
+#[test]
+fn replacement_verifies_padding_and_sample_repetition_across_every_frame() {
+    let dir = TempDir::new("replacement-pcm");
+    let source = pcm_using_bits(16, 16, 20_001, 8);
+    let replacement = flac(&dir, "cd.flac", &source, CD_SR, 16);
+    for ratio in [1, 2, 4] {
+        let padded: Vec<i32> = source
+            .iter()
+            .flat_map(|v| std::iter::repeat_n(v << 8, ratio))
+            .collect();
+        let original = flac(&dir, "original.flac", &padded, CD_SR * ratio as u32, 24);
+        assert!(preserves(&original, &replacement));
+        let wav = dir.file("original.wav");
+        write_wav(&wav, &padded, CD_SR * ratio as u32, 24);
+        assert!(preserves(&wav, &replacement));
+    }
+}
+
+#[test]
+fn replacement_rejects_real_precision_outside_the_sampled_window() {
+    let dir = TempDir::new("replacement-tail");
+    let source = pcm_using_bits(16, 16, 20_001, 9);
+    let replacement = flac(&dir, "cd.flac", &source, CD_SR, 16);
+    let padded: Vec<i32> = source.iter().map(|v| v << 8).collect();
+    for index in [0, 10_000, 20_000] {
+        let mut original = padded.clone();
+        original[index] += 1;
+        let original = flac(&dir, "original.flac", &original, CD_SR, 24);
+        assert!(!preserves(&original, &replacement), "frame {index}");
+    }
+}
+
+#[test]
+fn replacement_rejects_changed_master_rate_duration_and_truncation() {
+    let dir = TempDir::new("replacement-invalid");
+    let source = pcm_using_bits(16, 16, 20_001, 10);
+    let padded: Vec<i32> = source.iter().map(|v| v << 8).collect();
+    let original = flac(&dir, "original.flac", &padded, CD_SR, 24);
+    let other = pcm_using_bits(16, 16, source.len(), 11);
+    for (samples, rate) in [
+        (&other[..], CD_SR),
+        (&source[..], 48_000),
+        (&source[..20_000], CD_SR),
+    ] {
+        let replacement = flac(&dir, "other.flac", samples, rate, 16);
+        assert!(!preserves(&original, &replacement));
+    }
+    let replacement = flac(&dir, "truncated.flac", &source, CD_SR, 16);
+    let file = std::fs::OpenOptions::new()
+        .write(true)
+        .open(&replacement)
+        .expect("open");
+    file.set_len(file.metadata().expect("stat").len() - 3)
+        .expect("truncate");
+    assert!(!preserves(&original, &replacement));
+}
+
+#[test]
+fn replacement_checks_every_channel() {
+    let dir = TempDir::new("replacement-stereo");
+    let source = pcm_using_bits(16, 16, 20_001, 12);
+    let padded: Vec<i32> = source.iter().map(|v| v << 8).collect();
+    let original = dir.file("stereo.flac");
+    write_flac(&original, &padded, CD_SR, 24, 2);
+    let stereo = dir.file("stereo.wav");
+    let interleaved: Vec<i32> = source.iter().flat_map(|&v| [v, v]).collect();
+    write_wav(&stereo, &interleaved, CD_SR, 16);
+    let mut bytes = std::fs::read(&stereo).expect("wav");
+    bytes[22..24].copy_from_slice(&2u16.to_le_bytes());
+    bytes[28..32].copy_from_slice(&(CD_SR * 4).to_le_bytes());
+    bytes[32..34].copy_from_slice(&4u16.to_le_bytes());
+    std::fs::write(&stereo, &bytes).expect("stereo header");
+    assert!(preserves(&original, &stereo));
+    // Only the last frame's right channel changes.
+    let last = bytes.len() - 2;
+    bytes[last] ^= 1;
+    std::fs::write(&stereo, &bytes).expect("different right channel");
+    assert!(!preserves(&original, &stereo));
+    let mono = flac(&dir, "mono.flac", &source, CD_SR, 16);
+    assert!(!preserves(&original, &mono));
+}
+
+#[test]
+fn replacement_comparison_is_cancellable() {
+    let dir = TempDir::new("replacement-cancel");
+    let original = flac(&dir, "original.flac", &vec![256; 20_000], CD_SR, 24);
+    let replacement = flac(&dir, "cd.flac", &vec![1; 20_000], CD_SR, 16);
+    let calls = std::cell::Cell::new(0);
+    let result = replacement_preserves_audio(
+        File::open(original).expect("original"),
+        File::open(replacement).expect("replacement"),
+        &|| {
+            calls.set(calls.get() + 1);
+            if calls.get() > 2 {
+                Err("cancelled".into())
+            } else {
+                Ok(())
+            }
+        },
+    );
+    assert!(matches!(result, Err(HiResCheckError::Failed(message)) if message == "cancelled"));
+}
+
+#[test]
+fn wav_rejects_oversized_and_truncated_chunks_without_allocating_them() {
+    let dir = TempDir::new("wav-malformed");
+    let path = dir.file("bad.wav");
+    for id in [b"fmt ", b"JUNK"] {
+        let mut bytes = b"RIFF\xff\xff\xff\xffWAVE".to_vec();
+        bytes.extend_from_slice(id);
+        bytes.extend_from_slice(&u32::MAX.to_le_bytes());
+        bytes.extend_from_slice(&[0; 40]);
+        std::fs::write(&path, bytes).expect("malformed WAV");
+        assert!(run_check(&path, &HiResCheckOptions::default()).is_err());
+    }
+    write_wav(&path, &[0; 100], CD_SR, 16);
+    let mut bytes = std::fs::read(&path).expect("wav");
+    bytes.truncate(bytes.len() - 2);
+    std::fs::write(&path, bytes).expect("truncated data");
+    assert!(run_check(&path, &HiResCheckOptions::default()).is_err());
+}
+
+#[test]
+fn wav_skips_extra_format_bytes_and_odd_chunk_padding() {
+    let dir = TempDir::new("wav-extra-fmt");
+    let path = dir.file("extended.wav");
+    write_wav(&path, &pcm_using_bits(16, 24, 20_000, 13), CD_SR, 24);
+    let mut bytes = std::fs::read(&path).expect("wav");
+    bytes[16..20].copy_from_slice(&41u32.to_le_bytes());
+    bytes.splice(36..36, [0; 26]); // 25 extra format bytes plus one pad byte
+    let len = bytes.len() as u32 - 8;
+    bytes[4..8].copy_from_slice(&len.to_le_bytes());
+    std::fs::write(&path, bytes).expect("extra fmt bytes");
+    assert!(check(&path).padded_bit_depth());
+}

