Rebuild Inertia SSR assets after the upload and artwork UI changes.

Replace hashed SSR bundles so server-rendered pages match the current frontend.

.env.example

@@ -4,6 +4,14 @@ APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost
 
+# Maximum secondary artwork categories in addition to the primary category.
+CATEGORIES_MAX_SECONDARY=5
+
+# Artwork original downloads: PHP fallback unless nginx X-Accel is configured.
+# Leave false until the internal location exists and has been verified.
+DOWNLOAD_ACCEL_ENABLED=false
+DOWNLOAD_ACCEL_PATH=/internal/originals
+
 SECURITY_REPORT_ENABLED=true
 SECURITY_REPORT_NOTIFY_EMAIL=
 SECURITY_REPORT_SCAN_NPM=true
@@ -66,6 +74,26 @@ SKINBASE_SESSION_DEBUG_HEADER=false
 BROADCAST_CONNECTION=reverb
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=redis
+
+# Comment spam protection: observe records scores without changing visibility.
+COMMENT_SPAM_ENABLED=true
+COMMENT_SPAM_MODE=enforce
+COMMENT_SPAM_AI_ENABLED=true
+COMMENT_SPAM_AI_PROVIDER=together
+# Supported: Prism-ML/Ternary-Bonsai-27B or meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_MODEL=meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_TIMEOUT=5
+TOGETHER_API_KEY=
+TOGETHER_API_BASE_URL=https://api.together.xyz/v1
+COMMENT_SPAM_LOCAL_SAFE_MAX=29
+COMMENT_SPAM_LOCAL_SPAM_MIN=70
+COMMENT_SPAM_AI_SPAM_MIN=70
+COMMENT_SPAM_SIGNATURE_CACHE_MINUTES=1440
+COMMENT_TURNSTILE_ENABLED=false
+COMMENT_TURNSTILE_SITE_KEY=
+COMMENT_TURNSTILE_SECRET_KEY=
+COMMENT_TURNSTILE_RISK_THRESHOLD=40
+COMMENT_TURNSTILE_FAIL_OPEN=false
 # Must exceed Horizon supervisor-default timeout (960s). Production used 90s
 # and nightly RecComputeSimilar* jobs failed with MaxAttemptsExceeded.
 REDIS_QUEUE_RETRY_AFTER=1080
@@ -128,6 +156,13 @@ UPLOAD_CHUNK_REQUEST_TIMEOUT_MS=45000
 UPLOAD_RATE_CHUNK_USER=180
 UPLOAD_RATE_CHUNK_IP=360
 
+# New accounts without this many moderator/legacy published artworks go to review.
+# Queued uploads and trusted_auto publishes do not count, so a new user's 6th upload stays hidden.
+UPLOAD_MIN_APPROVED_UPLOADS=5
+UPLOAD_MIN_ACCOUNT_AGE_DAYS=7
+UPLOAD_MAX_UNTRUSTED_LEVEL=1
+UPLOAD_BOT_RISK_REVIEW_THRESHOLD=40
+
 # Draft abuse prevention controls
 SKINBASE_MAX_DRAFTS=10
 SKINBASE_MAX_DRAFT_STORAGE_MB=1024
@@ -440,6 +475,13 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 GOOGLE_REDIRECT_URI=/auth/google/callback
 
+# Google AdSense Management API (admin analytics, read-only)
+# Redirect URI must match the Google Cloud OAuth client exactly.
+ADSENSE_CLIENT_ID=
+ADSENSE_CLIENT_SECRET=
+ADSENSE_REDIRECT_URI=https://skinbase.org/admin/adsense/oauth/callback
+ADSENSE_SYNC_ENABLED=true
+
 # Optional light theme feature
 # Set LIGHT_THEME_ENABLED=true to allow a light theme in the client-side toggle.
 # Set LIGHT_THEME_SHOW_SWITCH=true to display the theme switch in the toolbar.

.gitignore

@@ -13,6 +13,7 @@
 /.deploy
 /.zed
 /auth.json
+/build-info.json
 /node_modules
 /public/build
 /public/hot
@@ -45,6 +46,7 @@
 /storage/*.tar.xz
 /storage/*.tar
 /storage/*.tgz
+/var/deploy/
 /vendor
 Homestead.json
 Homestead.yaml

app/Console/Commands/AdsenseSyncCommand.php

@@ -0,0 +1,137 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\AdsenseSyncResult;
+use App\Services\Adsense\AdsenseSyncService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+
+final class AdsenseSyncCommand extends Command
+{
+    protected $signature = 'adsense:sync
+        {--days= : Number of trailing days to synchronize, including today}
+        {--from= : Inclusive start date (YYYY-MM-DD)}
+        {--to= : Inclusive end date (YYYY-MM-DD)}
+        {--entities-only : Synchronize ad units and custom channels without reports}
+        {--force : Run even when ADSENSE_SYNC_ENABLED is false}';
+
+    protected $description = 'Synchronize Google AdSense entities and daily reporting into Skinbase';
+
+    public function handle(AdsenseSyncService $sync): int
+    {
+        if (! (bool) config('adsense.sync_enabled', true) && ! $this->option('force')) {
+            $this->warn('AdSense synchronization is disabled. Use --force to run anyway.');
+
+            return self::SUCCESS;
+        }
+
+        try {
+            [$from, $to] = $this->resolveRange();
+        } catch (\InvalidArgumentException $exception) {
+            $this->error($exception->getMessage());
+
+            return self::INVALID;
+        }
+
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->hasRefreshToken()) {
+            $this->error('Google AdSense is not connected.');
+
+            return self::FAILURE;
+        }
+
+        if ($connection->status === AdsenseConnection::STATUS_RECONNECT_REQUIRED) {
+            $this->error('AdSense authorization expired or was revoked. Reconnect Google AdSense.');
+
+            return self::FAILURE;
+        }
+
+        if ((string) $connection->account_resource_name === '') {
+            $this->error('No AdSense account is selected.');
+
+            return self::FAILURE;
+        }
+
+        $entitiesOnly = (bool) $this->option('entities-only');
+        $result = $sync->sync($connection, $from, $to, $entitiesOnly);
+
+        $this->renderResult($result, $entitiesOnly);
+
+        if ($result->reconnectRequired) {
+            $this->error('AdSense authorization expired or was revoked. Reconnect Google AdSense.');
+
+            return self::FAILURE;
+        }
+
+        if ($result->failedReports !== []) {
+            $this->warn('Synchronization completed with partial report failures: '.implode(', ', $result->failedReports));
+
+            return self::SUCCESS;
+        }
+
+        $this->info('Synchronization completed successfully.');
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @return array{0: Carbon, 1: Carbon}
+     */
+    private function resolveRange(): array
+    {
+        $days = $this->option('days');
+        $from = $this->option('from');
+        $to = $this->option('to');
+
+        if ($days !== null && ($from !== null || $to !== null)) {
+            throw new \InvalidArgumentException('The --days option cannot be combined with --from or --to.');
+        }
+
+        if (($from !== null) !== ($to !== null)) {
+            throw new \InvalidArgumentException('Both --from and --to are required for a custom range.');
+        }
+
+        if (is_string($from) && is_string($to)) {
+            $start = Carbon::parse($from)->startOfDay();
+            $end = Carbon::parse($to)->startOfDay();
+            if ($end->lt($start)) {
+                throw new \InvalidArgumentException('The --to date must be on or after --from.');
+            }
+
+            return [$start, $end];
+        }
+
+        $trailingDays = $days !== null ? max(1, (int) $days) : 3;
+        $end = now()->startOfDay();
+        $start = $end->copy()->subDays($trailingDays - 1);
+
+        return [$start, $end];
+    }
+
+    private function renderResult(AdsenseSyncResult $result, bool $entitiesOnly): void
+    {
+        $this->line('AdSense account: '.($result->accountDisplayName !== '' ? $result->accountDisplayName : 'unknown'));
+        $this->line('Range: '.$result->from.' -> '.$result->to);
+        $this->newLine();
+        $this->line('Entities:');
+        $this->line('  Ad units: '.$result->adUnits);
+        $this->line('  Custom channels: '.$result->customChannels);
+
+        if ($entitiesOnly) {
+            return;
+        }
+
+        $this->newLine();
+        $this->line('Reports:');
+        $this->line('  Total: '.$result->totalRows);
+        $this->line('  Ad units: '.$result->adUnitRows);
+        $this->line('  Custom channels: '.$result->customChannelRows);
+        $this->line('  Platform: '.$result->platformRows);
+        $this->line('  Countries: '.$result->countryRows);
+        $this->newLine();
+    }
+}

app/Console/Commands/AuditArtworkDownloadFilesCommand.php

@@ -18,6 +18,9 @@ final class AuditArtworkDownloadFilesCommand extends Command
         {--id= : Audit only this artwork ID}
         {--limit= : Stop after processing this many artworks}
         {--chunk=500 : Number of artworks to scan per batch}
+        {--status= : Only inspect records with this persisted download status}
+        {--missing-only : Only report unresolved records}
+        {--mark-status : Persist the resolved availability status (explicit write)}
         {--restore-missing : Copy missing local originals from object storage when available}';
 
     protected $description = 'Scan artworks in descending ID order and report missing local download files with full URLs.';
@@ -28,6 +31,8 @@ final class AuditArtworkDownloadFilesCommand extends Command
         $limit = $this->option('limit') !== null ? max(1, (int) $this->option('limit')) : null;
         $chunkSize = max(1, min((int) $this->option('chunk'), 2000));
         $restoreMissing = (bool) $this->option('restore-missing');
+        $markStatus = (bool) $this->option('mark-status');
+        $statusFilter = $this->option('status');
 
         $this->info(sprintf(
             'Starting download file audit. order=desc include_trashed=yes chunk=%d limit=%s restore_missing=%s',
@@ -41,10 +46,11 @@ final class AuditArtworkDownloadFilesCommand extends Command
         $unresolved = 0;
         $restored = 0;
         $restoreFailed = 0;
+        $classifications = [];
         $lastSeenId = null;
 
         do {
-            $artworks = $this->nextChunk($artworkId, $chunkSize, $lastSeenId);
+            $artworks = $this->nextChunk($artworkId, $chunkSize, $lastSeenId, is_string($statusFilter) ? $statusFilter : null);
             if ($artworks->isEmpty()) {
                 break;
             }
@@ -54,18 +60,36 @@ final class AuditArtworkDownloadFilesCommand extends Command
                     break 2;
                 }
 
-                $localPath = $locator->resolveLocalPath($artwork);
-                $missingReason = null;
-
-                if ($localPath === '') {
-                    $missingReason = 'unresolved_local_path';
+                $resolution = $locator->resolve($artwork);
+                $classification = match ($resolution['status']) {
+                    'available' => strtoupper((string) $resolution['source']).'_OK',
+                    'pending' => 'PENDING',
+                    'unknown' => 'AMBIGUOUS',
+                    default => 'MISSING_EVERYWHERE',
+                };
+                $classifications[$classification] = ($classifications[$classification] ?? 0) + 1;
+                $localPath = (string) $resolution['path'];
+                $missingReason = $resolution['status'] === 'missing' ? 'missing_everywhere' : null;
+                if ($missingReason !== null) {
                     $unresolved++;
-                } elseif (! File::isFile($localPath)) {
-                    $missingReason = 'missing_local_file';
+                }
+
+                if ($markStatus) {
+                    $this->persistStatus($artwork, $resolution);
+                }
+
+                if ($missingReason === null && (bool) $this->option('missing-only')) {
+                    $processed++;
+
+                    continue;
+                }
+
+                if ($missingReason === null) {
+                    $this->line(sprintf('Artwork %d %s source=%s', (int) $artwork->id, $classification, (string) $resolution['source']));
                 }
 
                 if ($missingReason !== null) {
-                    $objectPath = $locator->resolveObjectPath($artwork);
+                    $objectPath = (string) $resolution['object_key'];
                     $objectUrl = $locator->resolveObjectUrl($artwork);
 
                     $missing++;
@@ -88,7 +112,7 @@ final class AuditArtworkDownloadFilesCommand extends Command
                         $this->line('  local_path: '.$localPath);
                     }
 
-                    if ($restoreMissing && $missingReason === 'missing_local_file' && $localPath !== '') {
+                    if ($restoreMissing && $missingReason === 'missing_everywhere' && $localPath !== '') {
                         $restoreResult = $this->restoreLocalFile($storage, $objectPath, $localPath);
 
                         if ($restoreResult === 'restored') {
@@ -120,6 +144,9 @@ final class AuditArtworkDownloadFilesCommand extends Command
             $restored,
             $restoreFailed,
         ));
+        foreach ($classifications as $classification => $count) {
+            $this->line(sprintf('classification=%s count=%d', $classification, $count));
+        }
 
         return self::SUCCESS;
     }
@@ -127,11 +154,15 @@ final class AuditArtworkDownloadFilesCommand extends Command
     /**
      * @return Collection<int, Artwork>
      */
-    private function nextChunk(?int $artworkId, int $chunkSize, ?int $lastSeenId): Collection
+    private function nextChunk(?int $artworkId, int $chunkSize, ?int $lastSeenId, ?string $status): Collection
     {
+        if ($artworkId !== null && $lastSeenId !== null) {
+            return collect();
+        }
+
         $query = Artwork::query()
             ->withTrashed()
-            ->select(['id', 'slug', 'file_path', 'hash', 'file_ext'])
+            ->select(['id', 'slug', 'file_name', 'file_path', 'hash', 'file_ext'])
             ->orderByDesc('id');
 
         if ($artworkId !== null) {
@@ -140,9 +171,30 @@ final class AuditArtworkDownloadFilesCommand extends Command
             $query->where('id', '<', $lastSeenId);
         }
 
+        if ($status !== null && $status !== '') {
+            $query->where('download_status', $status);
+        }
+
         return $query->limit($chunkSize)->get();
     }
 
+    /** @param array{status:string,source:?string} $resolution */
+    private function persistStatus(Artwork $artwork, array $resolution): void
+    {
+        $status = match ($resolution['status']) {
+            'available' => 'available',
+            'pending' => 'pending',
+            'unknown' => 'unknown',
+            default => 'missing',
+        };
+
+        $artwork->forceFill([
+            'download_status' => $status,
+            'download_source' => $resolution['source'],
+            'download_checked_at' => now(),
+        ])->saveQuietly();
+    }
+
     private function restoreLocalFile(UploadStorageService $storage, string $objectPath, string $localPath): string
     {
         if ($objectPath === '') {