rust_backend/crates/core/src/media/mod.rs

@@ -1,6 +1,7 @@
 //! Bounded, seek-based implementation of Go's FLAC/MP4 quality probe.
 
 mod audio;
+pub mod hires;
 pub(crate) mod mp4;
 
 pub(crate) use audio::{mp3_quality, ogg_quality, riff_quality};

rust_backend/crates/mobile/src/hires.rs

@@ -0,0 +1,145 @@
+use crate::cancellation::RequestLease;
+use crate::tags::{check_lease, open_audio_file};
+use spotiflac_core::media::hires::{self, HiResCheckOptions};
+use std::sync::Arc;
+
+#[derive(Debug, thiserror::Error, uniffi::Error)]
+#[uniffi(flat_error)]
+pub enum HiResCheckError {
+    #[error("{message}")]
+    Failed { message: String },
+}
+
+impl From<String> for HiResCheckError {
+    fn from(message: String) -> Self {
+        Self::Failed { message }
+    }
+}
+
+/// Runs the fake Hi-Res check on one local FLAC or WAV file; `options_json`
+/// may be empty or override any `HiResCheckOptions` field. A format the
+/// checker cannot decode is not an error: it returns `{"supported": false}`
+/// so the UI can say "not checkable" rather than report a broken file.
+/// CPU-bound for a second or two: call it off the main thread.
+/// With `verify_replacement_path`, bypasses sampled analysis and compares the
+/// entire decoded PCM stream, returning only `replacement_equivalent`.
+#[uniffi::export]
+pub fn check_hires_authenticity(
+    path: String,
+    options_json: String,
+    lease: Option<Arc<RequestLease>>,
+) -> Result<String, HiResCheckError> {
+    let check = || check_lease(lease.as_deref());
+    check()?;
+    let request: serde_json::Value = if options_json.trim().is_empty() {
+        serde_json::json!({})
+    } else {
+        serde_json::from_str(&options_json)
+            .map_err(|error| format!("invalid hi-res check options: {error}"))?
+    };
+    if let Some(replacement_path) = request.get("verify_replacement_path") {
+        let replacement_path = replacement_path
+            .as_str()
+            .filter(|path| !path.trim().is_empty())
+            .ok_or("invalid replacement path".to_string())?;
+        let equivalent = hires::replacement_preserves_audio(
+            open_audio_file(&path)?,
+            open_audio_file(replacement_path)?,
+            &check,
+        )
+        .map_err(|error| error.to_string())?;
+        return Ok(serde_json::json!({"replacement_equivalent": equivalent}).to_string());
+    }
+    let options: HiResCheckOptions = if options_json.trim().is_empty() {
+        HiResCheckOptions::default()
+    } else {
+        serde_json::from_str(&options_json)
+            .map_err(|error| format!("invalid hi-res check options: {error}"))?
+    };
+    let file = open_audio_file(&path)?;
+    let result = match hires::check_file(file, &path, &options, &check) {
+        Ok(result) => result,
+        Err(hires::HiResCheckError::Unsupported) => {
+            return Ok(serde_json::json!({"supported": false, "file_path": path}).to_string());
+        }
+        Err(error) => return Err(error.to_string().into()),
+    };
+    let mut value = serde_json::to_value(&result).map_err(|error| error.to_string())?;
+    if let Some(object) = value.as_object_mut() {
+        object.insert("supported".into(), true.into());
+        object.insert("is_suspicious".into(), result.is_suspicious().into());
+        object.insert("padded_bit_depth".into(), result.padded_bit_depth().into());
+        object.insert("redownload_safe".into(), result.redownload_safe().into());
+    }
+    Ok(value.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn replacement_verification_is_exposed_and_fails_closed() {
+        let dir =
+            std::env::temp_dir().join(format!("spotiflac-hires-verify-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).expect("dir");
+        let original = dir.join("original.wav");
+        let replacement = dir.join("replacement.wav");
+        let wav = |bits: u16, sample: i32| {
+            let bytes = u32::from(bits / 8);
+            let mut data = b"RIFF".to_vec();
+            data.extend_from_slice(&(36 + bytes).to_le_bytes());
+            data.extend_from_slice(b"WAVEfmt ");
+            data.extend_from_slice(&16u32.to_le_bytes());
+            data.extend_from_slice(&1u16.to_le_bytes());
+            data.extend_from_slice(&1u16.to_le_bytes());
+            data.extend_from_slice(&44_100u32.to_le_bytes());
+            data.extend_from_slice(&(44_100 * bytes).to_le_bytes());
+            data.extend_from_slice(&(bytes as u16).to_le_bytes());
+            data.extend_from_slice(&bits.to_le_bytes());
+            data.extend_from_slice(b"data");
+            data.extend_from_slice(&bytes.to_le_bytes());
+            data.extend_from_slice(&sample.to_le_bytes()[..bytes as usize]);
+            data
+        };
+        std::fs::write(&original, wav(24, 256)).expect("original");
+        for (sample, expected) in [(1, true), (2, false)] {
+            std::fs::write(&replacement, wav(16, sample)).expect("replacement");
+            let raw = check_hires_authenticity(
+                original.to_string_lossy().into_owned(),
+                serde_json::json!({"verify_replacement_path": replacement}).to_string(),
+                None,
+            )
+            .expect("verify");
+            let value: serde_json::Value = serde_json::from_str(&raw).expect("json");
+            assert_eq!(value["replacement_equivalent"], expected);
+            assert!(value.get("redownload_safe").is_none());
+        }
+        assert!(
+            check_hires_authenticity(
+                original.to_string_lossy().into_owned(),
+                "{\"verify_replacement_path\":123}".into(),
+                None,
+            )
+            .is_err()
+        );
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn unsupported_formats_are_not_errors_and_bad_options_are() {
+        let dir =
+            std::env::temp_dir().join(format!("spotiflac-hires-export-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).expect("dir");
+        let mp3 = dir.join("song.mp3");
+        std::fs::write(&mp3, b"ID3\x04\x00\x00\x00\x00\x00\x00junk").expect("write");
+        let path = mp3.to_string_lossy().to_string();
+
+        let raw = check_hires_authenticity(path.clone(), String::new(), None).expect("check");
+        let value: serde_json::Value = serde_json::from_str(&raw).expect("json");
+        assert_eq!(value["supported"], false);
+
+        assert!(check_hires_authenticity(path, "{bad".into(), None).is_err());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

rust_backend/crates/mobile/src/lib.rs

@@ -4,6 +4,7 @@ mod cancellation;
 mod extensions;
 mod ffmpeg;
 mod filename;
+mod hires;
 mod index;
 mod logging;
 mod lyrics;

rust_backend/crates/mobile/src/tags.rs

@@ -339,7 +339,7 @@ pub fn read_file_metadata(
     serde_json::to_string(&metadata).map_err(|error| error.to_string().into())
 }
 
-fn check_lease(lease: Option<&RequestLease>) -> Result<(), String> {
+pub(crate) fn check_lease(lease: Option<&RequestLease>) -> Result<(), String> {
     lease.map_or(Ok(()), |lease| {
         lease
             .inner
@@ -348,7 +348,7 @@ fn check_lease(lease: Option<&RequestLease>) -> Result<(), String> {
     })
 }
 