app/Console/Commands/BackfillArtworkPrimaryCategoryCommand.php

@@ -0,0 +1,139 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\Artwork;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+final class BackfillArtworkPrimaryCategoryCommand extends Command
+{
+    protected $signature = 'artworks:backfill-primary-category
+        {--dry-run : Report without writing (default unless --apply is passed)}
+        {--report : Print category-count distribution and conflicts}
+        {--apply : Write primary_category_id for artworks with exactly one category}
+        {--force : Overwrite existing primary_category_id values}';
+
+    protected $description = 'Backfill artworks.primary_category_id from unique artwork_category memberships';
+
+    public function handle(): int
+    {
+        $apply = (bool) $this->option('apply');
+        $force = (bool) $this->option('force');
+        $report = (bool) $this->option('report') || ! $apply;
+
+        if ($report) {
+            $this->printDistribution();
+        }
+
+        $conflicts = $this->conflictArtworkIds();
+        $zeros = $this->zeroCategoryArtworkIds();
+        $eligible = $this->eligibleArtworkIds($force);
+
+        $this->info('Zero-category artworks: '.$zeros->count());
+        $this->info('Single-category eligible for backfill: '.$eligible->count());
+        $this->info('Multi-category conflicts (not auto-resolved): '.$conflicts->count());
+
+        if ($conflicts->isNotEmpty()) {
+            $this->warn('Multi-category artwork IDs (first 50): '.$conflicts->take(50)->implode(', '));
+        }
+
+        if (! $apply) {
+            $this->comment('Dry run only. Re-run with --apply to write primary_category_id for single-category artworks.');
+
+            return self::SUCCESS;
+        }
+
+        $updated = 0;
+        foreach ($eligible->chunk(500) as $chunk) {
+            $rows = DB::table('artwork_category')
+                ->select('artwork_id', 'category_id')
+                ->whereIn('artwork_id', $chunk->all())
+                ->get()
+                ->groupBy('artwork_id');
+
+            foreach ($rows as $artworkId => $memberships) {
+                if ($memberships->count() !== 1) {
+                    continue;
+                }
+
+                $query = Artwork::query()->where('id', (int) $artworkId);
+                if (! $force) {
+                    $query->whereNull('primary_category_id');
+                }
+
+                $updated += $query->update([
+                    'primary_category_id' => (int) $memberships->first()->category_id,
+                ]);
+            }
+        }
+
+        $this->info("Updated {$updated} artwork(s).");
+
+        return self::SUCCESS;
+    }
+
+    private function printDistribution(): void
+    {
+        $distribution = DB::query()
+            ->fromSub(function ($query): void {
+                $query->from('artwork_category')
+                    ->select('artwork_id', DB::raw('COUNT(*) as category_count'))
+                    ->groupBy('artwork_id');
+            }, 'x')
+            ->select('category_count', DB::raw('COUNT(*) as artworks'))
+            ->groupBy('category_count')
+            ->orderBy('category_count')
+            ->get();
+
+        $this->table(['category_count', 'artworks'], $distribution->map(fn ($row): array => [
+            (int) $row->category_count,
+            (int) $row->artworks,
+        ])->all());
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function eligibleArtworkIds(bool $force)
+    {
+        $query = DB::table('artwork_category')
+            ->select('artwork_id')
+            ->groupBy('artwork_id')
+            ->havingRaw('COUNT(*) = 1');
+
+        if (! $force) {
+            $query->whereIn('artwork_id', Artwork::query()->whereNull('primary_category_id')->select('id'));
+        }
+
+        return $query->pluck('artwork_id')->map(fn ($id): int => (int) $id);
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function conflictArtworkIds()
+    {
+        return DB::table('artwork_category')
+            ->select('artwork_id')
+            ->groupBy('artwork_id')
+            ->havingRaw('COUNT(*) > 1')
+            ->orderByRaw('COUNT(*) DESC')
+            ->pluck('artwork_id')
+            ->map(fn ($id): int => (int) $id);
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function zeroCategoryArtworkIds()
+    {
+        return Artwork::query()
+            ->whereDoesntHave('categories')
+            ->pluck('id')
+            ->map(fn ($id): int => (int) $id);
+    }
+}

app/Contracts/Moderation/CommentSpamClassifier.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Contracts\Moderation;
+
+use App\Data\Moderation\CommentSpamClassification;
+
+interface CommentSpamClassifier
+{
+    public function classify(string $content): CommentSpamClassification;
+}

app/Data/Moderation/CommentSpamClassification.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Data\Moderation;
+
+final class CommentSpamClassification
+{
+    public function __construct(
+        public readonly bool $spam,
+        public readonly float $confidence,
+        public readonly string $reason,
+        public readonly string $provider,
+        public readonly string $model,
+        public readonly int $latencyMs,
+    ) {}
+}

app/Http/Controllers/Admin/AdsenseAnalyticsController.php

@@ -0,0 +1,266 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Jobs\SyncAdsenseJob;
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\AdsenseAnalyticsQueryService;
+use App\Services\Adsense\AdsenseApiClient;
+use App\Services\Adsense\AdsenseLogSanitizer;
+use App\Services\Adsense\AdsenseOAuthService;
+use App\Services\Adsense\Exceptions\AdsenseApiException;
+use App\Services\Adsense\Exceptions\AdsenseAuthorizationException;
+use App\Services\Adsense\Exceptions\AdsenseOAuthException;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class AdsenseAnalyticsController extends Controller
+{
+    public function __construct(
+        private readonly AdsenseOAuthService $oauth,
+        private readonly AdsenseApiClient $api,
+        private readonly AdsenseAnalyticsQueryService $query,
+    ) {}
+
+    public function index(Request $request): Response
+    {
+        $connection = AdsenseConnection::current();
+        $range = $this->query->resolveRange(
+            $request->query('period'),
+            $request->string('from')->toString() ?: null,
+            $request->string('to')->toString() ?: null,
+        );
+
+        $dashboard = null;
+        if ($connection !== null && $connection->isConnected() && filled($connection->account_resource_name)) {
+            $dashboard = $this->query->dashboard(
+                $connection,
+                $range['from'],
+                $range['to'],
+                $range['previous_from'],
+                $range['previous_to'],
+            );
+        }
+
+        return Inertia::render('Admin/Adsense/Index', [
+            'connection' => $this->connectionPayload($connection),
+            'configured' => $this->oauth->isConfigured(),
+            'pendingAccounts' => $request->session()->get(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, []),
+            'recommendedPlacements' => array_values((array) config('adsense.recommended_placement_names', [])),
+            'range' => [
+                'period' => $range['period'],
+                'from' => $range['from']->toDateString(),
+                'to' => $range['to']->toDateString(),
+                'previous_from' => $range['previous_from']->toDateString(),
+                'previous_to' => $range['previous_to']->toDateString(),
+            ],
+            'dashboard' => $dashboard,
+            'routes' => [
+                'index' => route('admin.adsense.index'),
+                'connect' => route('admin.adsense.connect'),
+                'account' => route('admin.adsense.account'),
+                'sync' => route('admin.adsense.sync'),
+                'disconnect' => route('admin.adsense.disconnect'),
+            ],
+        ]);
+    }
+
+    public function connect(Request $request): RedirectResponse
+    {
+        if (! $this->oauth->isConfigured()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'Google AdSense OAuth is not configured.');
+        }
+
+        try {
+            return redirect()->away($this->oauth->authorizationUrl($request, true));
+        } catch (AdsenseOAuthException $exception) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $exception->getMessage());
+        }
+    }
+
+    public function callback(Request $request): RedirectResponse
+    {
+        try {
+            $code = $this->oauth->assertValidCallback($request);
+            $tokens = $this->oauth->exchangeAuthorizationCode($code);
+            $connection = AdsenseConnection::current() ?? new AdsenseConnection;
+            $connection->status = AdsenseConnection::STATUS_PENDING;
+            $this->oauth->persistTokens($connection, $tokens, $request->user()?->id);
+
+            $accounts = $this->api->listAccounts($connection);
+        } catch (AdsenseOAuthException|AdsenseAuthorizationException|AdsenseApiException $exception) {
+            Log::warning('AdSense OAuth callback failed.', AdsenseLogSanitizer::context([
+                'message' => $exception->getMessage(),
+            ]));
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $exception->getMessage());
+        }
+
+        $normalized = collect($accounts)
+            ->map(function (array $account): ?array {
+                $name = (string) ($account['name'] ?? '');
+                if ($name === '') {
+                    return null;
+                }
+
+                return [
+                    'resource_name' => $name,
+                    'display_name' => (string) ($account['displayName'] ?? $name),
+                ];
+            })
+            ->filter()
+            ->values()
+            ->all();
+
+        if ($normalized === []) {
+            $connection->status = AdsenseConnection::STATUS_ERROR;
+            $connection->last_error = 'No Google AdSense accounts were available for this Google account.';
+            $connection->save();
+            $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $connection->last_error);
+        }
+
+        if (count($normalized) === 1) {
+            $this->assignAccount($connection, $normalized[0]['resource_name'], $normalized[0]['display_name']);
+            $this->queueAdsenseSync($connection, 30);
+            $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('success', 'Google AdSense connected. Initial synchronization has started.');
+        }
+
+        $request->session()->put(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, $normalized);
+        $connection->status = AdsenseConnection::STATUS_PENDING;
+        $connection->save();
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('warning', 'Select the Google AdSense account to use for Skinbase analytics.');
+    }
+
+    public function selectAccount(Request $request): RedirectResponse
+    {
+        $validated = $request->validate([
+            'account_resource_name' => ['required', 'string', 'max:128'],
+        ]);
+
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->hasRefreshToken()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'Connect Google AdSense before selecting an account.');
+        }
+
+        $pending = collect($request->session()->get(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, []));
+        $selected = $pending->firstWhere('resource_name', $validated['account_resource_name']);
+
+        if (! is_array($selected)) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'The selected AdSense account is not available.');
+        }
+
+        $this->assignAccount(
+            $connection,
+            (string) $selected['resource_name'],
+            (string) ($selected['display_name'] ?? $selected['resource_name']),
+        );
+        $this->queueAdsenseSync($connection, 30);
+        $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'AdSense account selected. Initial synchronization has started.');
+    }
+
+    public function sync(Request $request): RedirectResponse
+    {
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->isConnected()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $connection?->needsReconnect()
+                    ? 'AdSense authorization expired or was revoked. Reconnect Google AdSense.'
+                    : 'Google AdSense is not connected.');
+        }
+
+        $this->queueAdsenseSync($connection, 3);
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'AdSense synchronization has been queued.');
+    }
+
+    public function disconnect(): RedirectResponse
+    {
+        $connection = AdsenseConnection::current();
+        if ($connection !== null) {
+            $this->oauth->disconnect($connection);
+        }
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'Google AdSense has been disconnected. Historical statistics were kept.');
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    private function connectionPayload(?AdsenseConnection $connection): ?array
+    {
+        if ($connection === null) {
+            return null;
+        }
+
+        return [
+            'status' => $connection->status,
+            'account_resource_name' => $connection->account_resource_name,
+            'account_display_name' => $connection->account_display_name,
+            'connected_at' => optional($connection->connected_at)?->toIso8601String(),
+            'last_sync_attempt_at' => optional($connection->last_sync_attempt_at)?->toIso8601String(),
+            'last_successful_sync_at' => optional($connection->last_successful_sync_at)?->toIso8601String(),
+            'last_error' => $connection->last_error,
+            'needs_reconnect' => $connection->needsReconnect(),
+        ];
+    }
+
+    private function assignAccount(AdsenseConnection $connection, string $resourceName, string $displayName): void
+    {
+        $connection->account_resource_name = $resourceName;
+        $connection->account_display_name = $displayName;
+        $connection->status = AdsenseConnection::STATUS_CONNECTED;
+        $connection->last_error = null;
+        if ($connection->connected_at === null) {
+            $connection->connected_at = now();
+        }
+        $connection->save();
+    }
+
+    private function queueAdsenseSync(AdsenseConnection $connection, int $days): void
+    {
+        $to = now()->startOfDay();
+        $from = $to->copy()->subDays(max(1, $days) - 1);
+
+        SyncAdsenseJob::dispatch(
+            (int) $connection->id,
+            $from->toDateString(),
+            $to->toDateString(),
+        );
+    }
+}

app/Http/Controllers/Api/Admin/ArtworkModerationController.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Jobs\IndexArtworkJob;
+use App\Models\Artwork;
+use App\Services\NotificationService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+final class ArtworkModerationController extends Controller
+{
+    public function pending(): JsonResponse
+    {
+        $artworks = Artwork::query()
+            ->with([
+                'user:id,name,username,level,email',
+                'tags:id,name,slug',
+                'categories:id,name,slug',
+            ])
+            ->where('artwork_status', 'review')
+            ->where('is_approved', false)
+            ->latest('created_at')
+            ->limit(100)
+            ->get([
+                'id', 'user_id', 'title', 'description', 'hash', 'thumb_ext',
+                'artwork_status', 'moderation_note', 'created_at', 'slug',
+                'is_mature', 'maturity_status', 'visibility',
+            ])
+            ->map(fn (Artwork $artwork): array => $this->present($artwork))
+            ->values();
+
+        return response()->json(['data' => $artworks], Response::HTTP_OK);
+    }
+
+    public function approve(int $id, Request $request, NotificationService $notifications): JsonResponse
+    {
+        $artwork = Artwork::query()->with('user')->where('artwork_status', 'review')->find($id);
+        if (! $artwork) {
+            return response()->json(['message' => 'Artwork not found in review queue.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $artwork->forceFill([
+            'is_approved' => true,
+            'is_public' => $artwork->visibility !== Artwork::VISIBILITY_PRIVATE,
+            'artwork_status' => 'published',
+            'published_at' => now(),
+            'approval_source' => 'moderator',
+            'moderated_at' => now(),
+            'moderated_by' => $request->user()->id,
+            'moderation_note' => $request->input('note'),
+        ])->save();
+
+        IndexArtworkJob::dispatch((int) $artwork->id);
+
+        if ($artwork->user) {
+            $notifications->notifyArtworkApproved($artwork->user, $request->user(), $artwork);
+        }
+
+        return response()->json(['success' => true, 'id' => $artwork->id, 'status' => 'published']);
+    }
+
+    public function reject(int $id, Request $request, NotificationService $notifications): JsonResponse
+    {
+        $artwork = Artwork::query()->with('user')->where('artwork_status', 'review')->find($id);
+        if (! $artwork) {
+            return response()->json(['message' => 'Artwork not found in review queue.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $note = (string) $request->input('note', 'Rejected during upload moderation.');
+
+        $artwork->forceFill([
+            'is_approved' => false,
+            'is_public' => false,
+            'artwork_status' => 'rejected',
+            'published_at' => null,
+            'moderated_at' => now(),
+            'moderated_by' => $request->user()->id,
+            'moderation_note' => $note,
+        ])->save();
+
+        IndexArtworkJob::dispatch((int) $artwork->id);
+
+        if ($artwork->user) {
+            $notifications->notifyArtworkRejected($artwork->user, $request->user(), $artwork, $note);
+        }
+
+        return response()->json(['success' => true, 'id' => $artwork->id, 'status' => 'rejected']);
+    }
+
+    private function present(Artwork $artwork): array
+    {
+        $previewUrl = $artwork->thumbUrl('md') ?: $artwork->thumbUrl('sm');
+        $previewLgUrl = $artwork->thumbUrl('lg') ?: $previewUrl;
+
+        return [
+            'id' => (int) $artwork->id,
+            'title' => (string) ($artwork->title ?: '(untitled artwork)'),
+            'description' => (string) ($artwork->description ?? ''),
+            'type' => 'artwork',
+            'preview_url' => $previewUrl,
+            'preview_lg_url' => $previewLgUrl,
+            'tags' => $artwork->tags
+                ->map(fn ($tag): string => trim((string) ($tag->name ?: $tag->slug)))
+                ->filter()
+                ->values()
+                ->all(),
+            'categories' => $artwork->categories
+                ->map(fn ($category): string => trim((string) ($category->name ?: $category->slug)))
+                ->filter()
+                ->values()
+                ->all(),
+            'user' => $artwork->user ? [
+                'id' => (int) $artwork->user->id,
+                'name' => (string) $artwork->user->name,
+                'username' => $artwork->user->username,
+            ] : null,
+            'slug' => $artwork->slug,
+            'is_mature' => (bool) $artwork->is_mature,
+            'maturity_status' => $artwork->maturity_status,
+            'visibility' => $artwork->visibility,
+            'moderation_note' => $artwork->moderation_note,
+            'created_at' => optional($artwork->created_at)?->toISOString(),
+        ];
+    }
+}

app/Http/Controllers/Api/Admin/UploadModerationController.php

@@ -8,33 +8,51 @@ use App\Http\Controllers\Controller;
 use App\Models\Upload;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\URL;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
 
 final class UploadModerationController extends Controller
 {
     public function pending(): JsonResponse
     {
         $uploads = Upload::query()
+            ->with(['user:id,name,username', 'category:id,name,slug'])
             ->where('status', 'draft')
             ->where('moderation_status', 'pending')
             ->orderBy('created_at')
-            ->get([
-                'id',
-                'user_id',
-                'type',
-                'status',
-                'processing_state',
-                'title',
-                'preview_path',
-                'created_at',
-                'moderation_status',
-            ]);
+            ->get()
+            ->map(fn (Upload $upload): array => $this->present($upload))
+            ->values();
 
         return response()->json([
             'data' => $uploads,
         ], Response::HTTP_OK);
     }
 
+    public function preview(string $id): StreamedResponse|JsonResponse
+    {
+        $upload = Upload::query()
+            ->where('status', 'draft')
+            ->where('moderation_status', 'pending')
+            ->find($id);
+
+        if (! $upload) {
+            return response()->json(['message' => 'Upload not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $path = $this->safePreviewPath($upload);
+        if ($path === null || ! Storage::disk('local')->exists($path)) {
+            return response()->json(['message' => 'Preview not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        return Storage::disk('local')->response($path, 'preview.webp', [
+            'Content-Type' => 'image/webp',
+            'Cache-Control' => 'private, max-age=120',
+        ]);
+    }
+
     public function approve(string $id, Request $request): JsonResponse
     {
         $upload = Upload::query()->find($id);
@@ -80,4 +98,56 @@ final class UploadModerationController extends Controller
             'moderation_status' => (string) $upload->moderation_status,
         ], Response::HTTP_OK);
     }
+
+    private function present(Upload $upload): array
+    {
+        $tags = collect($upload->tags ?? [])
+            ->map(function (mixed $tag): string {
+                if (is_array($tag)) {
+                    return trim((string) ($tag['name'] ?? $tag['slug'] ?? ''));
+                }
+
+                return trim((string) $tag);
+            })
+            ->filter()
+            ->values()
+            ->all();
+
+        $hasPreview = $this->safePreviewPath($upload) !== null;
+
+        return [
+            'id' => (string) $upload->id,
+            'title' => (string) ($upload->title ?: '(untitled upload)'),
+            'description' => (string) ($upload->description ?? ''),
+            'type' => (string) ($upload->type ?? 'image'),
+            'preview_url' => $hasPreview
+                ? URL::temporarySignedRoute('api.admin.uploads.preview', now()->addMinutes(30), ['id' => $upload->id])
+                : null,
+            'preview_lg_url' => $hasPreview
+                ? URL::temporarySignedRoute('api.admin.uploads.preview', now()->addMinutes(30), ['id' => $upload->id])
+                : null,
+            'tags' => $tags,
+            'categories' => $upload->category?->name ? [(string) $upload->category->name] : [],
+            'user' => $upload->user ? [
+                'id' => (int) $upload->user->id,
+                'name' => (string) $upload->user->name,
+                'username' => $upload->user->username,
+            ] : null,
+            'nsfw' => (bool) $upload->nsfw,
+            'license' => $upload->license,
+            'created_at' => optional($upload->created_at)?->toISOString(),
+        ];
+    }
+
+    private function safePreviewPath(Upload $upload): ?string
+    {
+        $path = str_replace('\\', '/', ltrim((string) $upload->preview_path, '/'));
+        $expectedPrefix = 'tmp/drafts/'.$upload->id.'/';
+
+        if ($path === '' || str_contains($path, '..') || ! str_starts_with($path, $expectedPrefix)) {
+            return null;
+        }
+
+        return $path;
+    }
 }

app/Http/Controllers/Api/ArtworkCommentController.php

@@ -3,14 +3,17 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
-use App\Services\Activity\UserActivityService;
+use App\Models\ActivityEvent;
 use App\Models\Artwork;
 use App\Models\ArtworkComment;
 use App\Models\User;
 use App\Models\UserMention;
 use App\Notifications\ArtworkCommentedNotification;
 use App\Notifications\ArtworkMentionedNotification;
+use App\Services\Activity\UserActivityService;
+use App\Services\CommentReactionService;
 use App\Services\ContentSanitizer;
+use App\Services\Moderation\CommentSpamService;
 use App\Support\AvatarUrl;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
@@ -30,6 +33,11 @@ class ArtworkCommentController extends Controller
 {
     private const MAX_LENGTH = 10_000;
 
+    public function __construct(
+        private readonly CommentReactionService $commentReactions,
+        private readonly CommentSpamService $commentSpam,
+    ) {}
+
     // ─────────────────────────────────────────────────────────────────────────
     // List
     // ─────────────────────────────────────────────────────────────────────────
@@ -53,7 +61,9 @@ class ArtworkCommentController extends Controller
             ->paginate($perPage, ['*'], 'page', $page);
 
         $userId = $request->user()?->id;
-        $items  = $comments->getCollection()->map(fn ($c) => $this->formatComment($c, $userId, true));
+        $commentIds = $this->commentIds($comments->getCollection());
+        $reactionTotals = $this->commentReactions->forComments($commentIds, $userId);
+        $items = $comments->getCollection()->map(fn ($c) => $this->formatComment($c, $userId, true, $reactionTotals));
 
         return response()->json([
             'data' => $items,
@@ -110,35 +120,48 @@ class ArtworkCommentController extends Controller
             'content' => $raw,      // legacy column (plain text fallback)
             'raw_content' => $raw,
             'rendered_content' => $rendered,
-            'is_approved'      => true,       // auto-approve; extend with moderation as needed
+            'is_approved' => true,
         ]);
 
+        $moderation = $this->commentSpam->moderate($comment, $request->user());
+
         // Bust the comments cache for this user's 'all' feed
         Cache::forget('comments.latest.all.page1');
 
         $comment->load(['user', 'user.profile']);
+        if ($comment->is_approved) {
             $this->notifyRecipients($artwork, $comment, $request->user(), $parentId ? (int) $parentId : null);
+        }
 
         // Record activity event (fire-and-forget; never break the response)
         try {
-            \App\Models\ActivityEvent::record(
+            ActivityEvent::record(
                 actorId: $request->user()->id,
-                type:       \App\Models\ActivityEvent::TYPE_COMMENT,
-                targetType: \App\Models\ActivityEvent::TARGET_ARTWORK,
+                type: ActivityEvent::TYPE_COMMENT,
+                targetType: ActivityEvent::TARGET_ARTWORK,
                 targetId: $artwork->id,
             );
-        } catch (\Throwable) {}
+        } catch (\Throwable) {
+        }
 
         try {
+            if ($comment->is_approved) {
                 app(UserActivityService::class)->logComment(
                     (int) $request->user()->id,
                     (int) $comment->id,
                     $parentId !== null,
                     ['artwork_id' => (int) $artwork->id],
                 );
-        } catch (\Throwable) {}
+            }
+        } catch (\Throwable) {
+        }
 
-        return response()->json(['data' => $this->formatComment($comment, $request->user()->id, false)], 201);
+        $reactionTotals = $this->commentReactions->forComments([$comment->id], $request->user()->id);
+
+        return response()->json([
+            'data' => $this->formatComment($comment, $request->user()->id, false, $reactionTotals),
+            'moderation' => ['status' => $moderation['status']],
+        ], 201);
     }
 
     // ─────────────────────────────────────────────────────────────────────────
@@ -197,7 +220,7 @@ class ArtworkCommentController extends Controller
     // Helpers
     // ─────────────────────────────────────────────────────────────────────────
 
-    private function formatComment(ArtworkComment $c, ?int $currentUserId, bool $includeReplies = false): array
+    private function formatComment(ArtworkComment $c, ?int $currentUserId, bool $includeReplies = false, array $reactionTotals = []): array
     {
         $user = $c->user;
         $userId = (int) ($c->user_id ?? 0);
@@ -221,12 +244,13 @@ class ArtworkCommentController extends Controller
                 'level' => (int) ($user?->level ?? 1),
                 'rank' => (string) ($user?->rank ?? 'Newbie'),
             ],
+            'reactions' => $reactionTotals[(int) $c->id] ?? [],
         ];
 
         if ($includeReplies && $c->relationLoaded('approvedReplies')) {
-            $data['replies'] = $c->approvedReplies->map(fn ($r) => $this->formatComment($r, $currentUserId, true))->values()->toArray();
+            $data['replies'] = $c->approvedReplies->map(fn ($r) => $this->formatComment($r, $currentUserId, true, $reactionTotals))->values()->toArray();
         } elseif ($includeReplies && $c->relationLoaded('replies')) {
-            $data['replies'] = $c->replies->map(fn ($r) => $this->formatComment($r, $currentUserId, true))->values()->toArray();
+            $data['replies'] = $c->replies->map(fn ($r) => $this->formatComment($r, $currentUserId, true, $reactionTotals))->values()->toArray();
         } else {
             $data['replies'] = [];
         }
@@ -234,6 +258,24 @@ class ArtworkCommentController extends Controller
         return $data;
     }
 
+    /** @param iterable<int, ArtworkComment> $comments */
+    private function commentIds(iterable $comments): array
+    {
+        $ids = [];
+        $walk = function (iterable $items) use (&$walk, &$ids): void {
+            foreach ($items as $comment) {
+                $ids[] = (int) $comment->id;
+                if ($comment->relationLoaded('approvedReplies')) {
+                    $walk($comment->approvedReplies);
+                }
+            }
+        };
+
+        $walk($comments);
+
+        return array_values(array_unique($ids));
+    }
+
     private function renderCommentContent(ArtworkComment $comment): string
     {
         $rawContent = (string) ($comment->raw_content ?? $comment->content ?? '');

app/Http/Controllers/Api/ArtworkController.php

@@ -1,13 +1,14 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Artworks\ArtworkCreateRequest;
 use App\Http\Resources\ArtworkListResource;
 use App\Http\Resources\ArtworkResource;
-use App\Services\ArtworkService;
-use App\Services\Artworks\ArtworkDraftService;
 use App\Models\Category;
+use App\Services\Artworks\ArtworkDraftService;
+use App\Services\ArtworkService;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -29,9 +30,12 @@ class ArtworkController extends Controller
         $user = $request->user();
         $data = $request->validated();
 
-        $categoryId = isset($data['category']) && ctype_digit((string) $data['category'])
+        $categoryId = isset($data['primary_category_id']) && ctype_digit((string) $data['primary_category_id'])
+            ? (int) $data['primary_category_id']
+            : (isset($data['category']) && ctype_digit((string) $data['category'])
                 ? (int) $data['category']
-            : null;
+                : null);
+        $secondaryCategoryIds = array_values(array_map('intval', $data['secondary_category_ids'] ?? []));
 
         $result = $drafts->createDraft(
             $user,
@@ -40,6 +44,7 @@ class ArtworkController extends Controller
             $categoryId,
             (bool) ($data['is_mature'] ?? false),
             $data['group'] ?? null,
+            $secondaryCategoryIds,
         );
 
         return response()->json([

app/Http/Controllers/Api/ArtworkNavigationController.php

@@ -5,11 +5,15 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\ArtworkResource;
 use App\Models\Artwork;
+use App\Services\ArtworkNavigationService;
+use App\Services\ThumbnailPresenter;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Support\Str;
+use Illuminate\Http\Request;
 
 class ArtworkNavigationController extends Controller
 {
+    public function __construct(private readonly ArtworkNavigationService $navigation) {}
+
     /**
      * GET /api/artworks/navigation/{id}
      *
@@ -26,35 +30,11 @@ class ArtworkNavigationController extends Controller
                 'prev_id'   => null, 'next_id'   => null,
                 'prev_url'  => null, 'next_url'  => null,
                 'prev_slug' => null, 'next_slug' => null,
+                'prev_preview' => null, 'next_preview' => null,
             ]);
         }
 
-        $scope = Artwork::published()
-            ->select(['id', 'title', 'slug'])
-            ->where('user_id', $artwork->user_id);
-
-        $prev = (clone $scope)->where('id', '<', $id)->orderByDesc('id')->first();
-        $next = (clone $scope)->where('id', '>', $id)->orderBy('id')->first();
-
-        // Infinite loop: wrap around when reaching the first or last artwork
-        if (! $prev) {
-            $prev = (clone $scope)->where('id', '!=', $id)->orderByDesc('id')->first();
-        }
-        if (! $next) {
-            $next = (clone $scope)->where('id', '!=', $id)->orderBy('id')->first();
-        }
-
-        $prevSlug = $prev ? (Str::slug($prev->slug ?: $prev->title) ?: (string) $prev->id) : null;
-        $nextSlug = $next ? (Str::slug($next->slug ?: $next->title) ?: (string) $next->id) : null;
-
-        return response()->json([
-            'prev_id'   => $prev?->id,
-            'next_id'   => $next?->id,
-            'prev_url'  => $prev ? url('/art/' . $prev->id . '/' . $prevSlug) : null,
-            'next_url'  => $next ? url('/art/' . $next->id . '/' . $nextSlug) : null,
-            'prev_slug' => $prevSlug,
-            'next_slug' => $nextSlug,
-        ]);
+        return response()->json($this->navigation->navigationFor($artwork));
     }
 
     /**
@@ -62,8 +42,12 @@ class ArtworkNavigationController extends Controller
      *
      * Returns full artwork resource by numeric ID for client-side (no-reload) navigation.
      */
-    public function pageData(int $id): JsonResponse
+    public function pageData(Request $request, int $id): JsonResponse
     {
+        if ($request->boolean('prefetch')) {
+            return $this->prefetchData($id);
+        }
+
         $artwork = Artwork::with(['user.profile', 'categories.contentType', 'categories.parent.contentType', 'tags', 'stats'])
             ->published()
             ->find($id);
@@ -73,7 +57,30 @@ class ArtworkNavigationController extends Controller
         }
 
         $resource = (new ArtworkResource($artwork))->toArray(request());
+        $resource['navigation'] = $this->navigation->navigationFor($artwork);
 
         return response()->json($resource);
     }
+
+    private function prefetchData(int $id): JsonResponse
+    {
+        $artwork = Artwork::query()
+            ->published()
+            ->select(['id', 'title', 'slug', 'hash', 'file_path', 'file_name'])
+            ->find($id);
+
+        if (! $artwork) {
+            return response()->json(['error' => 'Not found'], 404);
+        }
+
+        return response()->json([
+            'id' => (int) $artwork->id,
+            'title' => (string) $artwork->title,
+            'slug' => (string) $artwork->slug,
+            'thumbs' => [
+                'md' => ThumbnailPresenter::present($artwork, 'md'),
+                'lg' => ThumbnailPresenter::present($artwork, 'lg'),
+            ],
+        ]);
+    }
 }

app/Http/Controllers/Api/DiscoveryNegativeSignalController.php

@@ -182,10 +182,9 @@ final class DiscoveryNegativeSignalController extends Controller
             return;
         }
 
-        $categoryId = DB::table('artwork_category')
-            ->where('artwork_id', $artworkId)
-            ->orderBy('category_id')
-            ->value('category_id');
+        $categoryId = DB::table('artworks')
+            ->where('id', $artworkId)
+            ->value('primary_category_id');
 
         DB::table('user_discovery_events')->insert([
             'event_id' => (string) Str::uuid(),

app/Http/Controllers/Api/FollowController.php

@@ -5,12 +5,10 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use App\Services\FollowService;
-use App\Support\AvatarUrl;
 use App\Support\UsernamePolicy;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\DB;
 
 /**
  * API endpoints for the follow system.
@@ -72,26 +70,17 @@ final class FollowController extends Controller
     {
         $target  = $this->resolveUser($username);
         $perPage = min((int) $request->query('per_page', 24), 100);
+        $page = max(1, (int) $request->query('page', 1));
 
-        $rows = DB::table('user_followers as uf')
-            ->join('users as u', 'u.id', '=', 'uf.follower_id')
-            ->leftJoin('user_profiles as up', 'up.user_id', '=', 'u.id')
-            ->where('uf.user_id', $target->id)
-            ->whereNull('u.deleted_at')
-            ->orderByDesc('uf.created_at')
-            ->select([
-                'u.id', 'u.username', 'u.name',
-                'up.avatar_hash',
-                'uf.created_at as followed_at',
-            ])
-            ->paginate($perPage)
-            ->through(fn ($row) => [
-                'id'          => $row->id,
-                'username'    => $row->username,
-                'display_name'=> $row->username ?? $row->name,
-                'avatar_url'  => AvatarUrl::forUser((int) $row->id, $row->avatar_hash, 50),
-                'profile_url' => '/@' . strtolower((string) ($row->username ?? $row->id)),
-                'followed_at' => $row->followed_at,
+        $rows = $this->followService
+            ->paginatedFollowers((int) $target->id, $perPage, $page)
+            ->through(fn (array $row) => [
+                'id'           => $row['id'],
+                'username'     => $row['username'],
+                'display_name' => $row['display_name'],
+                'avatar_url'   => $row['avatar_url'],
+                'profile_url'  => $row['profile_url'],
+                'followed_at'  => $row['followed_at'],
             ]);
 
         return response()->json($rows);
@@ -103,26 +92,17 @@ final class FollowController extends Controller
     {
         $target  = $this->resolveUser($username);
         $perPage = min((int) $request->query('per_page', 24), 100);
+        $page = max(1, (int) $request->query('page', 1));
 