-fn open_audio_file(path: &str) -> Result<File, String> {
+pub(crate) fn open_audio_file(path: &str) -> Result<File, String> {
     let mut options = OpenOptions::new();
     options.read(true);
     #[cfg(unix)]

test/hires_replacement_test.dart

@@ -0,0 +1,136 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:spotiflac_android/models/settings.dart';
+import 'package:spotiflac_android/services/hires_check_service.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+  const channel = MethodChannel('com.zarz.spotiflac/backend');
+  late Directory directory;
+  late File original;
+  setUp(() async {
+    directory = await Directory.systemTemp.createTemp('hires-replacement-');
+    original = await File(
+      '${directory.path}/track.flac',
+    ).writeAsString('original audio');
+  });
+  tearDown(() async {
+    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+        .setMockMethodCallHandler(channel, null);
+    await directory.delete(recursive: true);
+  });
+
+  test('automatic replacement defaults off for new and existing settings', () {
+    expect(const AppSettings().redownloadFakeHiRes, isFalse);
+    expect(AppSettings.fromJson({}).redownloadFakeHiRes, isFalse);
+    final enabled = const AppSettings().copyWith(redownloadFakeHiRes: true);
+    expect(AppSettings.fromJson(enabled.toJson()).redownloadFakeHiRes, isTrue);
+  });
+
+  test(
+    'finalization exception restores original over a partial replacement',
+    () async {
+      await expectLater(
+        HiResCheckService.withOriginalBackup(original.path, (backup) async {
+          expect(await File(backup).readAsString(), 'original audio');
+          await original.writeAsString('incomplete replacement');
+          throw StateError('finalization failed');
+        }),
+        throwsStateError,
+      );
+      expect(await original.readAsString(), 'original audio');
+      expect(await directory.list().length, 1);
+    },
+  );
+
+  test('pause or cancellation restores the original', () async {
+    final success = await HiResCheckService.withOriginalBackup(original.path, (
+      backup,
+    ) async {
+      await original.writeAsString('partial');
+      return false;
+    });
+    expect(success, isFalse);
+    expect(await original.readAsString(), 'original audio');
+  });
+
+  test(
+    'backup survives until final publication and persistence complete',
+    () async {
+      final pending = Completer<bool>();
+      final started = Completer<String>();
+      final transaction = HiResCheckService.withOriginalBackup(original.path, (
+        backup,
+      ) async {
+        await original.writeAsString('verified replacement');
+        started.complete(backup);
+        return pending.future;
+      });
+      final backup = await started.future;
+      expect(await File(backup).readAsString(), 'original audio');
+      pending.complete(true);
+      expect(await transaction, isTrue);
+      expect(await original.readAsString(), 'verified replacement');
+      expect(await File(backup).exists(), isFalse);
+    },
+  );
+
+  test('existing backup is never overwritten', () async {
+    final oldBackup = await File(
+      '${original.path}.fake-hires.bak',
+    ).writeAsString('older original');
+    await HiResCheckService.withOriginalBackup(
+      original.path,
+      (_) async => false,
+    );
+    expect(await oldBackup.readAsString(), 'older original');
+    expect(await original.readAsString(), 'original audio');
+  });
+
+  test('failed restoration retains backup and reports its location', () async {
+    String? backupPath;
+    await expectLater(
+      HiResCheckService.withOriginalBackup(original.path, (backup) async {
+        backupPath = backup;
+        await Directory(original.path).create();
+        return false;
+      }),
+      throwsA(isA<HiResOriginalRestoreException>()),
+    );
+    expect(await File(backupPath!).readAsString(), 'original audio');
+  });
+
+  test(
+    'verification requires explicit full-file success from the backend',
+    () async {
+      for (final reply in [
+        {'supported': true, 'redownload_safe': true},
+        {'replacement_equivalent': false},
+        {'error': 'decode failed', 'replacement_equivalent': true},
+        {'replacement_equivalent': true},
+      ]) {
+        TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger
+            .setMockMethodCallHandler(channel, (call) async {
+              expect(call.method, 'checkHiResAuthenticity');
+              final arguments = call.arguments as Map<Object?, Object?>;
+              expect(arguments['file_path'], 'original.flac');
+              expect(jsonDecode(arguments['options_json'] as String), {
+                'verify_replacement_path': 'replacement.flac',
+              });
+              return jsonEncode(reply);
+            });
+        expect(
+          await HiResCheckService.replacementPreservesAudio(
+            'original.flac',
+            'replacement.flac',
+          ),
+          reply['replacement_equivalent'] == true && reply['error'] == null,
+        );
+      }
+    },
+  );
+}