-        $rows = DB::table('user_followers as uf')
-            ->join('users as u', 'u.id', '=', 'uf.user_id')
-            ->leftJoin('user_profiles as up', 'up.user_id', '=', 'u.id')
-            ->where('uf.follower_id', $target->id)
-            ->whereNull('u.deleted_at')
-            ->orderByDesc('uf.created_at')
-            ->select([
-                'u.id', 'u.username', 'u.name',
-                'up.avatar_hash',
-                'uf.created_at as followed_at',
-            ])
-            ->paginate($perPage)
-            ->through(fn ($row) => [
-                'id'          => $row->id,
-                'username'    => $row->username,
-                'display_name'=> $row->username ?? $row->name,
-                'avatar_url'  => AvatarUrl::forUser((int) $row->id, $row->avatar_hash, 50),
-                'profile_url' => '/@' . strtolower((string) ($row->username ?? $row->id)),
-                'followed_at' => $row->followed_at,
+        $rows = $this->followService
+            ->paginatedFollowing((int) $target->id, $perPage, $page)
+            ->through(fn (array $row) => [
+                'id'           => $row['id'],
+                'username'     => $row['username'],
+                'display_name' => $row['display_name'],
+                'avatar_url'   => $row['avatar_url'],
+                'profile_url'  => $row['profile_url'],
+                'followed_at'  => $row['followed_at'],
             ]);
 
         return response()->json($rows);

app/Http/Controllers/Api/ProfileApiController.php

@@ -7,9 +7,11 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Models\Artwork;
 use App\Models\User;
-use Carbon\CarbonInterface;
+use App\Services\CollectionService;
+use App\Services\Maturity\ArtworkMaturityService;
 use App\Services\ThumbnailPresenter;
 use App\Support\UsernamePolicy;
+use Carbon\CarbonInterface;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -25,6 +27,28 @@ use UnexpectedValueException;
  */
 final class ProfileApiController extends Controller
 {
+    public function __construct(private readonly CollectionService $collections) {}
+
+    /**
+     * GET /api/profile/{username}/collections
+     * Returns the profile collection cards without rendering the profile page.
+     */
+    public function collections(Request $request, string $username): JsonResponse
+    {
+        $user = $this->resolveUser($username);
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        $viewer = $request->user();
+        $isOwner = $viewer && (int) $viewer->id === (int) $user->id;
+        $profileCollections = $this->collections->getProfileCollections($user, $viewer);
+
+        return response()->json([
+            'data' => $this->collections->mapCollectionCardPayloads($profileCollections, $isOwner, $viewer),
+        ]);
+    }
+
     /**
      * GET /api/profile/{username}/artworks
      * Returns cursor-paginated artworks for the profile page tabs.
@@ -106,7 +130,7 @@ final class ProfileApiController extends Controller
             return response()->json(['error' => 'User not found'], 404);
         }
 
-        $perPage = 24;
+        $perPage = 12;
         $offset = max(0, (int) base64_decode((string) $request->input('cursor', ''), true));
 
         $favIds = DB::table($favouriteTable.' as af')
@@ -116,6 +140,10 @@ final class ProfileApiController extends Controller
             ->where('a.is_public', true)
             ->where('a.is_approved', true)
             ->whereNotNull('a.published_at')
+            ->when(app(ArtworkMaturityService::class)->viewerPreferences($request->user())['visibility'] === ArtworkMaturityService::VIEW_HIDE, function ($query): void {
+                $query->whereRaw('COALESCE(a.is_mature, 0) = 0')
+                    ->whereRaw("COALESCE(a.maturity_status, 'clear') != ?", [ArtworkMaturityService::STATUS_SUSPECTED]);
+            })
             ->orderByDesc('af.created_at')
             ->orderByDesc('af.artwork_id')
             ->offset($offset)
@@ -185,6 +213,7 @@ final class ProfileApiController extends Controller
     private function resolveUser(string $username): ?User
     {
         $normalized = UsernamePolicy::normalize($username);
+
         return User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
     }
 
@@ -230,7 +259,7 @@ final class ProfileApiController extends Controller
     private function mapArtworkCardPayload(Artwork $art): array
     {
         $present = ThumbnailPresenter::present($art, 'md');
-        $category = $art->categories->first();
+        $category = $art->resolvedPrimaryCategory();
         $contentType = $category?->contentType;
         $stats = $art->stats;
         $group = $art->group;
@@ -246,6 +275,8 @@ final class ProfileApiController extends Controller
         return [
             'id' => $art->id,
             'name' => $art->title,
+            'picture' => $art->file_name,
+            'datum' => $this->formatIsoDate($art->published_at),
             'thumb' => $present['url'],
             'thumb_srcset' => $present['srcset'] ?? $present['url'],
             'width' => $art->width,

app/Http/Controllers/Api/UploadController.php

@@ -5,52 +5,58 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Uploads\UploadCancelRequest;
+use App\Http\Requests\Uploads\UploadChunkRequest;
 use App\Http\Requests\Uploads\UploadFinishRequest;
 use App\Http\Requests\Uploads\UploadInitRequest;
-use App\Http\Requests\Uploads\UploadChunkRequest;
-use App\Http\Requests\Uploads\UploadCancelRequest;
 use App\Http\Requests\Uploads\UploadStatusRequest;
-use App\Jobs\GenerateDerivativesJob;
 use App\Jobs\AnalyzeArtworkAiAssistJob;
-use App\Jobs\IndexArtworkJob;
 use App\Jobs\AutoTagArtworkJob;
 use App\Jobs\DetectArtworkMaturityJob;
 use App\Jobs\GenerateArtworkEmbeddingJob;
+use App\Jobs\GenerateDerivativesJob;
+use App\Jobs\IndexArtworkJob;
+use App\Models\ActivityEvent;
+use App\Models\Artwork;
+use App\Models\Group;
+use App\Models\Tag;
+use App\Notifications\NewArtworkReviewNotification;
 use App\Repositories\Uploads\UploadSessionRepository;
-use App\Services\Uploads\UploadChunkService;
-use App\Services\Uploads\UploadCancelService;
-use App\Services\Uploads\UploadAuditService;
-use App\Services\Uploads\UploadPipelineService;
-use App\Services\Uploads\UploadQuotaService;
-use App\Services\Uploads\UploadQueueService;
-use App\Services\Uploads\UploadSessionStatus;
-use App\Services\Uploads\UploadStatusService;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-use Symfony\Component\HttpFoundation\Response;
-use Throwable;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Validator;
-use App\Services\Upload\Contracts\UploadDraftServiceInterface;
-use Carbon\Carbon;
-use App\Uploads\Jobs\VirusScanJob;
-use App\Uploads\Services\PublishService;
 use App\Services\Activity\UserActivityService;
 use App\Services\ArtworkAttributionService;
+use App\Services\Artworks\ArtworkCategoryService;
+use App\Services\GroupArtworkReviewService;
 use App\Services\Maturity\ArtworkMaturityService;
+use App\Services\Moderation\ArtworkUploadPolicy;
+use App\Services\Upload\Contracts\UploadDraftServiceInterface;
+use App\Services\Uploads\UploadAuditService;
+use App\Services\Uploads\UploadCancelService;
+use App\Services\Uploads\UploadChunkService;
+use App\Services\Uploads\UploadPipelineService;
+use App\Services\Uploads\UploadQueueService;
+use App\Services\Uploads\UploadQuotaService;
+use App\Services\Uploads\UploadSessionStatus;
+use App\Services\Uploads\UploadStatusService;
+use App\Services\Worlds\WorldSubmissionService;
+use App\Support\ArtworkDescriptionContentValidator;
+use App\Uploads\Exceptions\DraftQuotaException;
 use App\Uploads\Exceptions\UploadNotFoundException;
 use App\Uploads\Exceptions\UploadOwnershipException;
 use App\Uploads\Exceptions\UploadPublishValidationException;
+use App\Uploads\Jobs\VirusScanJob;
 use App\Uploads\Services\ArchiveInspectorService;
 use App\Uploads\Services\DraftQuotaService;
-use App\Uploads\Exceptions\DraftQuotaException;
-use App\Models\Artwork;
-use App\Models\Group;
-use App\Services\GroupArtworkReviewService;
-use App\Support\ArtworkDescriptionContentValidator;
-use App\Services\Worlds\WorldSubmissionService;
-use Illuminate\Validation\ValidationException;
+use App\Uploads\Services\PublishService;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use Symfony\Component\HttpFoundation\Response;
+use Throwable;
 
 final class UploadController extends Controller
 {
@@ -59,8 +65,7 @@ final class UploadController extends Controller
         UploadPipelineService $pipeline,
         UploadQuotaService $quota,
         UploadAuditService $audit
-    )
-    {
+    ) {
         $user = $request->user();
 
         try {
@@ -251,6 +256,7 @@ final class UploadController extends Controller
                 if ((bool) config('vision.upload.ai_assist.enabled', false)) {
                     AnalyzeArtworkAiAssistJob::dispatch($artworkId)->afterCommit();
                 }
+
                 return UploadSessionStatus::PROCESSED;
             });
 
@@ -305,7 +311,7 @@ final class UploadController extends Controller
                     'realpath' => $chunkFile->getRealPath(),
                 ]);
             }
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Chunk upload debug logging failed', ['error' => $e->getMessage()]);
         }
 
@@ -333,7 +339,7 @@ final class UploadController extends Controller
                 'total_bytes' => $result->totalBytes,
                 'progress' => $result->progress,
             ], Response::HTTP_OK);
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Upload chunk failed', [
                 'session_id' => (string) $request->input('session_id'),
                 'error' => $e->getMessage(),
@@ -383,7 +389,7 @@ final class UploadController extends Controller
                 'session_id' => $result['session_id'],
                 'status' => $result['status'],
             ], Response::HTTP_OK);
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Upload cancel failed', [
                 'session_id' => (string) $request->input('session_id'),
                 'error' => $e->getMessage(),
@@ -512,6 +518,7 @@ final class UploadController extends Controller
             return response()->json($response, Response::HTTP_OK);
         } catch (Throwable $e) {
             logger()->error('Upload preload failed', ['error' => $e->getMessage()]);
+
             return response()->json(['message' => 'Preload failed.'], Response::HTTP_INTERNAL_SERVER_ERROR);
         }
     }
@@ -538,6 +545,8 @@ final class UploadController extends Controller
         $validated = $request->validate([
             'title' => ['nullable', 'string', 'max:255'],
             'category_id' => ['nullable', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
             'description' => ['nullable', 'string'],
             'tags' => ['nullable', 'array'],
             'license' => ['nullable', 'string'],
@@ -547,7 +556,7 @@ final class UploadController extends Controller
         $this->ensureValidArtworkDescription($validated);
 
         $updates = [];
-        foreach (['title', 'category_id', 'description', 'tags', 'license', 'nsfw'] as $field) {
+        foreach (['title', 'category_id', 'secondary_category_ids', 'description', 'tags', 'license', 'nsfw'] as $field) {
             if (array_key_exists($field, $validated)) {
                 $updates[$field] = $validated[$field];
             }
@@ -557,7 +566,7 @@ final class UploadController extends Controller
         foreach ($updates as $field => $value) {
             $current = $upload->{$field} ?? null;
 
-            if ($field === 'tags') {
+            if ($field === 'tags' || $field === 'secondary_category_ids') {
                 $current = $current ? json_decode((string) $current, true) : null;
             }
 
@@ -575,6 +584,10 @@ final class UploadController extends Controller
             $dirty['tags'] = json_encode($dirty['tags']);
         }
 
+        if (array_key_exists('secondary_category_ids', $dirty)) {
+            $dirty['secondary_category_ids'] = json_encode($dirty['secondary_category_ids']);
+        }
+
         if (! empty($dirty)) {
             $dirty['updated_at'] = now();
             DB::table('uploads')->where('id', $id)->update($dirty);
@@ -616,7 +629,7 @@ final class UploadController extends Controller
         ], Response::HTTP_OK);
     }
 
-    public function publish(string $id, Request $request, PublishService $publishService, ArtworkAttributionService $attribution, ArtworkMaturityService $maturity, WorldSubmissionService $submissions)
+    public function publish(string $id, Request $request, PublishService $publishService, ArtworkAttributionService $attribution, ArtworkMaturityService $maturity, WorldSubmissionService $submissions, ArtworkUploadPolicy $uploadPolicy)
     {
         $user = $request->user();
 
@@ -624,6 +637,9 @@ final class UploadController extends Controller
             'title' => ['nullable', 'string', 'max:150'],
             'description' => ['nullable', 'string'],
             'category' => ['nullable', 'integer', 'exists:categories,id'],
+            'primary_category_id' => ['nullable', 'integer', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
             'tags' => ['nullable', 'array', 'max:'.(int) config('tags.max_user_tags', 30)],
             'tags.*' => ['string', 'max:64'],
             'is_mature' => ['nullable', 'boolean'],
@@ -656,14 +672,14 @@ final class UploadController extends Controller
         $publishAt = null;
         if ($mode === 'schedule' && ! empty($validated['publish_at'])) {
             try {
-                $publishAt = \Carbon\Carbon::parse($validated['publish_at'])->utc();
+                $publishAt = Carbon::parse($validated['publish_at'])->utc();
                 // Must be at least 1 minute in the future (server-side guard)
                 if ($publishAt->lte(now()->addMinute())) {
                     return response()->json([
                         'message' => 'Scheduled publish time must be at least 1 minute in the future.',
                     ], Response::HTTP_UNPROCESSABLE_ENTITY);
                 }
-            } catch (\Throwable) {
+            } catch (Throwable) {
                 return response()->json(['message' => 'Invalid publish_at datetime.'], Response::HTTP_UNPROCESSABLE_ENTITY);
             }
         }
@@ -701,17 +717,20 @@ final class UploadController extends Controller
             $artwork->uploaded_by_user_id = $artwork->uploaded_by_user_id ?: (int) $user->id;
             $artwork->primary_author_user_id = $artwork->primary_author_user_id ?: (int) $user->id;
 
-            // Sync category if provided
-            $categoryId = isset($validated['category']) ? (int) $validated['category'] : null;
-            if ($categoryId && \App\Models\Category::where('id', $categoryId)->exists()) {
-                $artwork->categories()->sync([$categoryId]);
+            $categoryId = isset($validated['primary_category_id'])
+                ? (int) $validated['primary_category_id']
+                : (isset($validated['category']) ? (int) $validated['category'] : null);
+            $secondaryCategoryIds = array_values(array_map('intval', $validated['secondary_category_ids'] ?? []));
+            if ($categoryId) {
+                app(ArtworkCategoryService::class)
+                    ->sync($artwork, $categoryId, $secondaryCategoryIds, 'user', false);
             }
 
             // Sync tags if provided
             if (! empty($validated['tags']) && is_array($validated['tags'])) {
                 $tagIds = [];
                 foreach ($validated['tags'] as $tagSlug) {
-                    $tag = \App\Models\Tag::firstOrCreate(
+                    $tag = Tag::firstOrCreate(
                         ['slug' => Str::slug($tagSlug)],
                         ['name' => $tagSlug, 'is_active' => true, 'usage_count' => 0]
                     );
@@ -747,10 +766,47 @@ final class UploadController extends Controller
                 ], Response::HTTP_OK);
             }
 
-            // Publish immediately
+            // New and suspicious accounts are quarantined. Never let the client
+            // decide that an artwork is approved.
+            $policy = $uploadPolicy->assess($user, $artwork);
+            if ($policy['requires_review']) {
+                $artwork->visibility = $visibility;
+                $artwork->is_public = false;
+                $artwork->is_approved = false;
+                $artwork->approval_source = null;
+                $artwork->artwork_status = 'review';
+                $artwork->published_at = null;
+                $artwork->publish_at = null;
+                $artwork->moderated_at = null;
+                $artwork->moderated_by = null;
+                $artwork->moderation_note = implode(', ', $policy['reasons']);
+                $artwork->save();
+
+                $notifyEmail = trim((string) config('uploads.moderation.notify_email', ''));
+                if ($notifyEmail !== '') {
+                    try {
+                        Notification::route('mail', $notifyEmail)->notify(
+                            new NewArtworkReviewNotification($artwork, $user, $policy['reasons'])
+                        );
+                    } catch (Throwable) {
+                        // Email failure must not expose the artwork.
+                    }
+                }
+
+                return response()->json([
+                    'success' => true,
+                    'artwork_id' => (int) $artwork->id,
+                    'status' => 'submitted_for_review',
+                    'message' => 'Upload received and queued for moderation.',
+                    'review_reasons' => $policy['reasons'],
+                ], Response::HTTP_OK);
+            }
+
+            // Publish immediately for trusted users only.
             $artwork->visibility = $visibility;
             $artwork->is_public = ($visibility !== 'private');
             $artwork->is_approved = true;
+            $artwork->approval_source = 'trusted_auto';
             $artwork->published_at = now();
             $artwork->artwork_status = 'published';
             $artwork->publish_at = null;
@@ -760,17 +816,19 @@ final class UploadController extends Controller
 
             // Record upload activity event
             try {
-                \App\Models\ActivityEvent::record(
+                ActivityEvent::record(
                     actorId: (int) $user->id,
-                    type:       \App\Models\ActivityEvent::TYPE_UPLOAD,
-                    targetType: \App\Models\ActivityEvent::TARGET_ARTWORK,
+                    type: ActivityEvent::TYPE_UPLOAD,
+                    targetType: ActivityEvent::TARGET_ARTWORK,
                     targetId: (int) $artwork->id,
                 );
-            } catch (\Throwable) {}
+            } catch (Throwable) {
+            }
 
             try {
                 app(UserActivityService::class)->logUpload((int) $user->id, (int) $artwork->id);
-            } catch (\Throwable) {}
+            } catch (Throwable) {
+            }
 
             return response()->json([
                 'success' => true,
@@ -808,6 +866,9 @@ final class UploadController extends Controller
             'title' => ['nullable', 'string', 'max:150'],
             'description' => ['nullable', 'string'],
             'category' => ['nullable', 'integer', 'exists:categories,id'],
+            'primary_category_id' => ['nullable', 'integer', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
             'tags' => ['nullable', 'array', 'max:'.(int) config('tags.max_user_tags', 30)],
             'tags.*' => ['string', 'max:64'],
             'is_mature' => ['nullable', 'boolean'],

app/Http/Controllers/ArtworkDownloadController.php

@@ -8,11 +8,13 @@ use App\Models\Artwork;
 use App\Models\ArtworkDownload;
 use App\Services\ArtworkOriginalFileLocator;
 use App\Services\ArtworkStatsService;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 
@@ -43,29 +45,76 @@ final class ArtworkDownloadController extends Controller
         private readonly ArtworkOriginalFileLocator $originalFiles,
     ) {}
 
-    public function __invoke(Request $request, int $id): BinaryFileResponse|Response
+    public function __invoke(Request $request, int $id): BinaryFileResponse|RedirectResponse|Response
     {
         $artwork = Artwork::query()->find($id);
 
         if (! $artwork) {
-            abort(404);
+            return $this->notFound();
         }
 
-        $filePath = $this->originalFiles->resolveLocalPath($artwork);
-        $ext = strtolower(ltrim((string) pathinfo($filePath, PATHINFO_EXTENSION), '.'));
+        $resolution = $this->originalFiles->resolve($artwork);
+        $filePath = (string) $resolution['path'];
+        $objectKey = (string) $resolution['object_key'];
+        $ext = strtolower((string) ($resolution['file_ext'] ?: pathinfo($filePath !== '' ? $filePath : $objectKey, PATHINFO_EXTENSION)));
 
-        if ($filePath === '' || ! in_array($ext, self::ALLOWED_EXTENSIONS, true)) {
-            abort(404);
+        if (($filePath === '' && $objectKey === '') || ! in_array($ext, self::ALLOWED_EXTENSIONS, true)) {
+            return $this->notFound();
         }
 
-        if (! File::isFile($filePath)) {
+        if (! $resolution['exists']) {
             Log::warning('Artwork original file missing for download.', [
                 'artwork_id' => $artwork->id,
                 'ext' => $ext,
-                'resolved_path' => $filePath,
+                'download_status' => $artwork->download_status,
+                'canonical_local_exists' => $filePath !== '' && File::isFile($filePath),
+                'object_exists' => false,
+                'resolution_status' => $resolution['status'],
             ]);
 
-            abort(404);
+            return $this->notFound();
+        }
+
+        $downloadName = $this->buildDownloadFilename((string) $artwork->file_name, $ext);
+        $temporaryUrl = null;
+
+        if ($resolution['source'] === 'object') {
+            try {
+                $temporaryUrl = Storage::disk((string) $resolution['disk'])->temporaryUrl(
+                    $objectKey,
+                    now()->addMinutes(5),
+                    [
+                        'ResponseContentDisposition' => 'attachment; filename="'.addslashes($downloadName).'"',
+                    ],
+                );
+            } catch (\Throwable $exception) {
+                Log::warning('Artwork object temporary URL generation failed.', [
+                    'artwork_id' => $artwork->id,
+                    'disk' => $resolution['disk'],
+                    'object_key' => $objectKey,
+                    'object_exists' => true,
+                    'object_size' => $resolution['size'],
+                    'exception_class' => $exception::class,
+                    'exception_message' => mb_substr($exception->getMessage(), 0, 300),
+                ]);
+
+                return $this->notFound();
+            }
+
+            if (! is_string($temporaryUrl) || trim($temporaryUrl) === '') {
+                Log::warning('Artwork object temporary URL generation failed.', [
+                    'artwork_id' => $artwork->id,
+                    'disk' => $resolution['disk'],
+                    'object_key' => $objectKey,
+                    'resolution_status' => $resolution['status'],
+                    'object_exists' => true,
+                    'object_size' => $resolution['size'],
+                    'exception_class' => 'InvalidTemporaryUrl',
+                    'exception_message' => 'Storage adapter did not return a temporary URL.',
+                ]);
+
+                return $this->notFound();
+            }
         }
 
         $this->recordDownload($request, $artwork->id);
@@ -80,7 +129,13 @@ final class ArtworkDownloadController extends Controller
             ]);
         }
 
-        $downloadName = $this->buildDownloadFilename((string) $artwork->file_name, $ext);
+        if (array_key_exists('download_status', $artwork->getAttributes())) {
+            $artwork->forceFill([
+                'download_status' => 'available',
+                'download_source' => $resolution['source'],
+                'download_checked_at' => now(),
+            ])->saveQuietly();
+        }
 
         // X-Accel-Redirect is safe only when nginx is explicitly configured to
         // map the internal URI to the originals root. Otherwise fallback to the
@@ -95,9 +150,21 @@ final class ArtworkDownloadController extends Controller
             ]);
         }
 
+        if ($resolution['source'] === 'object') {
+            return redirect()->away($temporaryUrl);
+        }
+
         return response()->download($filePath, $downloadName);
     }
 
+    private function notFound(): Response
+    {
+        return response('', 404, [
+            'Content-Type' => 'text/plain; charset=UTF-8',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
     private function resolveAccelUri(string $filePath): ?string
     {
         if (! config('app.download_accel_enabled')) {

app/Http/Controllers/BuildInfoController.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+
+final class BuildInfoController extends Controller
+{
+    public function __invoke(): JsonResponse
+    {
+        $path = base_path('build-info.json');
+
+        if (! is_file($path) || ! is_readable($path)) {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        $decoded = json_decode((string) file_get_contents($path), true);
+
+        if (! is_array($decoded)) {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        $commit = trim((string) ($decoded['git_sha'] ?? ''));
+        $release = trim((string) ($decoded['release_id'] ?? ''));
+        $builtAt = trim((string) ($decoded['deployed_at_utc'] ?? ''));
+
+        if ($commit === '' || $release === '' || $builtAt === '') {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        return response()->json([
+            'environment' => app()->environment(),
+            'commit' => $commit,
+            'built_at' => $builtAt,
+            'release' => $release,
+        ])->header('Cache-Control', 'no-store, max-age=0');
+    }
+}

app/Http/Controllers/Dashboard/ManageController.php

@@ -3,12 +3,14 @@
 namespace App\Http\Controllers\Dashboard;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Manage\ManageArtworkDestroyRequest;
 use App\Http\Requests\Manage\ManageArtworkEditRequest;
 use App\Http\Requests\Manage\ManageArtworkUpdateRequest;
-use App\Http\Requests\Manage\ManageArtworkDestroyRequest;
+use App\Models\Artwork;
+use App\Services\Artworks\ArtworkCategoryService;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
 
 class ManageController extends Controller
 {
@@ -17,14 +19,12 @@ class ManageController extends Controller
         $userId = $request->user()->id;
         $perPage = 50;
 
-        $categorySub = DB::table('artwork_category as ac')
-            ->join('categories as c', 'ac.category_id', '=', 'c.id')
-            ->select('ac.artwork_id', DB::raw('MIN(c.name) as category_name'))
-            ->groupBy('ac.artwork_id');
+        $categorySub = DB::table('categories as c')
+            ->select('c.id as category_id', 'c.name as category_name');
 
         $query = DB::table('artworks as a')
             ->leftJoinSub($categorySub, 'cat', function ($join) {
-                $join->on('a.id', '=', 'cat.artwork_id');
+                $join->on('a.primary_category_id', '=', 'cat.category_id');
             })
             ->leftJoin('artwork_stats as s', 'a.id', '=', 's.artwork_id')
             ->where('a.user_id', $userId)
@@ -52,8 +52,8 @@ class ManageController extends Controller
     {
         $artwork = $request->artwork();
 
-        $selectedCategory = DB::table('artwork_category')->where('artwork_id', (int)$id)->value('category_id');
-        $artwork->category = $selectedCategory;
+        $selectedCategory = (int) ($artwork->primary_category_id ?: DB::table('artwork_category')->where('artwork_id', (int) $id)->value('category_id'));
+        $artwork->category = $selectedCategory ?: null;
 
         $categories = DB::table('categories')
             ->where('content_type_id', 0)
@@ -94,11 +94,11 @@ class ManageController extends Controller
         DB::table('artworks')->where('id', (int) $id)->update($update);
 
         if (isset($data['section'])) {
-            DB::table('artwork_category')->where('artwork_id', (int)$id)->delete();
-            DB::table('artwork_category')->insert([
-                'artwork_id' => (int)$id,
-                'category_id' => (int)$data['section'],
-            ]);
+            $model = Artwork::query()->find((int) $id);
+            if ($model) {
+                app(ArtworkCategoryService::class)
+                    ->sync($model, (int) $data['section'], [], 'moderator');
+            }
         }
 
         return redirect()->route('manage')->with('status', 'Artwork was successfully updated.');

app/Http/Controllers/Legacy/LegacyArtworkPhotoController.php

@@ -8,6 +8,7 @@ use App\Http\Controllers\Controller;
 use App\Models\Artwork;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Response;
 use Illuminate\Support\Facades\Schema;
 
 final class LegacyArtworkPhotoController extends Controller
@@ -26,25 +27,39 @@ final class LegacyArtworkPhotoController extends Controller
 
     private static ?bool $hasLegacyIdColumn = null;
 
-    public function __invoke(string $encoded, string $size, string $extension): RedirectResponse
+    public function __invoke(string $encoded, string $size, string $extension): RedirectResponse|Response
     {
         $artworkId = $this->decodeBase62($encoded);
         $sizeCode = (int) $size;
 
-        abort_if($artworkId === null || $artworkId < 1, 404);
+        if ($artworkId === null || $artworkId < 1) {
+            return $this->notFound();
+        }
 
         $artwork = $this->resolveArtwork($artworkId);
-        abort_unless($artwork !== null, 404);
+        if ($artwork === null) {
+            return $this->notFound();
+        }
 
         $targetUrl = $sizeCode === 7
             ? $this->resolveOriginalUrl($artwork)
             : $artwork->thumbUrl(self::THUMB_SIZE_MAP[$sizeCode] ?? 'md');
 
-        abort_if(empty($targetUrl), 404);
+        if ($targetUrl === null || $targetUrl === '') {
+            return $this->notFound();
+        }
 
         return redirect()->away($targetUrl, 301);
     }
 
+    private function notFound(): Response
+    {
+        return response('', 404, [
+            'Content-Type' => 'text/plain; charset=UTF-8',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
     private function decodeBase62(string $value): ?int
     {
         if ($value === '') {
@@ -86,11 +101,6 @@ final class LegacyArtworkPhotoController extends Controller
     {
         $cdn = rtrim((string) config('cdn.files_url', 'https://cdn.skinbase.org'), '/');
         $filePath = trim((string) ($artwork->file_path ?? ''), '/');
-
-        if ($filePath !== '') {
-            return $cdn . '/' . $filePath;
-        }
-
         $hash = strtolower((string) preg_replace('/[^a-f0-9]/i', '', (string) ($artwork->hash ?? '')));
         $ext = ltrim((string) ($artwork->file_ext ?: $artwork->thumb_ext ?: 'webp'), '.');
 
@@ -98,6 +108,10 @@ final class LegacyArtworkPhotoController extends Controller
             return $artwork->thumbUrl('xl') ?? $artwork->thumbUrl('lg') ?? $artwork->thumbUrl('md');
         }
 
+        if ($filePath !== '') {
+            return $cdn . '/' . $filePath;
+        }
+
         $prefix = trim((string) config('uploads.object_storage.prefix', 'artworks'), '/');
         $firstDir = substr($hash, 0, 2);
         $secondDir = substr($hash, 2, 2);

app/Http/Controllers/Legacy/TodayDownloadsController.php

@@ -3,11 +3,12 @@
 namespace App\Http\Controllers\Legacy;
 
 use App\Http\Controllers\Controller;
-use Illuminate\Http\Request;
+use App\Models\Artwork;
 use App\Models\ArtworkDownload;
-use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Str;
+use App\Services\ThumbnailPresenter;
 use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 
 class TodayDownloadsController extends Controller
 {
@@ -35,16 +36,16 @@ class TodayDownloadsController extends Controller
             $art = $row->artwork ?? null;
             // If Eloquent didn't eager load artwork (group queries sometimes don't), fetch it
             if (! $art && isset($row->artwork_id)) {
-                $art = \App\Models\Artwork::find($row->artwork_id);
+                $art = Artwork::find($row->artwork_id);
             }
 
             $name = $art->title ?? null;
             $picture = $art->file_name ?? null;
             $ext = pathinfo($picture ?? '', PATHINFO_EXTENSION) ?: 'jpg';
             $encoded = null; // legacy encoding unavailable; leave null
-            $present = $art ? \App\Services\ThumbnailPresenter::present($art, 'md') : null;
+            $present = $art ? ThumbnailPresenter::present($art, 'md') : null;
             $thumb = $present ? $present['url'] : 'https://files.skinbase.org/default/missing_md.webp';
-            $categoryId = $art->categories->first()->id ?? null;
+            $categoryId = $art->resolvedPrimaryCategory()?->id;
 
             return (object) [
                 'id' => $art->id ?? null,

app/Http/Controllers/Legacy/UserController.php

@@ -3,12 +3,12 @@
 namespace App\Http\Controllers\Legacy;
 
 use App\Http\Controllers\Controller;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
 use App\Services\AvatarService;
 use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Schema;
 
 class UserController extends Controller
 {
@@ -46,11 +46,21 @@ class UserController extends Controller
 
                 // Collect other profile updates to persist into `user_profiles` when available
                 $profileUpdates = [];
-                if (!empty($data['web'])) $profileUpdates['website'] = $data['web'];
-                if (!empty($data['signature'])) $profileUpdates['signature'] = $data['signature'];
-                if (!empty($data['description'])) $profileUpdates['description'] = $data['description'];
-                if (!empty($data['about_me'])) $profileUpdates['about'] = $data['about_me'];
-                if (!empty($data['country_code'])) $profileUpdates['country_code'] = $data['country_code'];
+                if (! empty($data['web'])) {
+                    $profileUpdates['website'] = $data['web'];
+                }
+                if (! empty($data['signature'])) {
+                    $profileUpdates['signature'] = $data['signature'];
+                }
+                if (! empty($data['description'])) {
+                    $profileUpdates['description'] = $data['description'];
+                }
+                if (! empty($data['about_me'])) {
+                    $profileUpdates['about'] = $data['about_me'];
+                }
+                if (! empty($data['country_code'])) {
+                    $profileUpdates['country_code'] = $data['country_code'];
+                }
 
                 $d1 = $request->input('date1');
                 $d2 = $request->input('date2');
@@ -60,10 +70,19 @@ class UserController extends Controller
                 }
 
                 $userGender = $request->input('gender', $user->gender);
-                if (!empty($userGender)) {
-                    $g = strtolower($userGender);
-                    $map = ['m' => 'M', 'f' => 'F', 'n' => 'X', 'x' => 'X'];
-                    $profileUpdates['gender'] = $map[$g] ?? strtoupper($userGender);
+                if ($userGender !== null && $userGender !== '') {
+                    $g = strtolower(trim((string) $userGender));
+                    $map = [
+                        'm' => 'M',
+                        'male' => 'M',
+                        'f' => 'F',
+                        'female' => 'F',
+                        'n' => 'X',
+                        'x' => 'X',
+                        'na' => 'X',
+                        'n/a' => 'X',
+                    ];
+                    $profileUpdates['gender'] = $map[$g] ?? null;
                 }
 
                 $profileUpdates['mlist'] = $request->has('newsletter') ? 1 : 0;
@@ -143,15 +162,33 @@ class UserController extends Controller
                 $profile = DB::table('user_profiles')->where('user_id', $user->id)->first();
                 if ($profile) {
                     // map modern profile fields onto the legacy user properties/helpers used by the view
-                    if (isset($profile->website)) $user->homepage = $profile->website;
-                    if (isset($profile->about)) $user->about_me = $profile->about;
-                    if (isset($profile->birthdate)) $user->birth = $profile->birthdate;
-                    if (isset($profile->gender)) $user->gender = $profile->gender;
-                    if (isset($profile->country_code)) $user->country_code = $profile->country_code;
-                    if (isset($profile->avatar_hash)) $user->icon = $profile->avatar_hash;
-                    if (isset($profile->cover_image)) $user->picture = $profile->cover_image;
-                    if (isset($profile->signature)) $user->signature = $profile->signature;
-                    if (isset($profile->description)) $user->description = $profile->description;
+                    if (isset($profile->website)) {
+                        $user->homepage = $profile->website;
+                    }
+                    if (isset($profile->about)) {
+                        $user->about_me = $profile->about;
+                    }
+                    if (isset($profile->birthdate)) {
+                        $user->birth = $profile->birthdate;
+                    }
+                    if (isset($profile->gender)) {
+                        $user->gender = $profile->gender;
+                    }
+                    if (isset($profile->country_code)) {
+                        $user->country_code = $profile->country_code;
+                    }
+                    if (isset($profile->avatar_hash)) {
+                        $user->icon = $profile->avatar_hash;
+                    }
+                    if (isset($profile->cover_image)) {
+                        $user->picture = $profile->cover_image;
+                    }
+                    if (isset($profile->signature)) {
+                        $user->signature = $profile->signature;
+                    }
+                    if (isset($profile->description)) {
+                        $user->description = $profile->description;
+                    }
                 }
             }
         } catch (\Throwable $e) {

app/Http/Controllers/Studio/StudioArtworksApiController.php

@@ -6,27 +6,34 @@ namespace App\Http\Controllers\Studio;
 
 use App\Http\Controllers\Controller;
 use App\Models\Artwork;
+use App\Models\ArtworkVersion;
 use App\Models\Category;
 use App\Models\ContentType;
-use App\Models\ArtworkVersion;
-use App\Services\ArtworkEvolutionService;
-use App\Services\Cdn\ArtworkCdnPurgeService;
-use App\Services\ArtworkSearchIndexer;
+use App\Notifications\NewArtworkReviewNotification;
+use App\Repositories\Uploads\ArtworkFileRepository;
 use App\Services\ArtworkAttributionService;
+use App\Services\ArtworkEvolutionService;
+use App\Services\Artworks\ArtworkCategoryService;
 use App\Services\Artworks\ArtworkPublicationService;
-use App\Services\TagService;
+use App\Services\ArtworkSearchIndexer;
 use App\Services\ArtworkVersioningService;
+use App\Services\Cdn\ArtworkCdnPurgeService;
+use App\Services\Moderation\ArtworkUploadPolicy;
 use App\Services\Studio\StudioArtworkQueryService;
 use App\Services\Studio\StudioBulkActionService;
-use App\Support\ArtworkDescriptionContentValidator;
 use App\Services\Tags\TagDiscoveryService;
+use App\Services\TagService;
+use App\Services\Uploads\UploadDerivativesService;
+use App\Services\Uploads\UploadStorageService;
 use App\Services\Worlds\WorldSubmissionService;
+use App\Support\ArtworkDescriptionContentValidator;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
-use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\ValidationException;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
@@ -45,6 +52,7 @@ final class StudioArtworksApiController extends Controller
         private readonly TagService $tagService,
         private readonly ArtworkCdnPurgeService $cdnPurge,
         private readonly ArtworkPublicationService $artworkPublication,
+        private readonly ArtworkCategoryService $artworkCategories,
     ) {}
 
     /**
@@ -127,7 +135,7 @@ final class StudioArtworksApiController extends Controller
      * PUT /api/studio/artworks/{id}
      * Update artwork details (title, description, visibility).
      */
-    public function update(Request $request, int $id, ArtworkAttributionService $attribution, WorldSubmissionService $submissions): JsonResponse
+    public function update(Request $request, int $id, ArtworkAttributionService $attribution, WorldSubmissionService $submissions, ArtworkUploadPolicy $uploadPolicy): JsonResponse
     {
         $artwork = $request->user()->artworks()->findOrFail($id);
         $evolution = app(ArtworkEvolutionService::class);
@@ -141,6 +149,9 @@ final class StudioArtworksApiController extends Controller
             'publish_at' => 'sometimes|nullable|string|date',
             'timezone' => 'sometimes|nullable|string|max:64',
             'category_id' => 'sometimes|nullable|integer|exists:categories,id',
+            'primary_category_id' => 'sometimes|nullable|integer|exists:categories,id',
+            'secondary_category_ids' => 'sometimes|array|max:'.(int) config('categories.max_secondary_categories', 5),
+            'secondary_category_ids.*' => 'integer|exists:categories,id',
             'content_type_id' => 'sometimes|nullable|integer|exists:content_types,id',
             'tags' => 'sometimes|array|max:'.(int) config('tags.max_user_tags', 30),
             'tags.*' => 'string|max:64',
@@ -210,14 +221,18 @@ final class StudioArtworksApiController extends Controller
 
         // Extract tags and category before updating core fields
         $tags = $validated['tags'] ?? null;
-        $categoryId = $validated['category_id'] ?? null;
+        $categoryId = $validated['primary_category_id'] ?? $validated['category_id'] ?? null;
+        $secondaryCategoryIds = array_key_exists('secondary_category_ids', $validated)
+            ? array_values(array_map('intval', $validated['secondary_category_ids'] ?? []))
+            : [];
+        $hasSecondaryCategoryUpdate = array_key_exists('secondary_category_ids', $validated);
         $contentTypeId = $validated['content_type_id'] ?? null;
         $evolutionPayload = [
             'target_artwork_id' => $validated['evolution_target_artwork_id'] ?? null,
             'relation_type' => $validated['evolution_relation_type'] ?? null,
             'note' => $validated['evolution_note'] ?? null,
         ];
-        unset($validated['tags'], $validated['category_id'], $validated['content_type_id'], $validated['visibility'], $validated['mode'], $validated['publish_at'], $validated['timezone'], $validated['group'], $validated['primary_author_user_id'], $validated['contributor_user_ids'], $validated['contributor_credits'], $validated['world_submissions']);
+        unset($validated['tags'], $validated['category_id'], $validated['primary_category_id'], $validated['secondary_category_ids'], $validated['content_type_id'], $validated['visibility'], $validated['mode'], $validated['publish_at'], $validated['timezone'], $validated['group'], $validated['primary_author_user_id'], $validated['contributor_user_ids'], $validated['contributor_credits'], $validated['world_submissions']);
         unset($validated['evolution_target_artwork_id'], $validated['evolution_relation_type'], $validated['evolution_note']);
 
         $validated['visibility'] = $visibility;
@@ -231,9 +246,17 @@ final class StudioArtworksApiController extends Controller
             $validated['artwork_status'] = 'scheduled';
         } else {
             $validated['is_public'] = $visibility !== Artwork::VISIBILITY_PRIVATE;
-            $validated['is_approved'] = true;
+            $policy = $uploadPolicy->assess($request->user(), $artwork);
+            $validated['is_approved'] = ! $policy['requires_review'];
+            $validated['approval_source'] = $policy['requires_review'] ? null : 'trusted_auto';
             $validated['publish_at'] = null;
-            $validated['artwork_status'] = 'published';
+            $validated['artwork_status'] = $policy['requires_review'] ? 'review' : 'published';
+
+            if ($policy['requires_review']) {
+                $validated['is_public'] = false;
+                $validated['published_at'] = null;
+                $validated['moderation_note'] = implode(', ', $policy['reasons']);
+            }
 
             if (($validated['is_public'] ?? false) && ! $artwork->published_at) {
                 $validated['published_at'] = now();
@@ -249,10 +272,19 @@ final class StudioArtworksApiController extends Controller
         }
 
         $artwork->update($validated);
+        $requiresReview = ($policy['requires_review'] ?? false) === true;
 
-        // Sync category
-        if ($categoryId !== null) {
-            $artwork->categories()->sync([(int) $categoryId]);
+        if ($categoryId !== null || $hasSecondaryCategoryUpdate) {
+            try {
+                $this->artworkCategories->sync(
+                    $artwork,
+                    $categoryId !== null ? (int) $categoryId : (int) $artwork->primary_category_id,
+                    $hasSecondaryCategoryUpdate ? $secondaryCategoryIds : ($categoryId !== null ? [] : null),
+                    (string) ($validated['category_source'] ?? $artwork->category_source ?? 'manual'),
+                );
+            } catch (ValidationException $exception) {
+                return response()->json(['errors' => $exception->errors()], 422);
+            }
         }
 
         // Sync tags through the shared tag service so pivot source/usage rules stay valid.
@@ -291,12 +323,28 @@ final class StudioArtworksApiController extends Controller
         // Reindex in Meilisearch — dispatches IndexArtworkJob which writes directly, no Scout hop.
         $this->searchIndexer->update($artwork);
 
+        if ($requiresReview) {
+            $notifyEmail = trim((string) config('uploads.moderation.notify_email', ''));
+            if ($notifyEmail !== '') {
+                try {
+                    Notification::route('mail', $notifyEmail)->notify(
+                        new NewArtworkReviewNotification($artwork, $request->user(), $policy['reasons'])
+                    );
+                } catch (\Throwable) {
+                    // Keep the artwork private if notification delivery fails.
+                }
+            }
+        }
+
         // Reload relationships for response
-        $artwork->load(['categories.contentType', 'tags', 'group', 'primaryAuthor.profile', 'contributors.user.profile']);
-        $primaryCategory = $artwork->categories->first();
+        $artwork->load(['categories.contentType', 'primaryCategory.contentType', 'tags', 'group', 'primaryAuthor.profile', 'contributors.user.profile']);
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
 
         return response()->json([
             'success' => true,
+            'status' => $requiresReview ? 'submitted_for_review' : 'published',
+            'message' => $requiresReview ? 'Artwork saved and queued for moderation.' : 'Artwork updated successfully.',
+            'review_reasons' => $requiresReview ? $policy['reasons'] : [],
             'artwork' => [
                 'id' => $artwork->id,
                 'title' => $artwork->title,
@@ -318,6 +366,13 @@ final class StudioArtworksApiController extends Controller
                 ])->values()->all(),
                 'content_type_id' => $primaryCategory?->contentType?->id,
                 'category_id' => $primaryCategory?->id,
+                'primary_category_id' => $primaryCategory?->id,
+                'secondary_category_ids' => $artwork->categories
+                    ->reject(fn ($category): bool => (int) $category->id === (int) ($primaryCategory?->id ?? 0))
+                    ->pluck('id')
+                    ->map(fn ($id): int => (int) $id)
+                    ->values()
+                    ->all(),
                 'tags' => $artwork->tags->map(fn ($t) => ['id' => $t->id, 'name' => $t->name, 'slug' => $t->slug])->values()->all(),
                 'title_source' => $artwork->title_source ?: 'manual',
                 'description_source' => $artwork->description_source ?: 'manual',
@@ -461,8 +516,8 @@ final class StudioArtworksApiController extends Controller
             'artwork_status' => $artwork->artwork_status,
             'created_at' => $artwork->created_at?->toIso8601String(),
             'deleted_at' => $artwork->deleted_at?->toIso8601String(),
-            'category'        => $artwork->categories->first()?->name,
-            'category_slug'   => $artwork->categories->first()?->slug,
+            'category' => $artwork->resolvedPrimaryCategory()?->name,
+            'category_slug' => $artwork->resolvedPrimaryCategory()?->slug,
             'tags' => $artwork->tags->pluck('slug')->values()->all(),
             'views' => (int) ($stats?->views ?? 0),
             'favourites' => (int) ($stats?->favorites ?? 0),
@@ -523,9 +578,9 @@ final class StudioArtworksApiController extends Controller
         }
 
         try {
-            $derivatives  = app(\App\Services\Uploads\UploadDerivativesService::class);
-            $storage      = app(\App\Services\Uploads\UploadStorageService::class);
-            $artworkFiles = app(\App\Repositories\Uploads\ArtworkFileRepository::class);
+            $derivatives = app(UploadDerivativesService::class);
+            $storage = app(UploadStorageService::class);
+            $artworkFiles = app(ArtworkFileRepository::class);
 
             // 1. Store original on disk (preserve extension when possible)
             $originalAsset = $derivatives->storeOriginal($tempPath, $hash);
@@ -610,6 +665,7 @@ final class StudioArtworksApiController extends Controller
                 'artwork_id' => $artwork->id,
                 'error' => $e->getMessage(),
             ]);
+
             return response()->json(['success' => false, 'error' => 'File processing failed: '.$e->getMessage()], 500);
         }
     }
@@ -678,8 +734,8 @@ final class StudioArtworksApiController extends Controller
             return response()->json(['success' => false, 'error' => $e->getMessage()], 429);
         }
 
-        $derivatives = app(\App\Services\Uploads\UploadDerivativesService::class);
-        $storage = app(\App\Services\Uploads\UploadStorageService::class);
+        $derivatives = app(UploadDerivativesService::class);
+        $storage = app(UploadStorageService::class);
         $cleanupLocalPaths = [];
         $cleanupObjectPaths = [];
 
@@ -918,7 +974,8 @@ final class StudioArtworksApiController extends Controller
             // Reindex
             try {
                 $this->searchIndexer->update($artwork);
-            } catch (\Throwable) {}
+            } catch (\Throwable) {
+            }
 
             return response()->json([
                 'success' => true,
@@ -938,7 +995,7 @@ final class StudioArtworksApiController extends Controller
      * This is best-effort; failures are logged but never fatal.
      * Configure a CDN purge webhook via ARTWORK_CDN_PURGE_URL if needed.
      */
-    private function purgeCdnCache(\App\Models\Artwork $artwork, string $oldHash): void
+    private function purgeCdnCache(Artwork $artwork, string $oldHash): void
     {
         try {
             $this->cdnPurge->purgeArtworkHashVariants($oldHash, 'webp', ['xs', 'sm', 'md', 'lg', 'xl', 'sq'], [

app/Http/Controllers/Studio/StudioController.php

@@ -5,26 +5,27 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Studio;
 
 use App\Http\Controllers\Controller;
-use App\Models\Group;
 use App\Models\ContentType;
+use App\Models\Group;
 use App\Services\ArtworkEvolutionService;
 use App\Services\Artworks\ArtworkPublicationService;
 use App\Services\GroupMembershipService;
 use App\Services\GroupService;
+use App\Services\Studio\CreatorStudioActivityService;
 use App\Services\Studio\CreatorStudioAnalyticsService;
 use App\Services\Studio\CreatorStudioAssetService;
 use App\Services\Studio\CreatorStudioCalendarService;
+use App\Services\Studio\CreatorStudioChallengeService;
 use App\Services\Studio\CreatorStudioCommentService;
 use App\Services\Studio\CreatorStudioContentService;
 use App\Services\Studio\CreatorStudioFollowersService;
 use App\Services\Studio\CreatorStudioGrowthService;
-use App\Services\Studio\CreatorStudioActivityService;
 use App\Services\Studio\CreatorStudioInboxService;
 use App\Services\Studio\CreatorStudioOverviewService;
 use App\Services\Studio\CreatorStudioPreferenceService;
-use App\Services\Studio\CreatorStudioChallengeService;
-use App\Services\Studio\CreatorStudioSearchService;
 use App\Services\Studio\CreatorStudioScheduledService;
+use App\Services\Studio\CreatorStudioSearchService;
+use App\Services\Uploads\UploadQueueService;
 use App\Services\Worlds\WorldSubmissionService;
 use App\Support\CoverUrl;
 use Illuminate\Http\RedirectResponse;
@@ -132,7 +133,7 @@ final class StudioController extends Controller
 
     public function uploadQueue(Request $request): Response
     {
-        $queue = app(\App\Services\Uploads\UploadQueueService::class)->listPayload(
+        $queue = app(UploadQueueService::class)->listPayload(
             $request->user(),
             $request->only(['batch_id', 'status', 'sort'])
         );
@@ -449,13 +450,13 @@ final class StudioController extends Controller
     {
         $user = $request->user();
         $artwork = $user->artworks()
-            ->with(['stats', 'categories.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile'])
+            ->with(['stats', 'categories.contentType', 'primaryCategory.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile'])
             ->findOrFail($id);
 
         $artwork = app(ArtworkPublicationService::class)->publishIfDue($artwork);
-        $artwork->loadMissing(['stats', 'categories.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile']);
+        $artwork->loadMissing(['stats', 'categories.contentType', 'primaryCategory.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile']);
 
-        $primaryCategory = $artwork->categories->first();
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
         $availableGroups = app(GroupService::class)->studioOptionsForUser($user);
         $membershipService = app(GroupMembershipService::class);
         $contributorOptionsByGroup = [];
@@ -503,9 +504,17 @@ final class StudioController extends Controller
                 ])->values()->all(),
                 'content_type_id' => $primaryCategory?->contentType?->id,
                 'category_id' => $primaryCategory?->id,
+                'primary_category_id' => $primaryCategory?->id,
                 'parent_category_id' => $primaryCategory?->parent_id ? $primaryCategory->parent_id : $primaryCategory?->id,
                 'sub_category_id' => $primaryCategory?->parent_id ? $primaryCategory->id : null,
-                'categories'      => $artwork->categories->map(fn ($c) => ['id' => $c->id, 'name' => $c->name, 'slug' => $c->slug])->values()->all(),
+                'secondary_category_ids' => $artwork->categories
+                    ->reject(fn ($category): bool => (int) $category->id === (int) ($primaryCategory?->id ?? 0))
+                    ->pluck('id')
+                    ->map(fn ($id): int => (int) $id)
+                    ->values()
+                    ->all(),
+                'max_secondary_categories' => (int) config('categories.max_secondary_categories', 5),
+                'categories' => $artwork->categories->map(fn ($c) => ['id' => $c->id, 'name' => $c->name, 'slug' => $c->slug, 'is_primary' => (int) $c->id === (int) ($primaryCategory?->id ?? 0)])->values()->all(),
                 'tags' => $artwork->tags->map(fn ($t) => ['id' => $t->id, 'name' => $t->name, 'slug' => $t->slug])->values()->all(),
                 'ai_status' => $artwork->ai_status,
                 'title_source' => $artwork->title_source ?: 'manual',

app/Http/Controllers/User/ProfileController.php

@@ -25,44 +25,49 @@ use App\Models\GroupReleaseContributor;
 use App\Models\ProfileComment;
 use App\Models\Story;
 use App\Models\User;
-use Carbon\CarbonInterface;
-use App\Services\Security\CaptchaVerifier;
-use App\Services\AvatarService;
-use App\Services\ArtworkService;
-use App\Services\FollowService;
 use App\Services\AchievementService;
+use App\Services\ArtworkService;
+use App\Services\AvatarService;
 use App\Services\CollectionService;
-use App\Services\FollowAnalyticsService;
-use App\Services\LeaderboardService;
-use App\Services\UserSuggestionService;
 use App\Services\Countries\CountryCatalogService;
+use App\Services\FollowAnalyticsService;
+use App\Services\FollowService;
+use App\Services\LeaderboardService;
 use App\Services\Maturity\ArtworkMaturityService;
-use App\Services\ThumbnailPresenter;
-use App\Services\Worlds\WorldRewardService;
-use App\Services\XPService;
-use App\Services\UsernameApprovalService;
 use App\Services\Profile\CreatorJourneyService;
 use App\Services\Profile\WorldProfileHistoryService;
+use App\Services\Security\CaptchaVerifier;
+use App\Services\ThumbnailPresenter;
+use App\Services\UsernameApprovalService;
 use App\Services\UserStatsService;
+use App\Services\UserSuggestionService;
+use App\Services\Worlds\WorldRewardService;
+use App\Services\XPService;
 use App\Support\AvatarUrl;
 use App\Support\CoverUrl;
 use App\Support\Seo\SeoFactory;
 use App\Support\UsernamePolicy;
+use Carbon\Carbon;
+use Carbon\CarbonInterface;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Redirect;
-use Illuminate\Support\Facades\Schema;
-use Illuminate\View\View;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Redirect;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\Rules\Password as PasswordRule;
+use Illuminate\View\View;
 use Inertia\Inertia;
 
 class ProfileController extends Controller
 {
+    private const SSR_WORLD_HISTORY_TABS = ['achievements', 'worlds'];
+
     private const PROFILE_TABS = [
         'posts',
         'artworks',
@@ -74,6 +79,7 @@ class ProfileController extends Controller
         'stats',
         'favourites',
         'activity',
+        'followers',
     ];
 
     public function __construct(
@@ -92,9 +98,7 @@ class ProfileController extends Controller
         private readonly CreatorJourneyService $creatorJourney,
         private readonly WorldRewardService $worldRewards,
         private readonly WorldProfileHistoryService $worldProfileHistory,
-    )
-    {
-    }
+    ) {}
 
     public function showByUsername(Request $request, string $username)
     {
@@ -188,6 +192,44 @@ class ProfileController extends Controller
         return $this->renderProfilePage($request, $user, 'Profile/ProfileShow', false, $normalizedTab);
     }
 
+    /**
+     * Read-only featured artwork payload for the client-side Artworks tab.
+     * This deliberately does not render the profile document or track a view.
+     */
+    public function featuredArtworks(Request $request, string $username): JsonResponse
+    {
+        $normalized = UsernamePolicy::normalize($username);
+        $user = User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
+
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        return response()->json([
+            'data' => $this->loadFeaturedArtworks($user, $request->user())->values(),
+        ]);
+    }
+
+    /**
+     * Read-only world history payload for profile tabs that are loaded client-side.
+     * This deliberately does not render the profile document or track a view.
+     */
+    public function worldHistory(Request $request, string $username): JsonResponse
+    {
+        $normalized = UsernamePolicy::normalize($username);
+        $user = User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
+
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        $isOwner = Auth::check() && Auth::id() === $user->id;
+
+        return response()->json($isOwner
+            ? $this->worldProfileHistory->ownerPayloadForUser($user)
+            : $this->worldProfileHistory->publicPayloadForUser($user));
+    }
+
     public function legacyById(Request $request, int $id, ?string $username = null)
     {
         $user = User::query()->findOrFail($id);
@@ -200,6 +242,28 @@ class ProfileController extends Controller
         return redirect()->route('profile.show', ['username' => UsernamePolicy::normalize($username)], 301);
     }
 
+    /**
+     * Legacy "All followers" URL from old profile templates:
+     * GET /following/{id}/{slug?} → /@{canonical-username}/followers
+     */
+    public function legacyFollowingById(Request $request, int $id, ?string $slug = null)
+    {
+        $user = User::query()->find($id);
+
+        if (! $user) {
+            abort(404);
+        }
+
+        $url = url('/@'.strtolower((string) $user->username).'/followers');
+        $query = $request->query();
+
+        if ($query !== []) {
+            $url .= '?'.http_build_query($query);
+        }
+
+        return redirect()->to($url, 301);
+    }
+
     /** Toggle follow/unfollow for the profile of $username (auth required). */
     public function toggleFollow(Request $request, string $username): JsonResponse
     {
@@ -284,27 +348,49 @@ class ProfileController extends Controller
                 $profile = DB::table('user_profiles')->where('user_id', $user->id)->first();
                 if ($profile) {
                     $profileData = (array) $profile;
-                    if (isset($profile->website)) $user->homepage = $profile->website;
-                    if (isset($profile->about)) $user->about_me = $profile->about;
-                    if (isset($profile->birthdate)) $user->birth = $profile->birthdate;
-                    if (isset($profile->gender)) $user->gender = $profile->gender;
-                    if (isset($profile->country_code)) $user->country_code = $profile->country_code;
-                    if (isset($profile->signature)) $user->signature = $profile->signature;
-                    if (isset($profile->description)) $user->description = $profile->description;
-                    if (isset($profile->mlist)) $user->mlist = $profile->mlist;
-                    if (isset($profile->friend_upload_notice)) $user->friend_upload_notice = $profile->friend_upload_notice;
-                    if (isset($profile->auto_post_upload)) $user->auto_post_upload = $profile->auto_post_upload;
+                    if (isset($profile->website)) {
+                        $user->homepage = $profile->website;
+                    }
+                    if (isset($profile->about)) {
+                        $user->about_me = $profile->about;
+                    }
+                    if (isset($profile->birthdate)) {
+                        $user->birth = $profile->birthdate;
+                    }
+                    if (isset($profile->gender)) {
+                        $user->gender = $profile->gender;
+                    }
+                    if (isset($profile->country_code)) {
+                        $user->country_code = $profile->country_code;
+                    }
+                    if (isset($profile->signature)) {
+                        $user->signature = $profile->signature;
+                    }
+                    if (isset($profile->description)) {
+                        $user->description = $profile->description;
+                    }
+                    if (isset($profile->mlist)) {
+                        $user->mlist = $profile->mlist;
+                    }
+                    if (isset($profile->friend_upload_notice)) {
+                        $user->friend_upload_notice = $profile->friend_upload_notice;
+                    }
+                    if (isset($profile->auto_post_upload)) {
+                        $user->auto_post_upload = $profile->auto_post_upload;
                     }
                 }
-        } catch (\Throwable $e) {}
+            }
+        } catch (\Throwable $e) {
+        }
 
         if (! empty($user->birth)) {
             try {
-                $dt = \Carbon\Carbon::parse($user->birth);
+                $dt = Carbon::parse($user->birth);
                 $birthDay = $dt->format('d');
                 $birthMonth = $dt->format('m');
                 $birthYear = $dt->format('Y');
-            } catch (\Throwable $e) {}
+            } catch (\Throwable $e) {
+            }
         }
 
         $selectedCountry = $this->countryCatalog->resolveUserCountry($user);
@@ -568,8 +654,8 @@ class ProfileController extends Controller
             'country_code' => $selectedCountry?->iso2,
         ];
 
-        if (!empty($validated['gender'])) {
-            $profileUpdates['gender'] = strtoupper((string) $validated['gender']);
+        if (array_key_exists('gender', $validated)) {
+            $profileUpdates['gender'] = $this->normalizeProfileGender($validated['gender'] ?? null);
         }
 
         $this->persistProfileUpdates((int) $request->user()->id, $profileUpdates);
@@ -653,6 +739,29 @@ class ProfileController extends Controller
         DB::table('user_profiles')->updateOrInsert(['user_id' => $userId], $filtered);
     }
 
+    /**
+     * Normalize gender to the MySQL enum values used by user_profiles.gender.
+     */
+    private function normalizeProfileGender(mixed $value): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        $normalized = strtolower(trim((string) $value));
+
+        if ($normalized === '') {
+            return null;
+        }
+
+        return match ($normalized) {
+            'm', 'male', 'man', 'boy' => 'M',
+            'f', 'female', 'woman', 'girl' => 'F',
+            'x', 'n', 'na', 'n/a', 'nonbinary', 'non-binary', 'prefer_not_to_say', 'prefer not to say' => 'X',
+            default => null,
+        };
+    }
+
     private function resolveCountrySelection(int|string|null $countryId = null, ?string $countryCode = null): ?Country
     {
         if (is_numeric($countryId) && (int) $countryId > 0) {
@@ -736,7 +845,7 @@ class ProfileController extends Controller
         );
     }
 
-    public function update(ProfileUpdateRequest $request, \App\Services\AvatarService $avatarService): RedirectResponse|JsonResponse
+    public function update(ProfileUpdateRequest $request, AvatarService $avatarService): RedirectResponse|JsonResponse
     {
         $user = $request->user();
 
@@ -763,6 +872,7 @@ class ProfileController extends Controller
                     if ($request->expectsJson()) {
                         return response()->json(['errors' => $error], 422);
                     }
+
                     return Redirect::back()->withErrors($error);
                 }
 
@@ -775,6 +885,7 @@ class ProfileController extends Controller
                     if ($request->expectsJson()) {
                         return response()->json(['errors' => $error], 422);
                     }
+
                     return Redirect::back()->withErrors($error);
                 }
 
@@ -797,7 +908,9 @@ class ProfileController extends Controller
         $user->save();
 
         $profileUpdates = [];
-        if (!empty($validated['about'])) $profileUpdates['about'] = $validated['about'];
+        if (! empty($validated['about'])) {
+            $profileUpdates['about'] = $validated['about'];
+        }
 
         if (! empty($validated['web'])) {
             $profileUpdates['website'] = $validated['web'];
@@ -812,10 +925,8 @@ class ProfileController extends Controller
             $profileUpdates['birthdate'] = sprintf('%04d-%02d-%02d', (int) $year, (int) $month, (int) $day);
         }
 
-        if (!empty($validated['gender'])) {
-            $g = strtolower($validated['gender']);
-            $map = ['m' => 'M', 'f' => 'F', 'n' => 'X', 'x' => 'X'];
-            $profileUpdates['gender'] = $map[$g] ?? strtoupper($validated['gender']);
+        if (array_key_exists('gender', $validated)) {
+            $profileUpdates['gender'] = $this->normalizeProfileGender($validated['gender'] ?? null);
         }
 
         if (array_key_exists('country_id', $validated) || array_key_exists('country', $validated)) {
@@ -839,10 +950,16 @@ class ProfileController extends Controller
             $profileUpdates['auto_post_upload'] = filter_var($validated['auto_post_upload'], FILTER_VALIDATE_BOOLEAN) ? 1 : 0;
         }
 
-        if (isset($validated['signature'])) $profileUpdates['signature'] = $validated['signature'];
-        if (isset($validated['description'])) $profileUpdates['description'] = $validated['description'];
+        if (isset($validated['signature'])) {
+            $profileUpdates['signature'] = $validated['signature'];
+        }
+        if (isset($validated['description'])) {
+            $profileUpdates['description'] = $validated['description'];
+        }
 
-        if (isset($validated['about'])) $profileUpdates['about'] = $validated['about'];
+        if (isset($validated['about'])) {
+            $profileUpdates['about'] = $validated['about'];
+        }
 
         if ($request->hasFile('avatar')) {
             try {
@@ -851,6 +968,7 @@ class ProfileController extends Controller
                 if ($request->expectsJson()) {
                     return response()->json(['errors' => ['avatar' => ['Avatar processing failed: '.$e->getMessage()]]], 422);
                 }
+
                 return Redirect::back()->with('error', 'Avatar processing failed: '.$e->getMessage());
             }
         }
@@ -862,10 +980,11 @@ class ProfileController extends Controller
             if (in_array($file->getMimeType(), $allowedImageMimes, true)) {
                 $ext = $file->guessExtension() ?: 'jpg';
                 $fname = $user->id.'_emoticon_'.time().'.'.$ext;
-                \Illuminate\Support\Facades\Storage::disk('public')->putFileAs('user-emoticons/'.$user->id, $file, $fname);
+                Storage::disk('public')->putFileAs('user-emoticons/'.$user->id, $file, $fname);
                 try {
-                    \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update(['eicon' => $fname]);
-                } catch (\Exception $e) {}
+                    DB::table('users')->where('id', $user->id)->update(['eicon' => $fname]);
+                } catch (\Exception $e) {
+                }
             }
         }
 
@@ -874,25 +993,26 @@ class ProfileController extends Controller
             if (in_array($file->getMimeType(), $allowedImageMimes, true)) {
                 $ext = $file->guessExtension() ?: 'jpg';
                 $fname = $user->id.'_photo_'.time().'.'.$ext;
-                \Illuminate\Support\Facades\Storage::disk('public')->putFileAs('user-picture/'.$user->id, $file, $fname);
-                if (\Illuminate\Support\Facades\Schema::hasTable('user_profiles')) {
+                Storage::disk('public')->putFileAs('user-picture/'.$user->id, $file, $fname);
+                if (Schema::hasTable('user_profiles')) {
                     $profileUpdates['cover_image'] = $fname;
                 } else {
                     try {
-                        \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update(['picture' => $fname]);
-                    } catch (\Exception $e) {}
+                        DB::table('users')->where('id', $user->id)->update(['picture' => $fname]);
+                    } catch (\Exception $e) {
+                    }
                 }
             }
         }
 
         try {
-            if (\Illuminate\Support\Facades\Schema::hasTable('user_profiles')) {
+            if (Schema::hasTable('user_profiles')) {
                 if (! empty($profileUpdates)) {
-                    \Illuminate\Support\Facades\DB::table('user_profiles')->updateOrInsert(['user_id' => $user->id], $profileUpdates);
+                    DB::table('user_profiles')->updateOrInsert(['user_id' => $user->id], $profileUpdates);
                 }
             } else {
                 if (! empty($profileUpdates)) {
-                    \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update($profileUpdates);
+                    DB::table('users')->where('id', $user->id)->update($profileUpdates);
                 }
             }
         } catch (\Exception $e) {
@@ -953,8 +1073,7 @@ class ProfileController extends Controller
         string $component = 'Profile/ProfileShow',
         bool $galleryOnly = false,
         ?string $initialTab = null,
-    )
-    {
+    ) {
         $isOwner = Auth::check() && Auth::id() === $user->id;
         $viewer = Auth::user();
         $perPage = 24;
@@ -966,51 +1085,21 @@ class ProfileController extends Controller
             });
 
         // ── Featured artworks for this user ─────────────────────────────────
-        $featuredArtworks = collect();
-        if (Schema::hasTable('artwork_features')) {
-            $featuredQuery = Artwork::query()
-                ->with([
-                    'user:id,name,username,level,rank',
-                    'user.profile:user_id,avatar_hash',
-                    'group:id,name,slug,avatar_path',
-                    'stats:artwork_id,views,downloads,favorites',
-                    'categories' => function ($query) {
-                        $query->select('categories.id', 'categories.content_type_id', 'categories.parent_id', 'categories.name', 'categories.slug', 'categories.sort_order')
-                            ->with(['parent:id,parent_id,content_type_id,name,slug', 'contentType:id,slug,name']);
-                    },
-                ])
-                ->join('artwork_features as af', 'af.artwork_id', '=', 'artworks.id')
-                ->where('artworks.user_id', $user->id)
-                ->where('af.is_active', true)
-                ->whereNull('af.deleted_at')
-                ->whereNull('artworks.deleted_at')
-                ->where('artworks.is_public', true)
-                ->where('artworks.is_approved', true)
-                ->whereNotNull('artworks.published_at')
-                ->select(['artworks.*', 'af.label as featured_label', 'af.featured_at as featured_slot_at'])
-                ->orderByDesc('af.featured_at')
-                ->limit(3);
+        $featuredArtworks = $initialTab === 'artworks'
+            ? $this->loadFeaturedArtworks($user, $viewer)
+            : null;
 
-            app(ArtworkMaturityService::class)->applyViewerFilter($featuredQuery, $viewer);
-
-            $featuredArtworks = $featuredQuery
-                ->get()
-                ->map(function (Artwork $artwork) {
-                    return (object) array_merge($this->mapArtworkCardPayload($artwork), [
-                        'label' => $artwork->featured_label,
-                        'featured_at' => $this->formatIsoDate($artwork->featured_slot_at),
-                    ]);
-                });
-        }
-
-        // ── Favourites ───────────────────────────────────────────────────────
+        // ── Favourites (only needed for the direct Favourites tab) ───────────
+        $favourites = null;
+        if ($initialTab === 'favourites') {
             $favouriteLimit = 12;
             $favouriteTable = $this->resolveFavouriteTable();
             $favourites = [
                 'data' => [],
                 'next_cursor' => null,
             ];
-        if ($favouriteTable !== null) {
+        }
+        if ($favourites !== null && $favouriteTable !== null) {
             $favIds = DB::table($favouriteTable.' as af')
                 ->join('artworks as a', 'a.id', '=', 'af.artwork_id')
                 ->where('af.user_id', $user->id)
@@ -1223,8 +1312,11 @@ class ProfileController extends Controller
                 'published_at' => $story->published_at?->toISOString(),
             ]);
 
+        $profileCollectionsPayload = null;
+        if ($initialTab === 'collections') {
             $profileCollections = $this->collections->getProfileCollections($user, $viewer);
             $profileCollectionsPayload = $this->collections->mapCollectionCardPayloads($profileCollections, $isOwner, $viewer);
+        }
 
         // ── Profile data ─────────────────────────────────────────────────────
         $profile = $user->profile;
@@ -1243,7 +1335,8 @@ class ProfileController extends Controller
         if (! $isOwner) {
             try {
                 $this->userStats->incrementProfileViews($user->id);
-            } catch (\Throwable) {}
+            } catch (\Throwable) {
+            }
         }
 
         // ── Normalise artworks for JSON serialisation ────────────────────
@@ -1260,7 +1353,7 @@ class ProfileController extends Controller
         // ── Auth context for JS ───────────────────────────────────────────
         $authData = null;
         if (Auth::check()) {
-            /** @var \App\Models\User $authUser */
+            /** @var User $authUser */
             $authUser = Auth::user();
             $authAvatarUrl = AvatarUrl::forUser((int) $authUser->id, $authUser->profile?->avatar_hash, 64);
             $authData = [
@@ -1281,9 +1374,11 @@ class ProfileController extends Controller
             ->all();
         $achievementSummary = $this->achievements->summary((int) $user->id);
         $worldRewardSummary = $this->worldRewards->summaryForUser($user);
-        $worldHistory = $isOwner
+        $worldHistory = in_array($initialTab, self::SSR_WORLD_HISTORY_TABS, true)
+            ? ($isOwner
                 ? $this->worldProfileHistory->ownerPayloadForUser($user)
-            : $this->worldProfileHistory->publicPayloadForUser($user);
+                : $this->worldProfileHistory->publicPayloadForUser($user))
+            : null;
         $leaderboardRank = $this->leaderboards->creatorRankSummary((int) $user->id);
         $groupContributionHistory = $this->buildGroupContributionHistory($user);
         $journey = $this->creatorJourney->publicPayloadForUser($user);
@@ -1293,9 +1388,37 @@ class ProfileController extends Controller
             ? ($profileTabUrls[$resolvedInitialTab] ?? $canonical)
             : $canonical;
         $tabMetaLabel = $resolvedInitialTab !== null
-            ? ucfirst($resolvedInitialTab)
+            ? ($resolvedInitialTab === 'followers' ? 'Followers' : ucfirst($resolvedInitialTab))
             : null;
 
+        $followersListing = null;
+
+        if (! $galleryOnly && $resolvedInitialTab === 'followers') {
+            $followersPage = max(1, (int) $request->query('page', 1));
+            $followersListing = [
+                'data' => [],
+                'current_page' => $followersPage,
+                'last_page' => 1,
+                'per_page' => 24,
+                'total' => 0,
+                'next_page_url' => null,
+                'prev_page_url' => null,
+            ];
+
+            if (Schema::hasTable('user_followers')) {
+                $followersPaginator = $this->followService->paginatedFollowers((int) $user->id, 24, $followersPage);
+                $followersListing = [
+                    'data' => array_values($followersPaginator->items()),
+                    'current_page' => $followersPaginator->currentPage(),
+                    'last_page' => $followersPaginator->lastPage(),
+                    'per_page' => $followersPaginator->perPage(),
+                    'total' => $followersPaginator->total(),
+                    'next_page_url' => $followersPaginator->nextPageUrl(),
+                    'prev_page_url' => $followersPaginator->previousPageUrl(),
+                ];
+            }
+        }
+
         $pageTitle = $galleryOnly
             ? (($user->username ?? $user->name ?? 'User').' Gallery on Skinbase')
             : ($isTabLanding
@@ -1303,9 +1426,11 @@ class ProfileController extends Controller
                 : (($user->username ?? $user->name ?? 'User').' on Skinbase'));
         $pageDescription = $galleryOnly
             ? ('Browse the public gallery of '.($user->username ?? $user->name).' on Skinbase.')
+            : ($resolvedInitialTab === 'followers'
+                ? ('People who follow '.($user->username ?? $user->name).' on Skinbase.')
                 : ($isTabLanding
                     ? ('Explore the '.strtolower((string) $tabMetaLabel).' section for '.($user->username ?? $user->name).' on Skinbase.')
-                : ('View the profile of ' . ($user->username ?? $user->name) . ' on Skinbase — artworks, favourites and more.'));
+                    : ('View the profile of '.($user->username ?? $user->name).' on Skinbase — artworks, favourites and more.')));
         $profileSeo = app(SeoFactory::class)->profilePage(
             $pageTitle,
             $galleryOnly ? $galleryUrl : $activeProfileUrl,
@@ -1344,12 +1469,13 @@ class ProfileController extends Controller
                 'cover_image' => $profile->cover_image ?? null,
             ] : null,
             'artworks' => $artworkPayload,
-            'featuredArtworks'  => $featuredArtworks->values(),
+            'featuredArtworks' => $featuredArtworks?->values(),
             'favourites' => $favourites,
             'stats' => $statsPayload,
             'socialLinks' => $socialLinks,
             'followerCount' => $followerCount,
             'recentFollowers' => $recentFollowers->values(),
+            'followersListing' => $followersListing,
             'followContext' => $followContext,
             'followAnalytics' => $followAnalytics,
             'suggestedUsers' => $suggestedUsers,
@@ -1386,6 +1512,50 @@ class ProfileController extends Controller
         ]);
     }
 
+    /**
+     * Build the canonical featured artwork representation shared by SSR and
+     * the lazy Artworks-tab endpoint.
+     */
+    private function loadFeaturedArtworks(User $user, ?User $viewer): ?Collection
+    {
+        if (! Schema::hasTable('artwork_features')) {
+            return collect();
+        }
+
+        $featuredQuery = Artwork::query()
+            ->with([
+                'user:id,name,username,level,rank',
+                'user.profile:user_id,avatar_hash',
+                'group:id,name,slug,avatar_path',
+                'stats:artwork_id,views,downloads,favorites',
+                'categories' => function ($query) {
+                    $query->select('categories.id', 'categories.content_type_id', 'categories.parent_id', 'categories.name', 'categories.slug', 'categories.sort_order')
+                        ->with(['parent:id,parent_id,content_type_id,name,slug', 'contentType:id,slug,name']);
+                },
+            ])
+            ->join('artwork_features as af', 'af.artwork_id', '=', 'artworks.id')
+            ->where('artworks.user_id', $user->id)
+            ->where('af.is_active', true)
+            ->whereNull('af.deleted_at')
+            ->whereNull('artworks.deleted_at')
+            ->where('artworks.is_public', true)
+            ->where('artworks.is_approved', true)
+            ->whereNotNull('artworks.published_at')
+            ->select(['artworks.*', 'af.label as featured_label', 'af.featured_at as featured_slot_at'])
+            ->orderByDesc('af.featured_at')
+            ->limit(3);
+
+        app(ArtworkMaturityService::class)->applyViewerFilter($featuredQuery, $viewer);
+
+        return $featuredQuery->get()
+            ->map(function (Artwork $artwork) {
+                return (object) array_merge($this->mapArtworkCardPayload($artwork), [
+                    'label' => $artwork->featured_label,
+                    'featured_at' => $this->formatIsoDate($artwork->featured_slot_at),
+                ]);
+            });
+    }
+
     private function normalizeProfileTab(mixed $tab): ?string
     {
         if (! is_string($tab)) {
@@ -1413,7 +1583,7 @@ class ProfileController extends Controller
 
     private function buildGroupContributionHistory(User $user): array
     {
-        return GroupContributorStat::query()
+        $stats = GroupContributorStat::query()
             ->with(['group.owner.profile'])
             ->where('user_id', $user->id)
             ->whereHas('group', fn ($query) => $query
@@ -1422,29 +1592,60 @@ class ProfileController extends Controller
             ->orderByDesc('release_count')
             ->orderByDesc('credited_artworks_count')
             ->limit(8)
+            ->get();
+
+        $groupIds = $stats->pluck('group_id')->map(static fn ($id): int => (int) $id)->values()->all();
+        if ($groupIds === []) {
+            return [];
+        }
+
+        $membershipsByGroup = GroupMember::query()
+            ->whereIn('group_id', $groupIds)
+            ->where('user_id', $user->id)
+            ->where('status', Group::STATUS_ACTIVE)
             ->get()
-            ->map(function (GroupContributorStat $stat) use ($user): ?array {
+            ->keyBy('group_id');
+
+        $releaseRolesByGroup = GroupReleaseContributor::query()
+            ->join('group_releases as bulk_releases', 'bulk_releases.id', '=', 'group_release_contributors.group_release_id')
+            ->where('group_release_contributors.user_id', $user->id)
+            ->whereIn('bulk_releases.group_id', $groupIds)
+            ->whereNull('bulk_releases.deleted_at')
+            ->orderBy('group_release_contributors.id')
+            ->get([
+                'bulk_releases.group_id',
+                'group_release_contributors.role_label',
+            ])
+            ->groupBy('group_id');
+
+        $projectRolesByGroup = GroupProjectMember::query()
+            ->join('group_projects as bulk_projects', 'bulk_projects.id', '=', 'group_project_members.group_project_id')
+            ->where('group_project_members.user_id', $user->id)
+            ->whereIn('bulk_projects.group_id', $groupIds)
+            ->whereNull('bulk_projects.deleted_at')
+            ->orderBy('group_project_members.id')
+            ->get([
+                'bulk_projects.group_id',
+                'group_project_members.role_label',
+            ])
+            ->groupBy('group_id');
+
+        $recentReleasesByGroup = $this->loadRecentGroupReleaseTitles($user, $groupIds);
+
+        return $stats
+            ->map(function (GroupContributorStat $stat) use ($user, $membershipsByGroup, $releaseRolesByGroup, $projectRolesByGroup, $recentReleasesByGroup): ?array {
                 $group = $stat->group;
 
                 if (! $group) {
                     return null;
                 }
 
-                $member = GroupMember::query()
-                    ->where('group_id', $group->id)
-                    ->where('user_id', $user->id)
-                    ->where('status', Group::STATUS_ACTIVE)
-                    ->first();
+                $groupId = (int) $group->id;
+                $member = $membershipsByGroup->get($groupId);
 
                 $roleLabels = collect()
-                    ->merge(GroupReleaseContributor::query()
-                        ->where('user_id', $user->id)
-                        ->whereHas('release', fn ($query) => $query->where('group_id', $group->id))
-                        ->pluck('role_label'))
-                    ->merge(GroupProjectMember::query()
-                        ->where('user_id', $user->id)
-                        ->whereHas('project', fn ($query) => $query->where('group_id', $group->id))
-                        ->pluck('role_label'))
+                    ->merge($releaseRolesByGroup->get($groupId, collect())->pluck('role_label'))
+                    ->merge($projectRolesByGroup->get($groupId, collect())->pluck('role_label'))
                     ->filter()
                     ->map(fn ($label): string => trim((string) $label))
                     ->filter()
@@ -1452,21 +1653,7 @@ class ProfileController extends Controller
                     ->values()
                     ->all();
 
-                $recentReleaseTitles = GroupRelease::query()
-                    ->where('group_id', $group->id)
-                    ->where('visibility', GroupRelease::VISIBILITY_PUBLIC)
-                    ->where(function ($query) use ($user): void {
-                        $query->where('lead_user_id', $user->id)
-                            ->orWhere('created_by_user_id', $user->id)
-                            ->orWhereHas('contributorLinks', fn ($contributorQuery) => $contributorQuery->where('user_id', $user->id));
-                    })
-                    ->orderByDesc('released_at')
-                    ->latest('updated_at')
-                    ->limit(3)
-                    ->pluck('title')
-                    ->map(fn ($title): string => (string) $title)
-                    ->values()
-                    ->all();
+                $recentReleaseTitles = $recentReleasesByGroup->get($groupId, collect())->all();
 
                 $joinedAt = $group->isOwnedBy($user)
                     ? $group->created_at?->toISOString()
@@ -1503,6 +1690,45 @@ class ProfileController extends Controller
             ->all();
     }
 
+    /**
+     * Load the same top-three public releases per group as the previous
+     * per-group LIMIT query, while keeping the existing two-column ordering.
+     *
+     * @param  array<int, int>  $groupIds
+     * @return Collection<int, Collection<int, string>>
+     */
+    private function loadRecentGroupReleaseTitles(User $user, array $groupIds): Collection
+    {
+        $eligibleReleases = GroupRelease::query()
+            ->whereIn('group_id', $groupIds)
+            ->where('visibility', GroupRelease::VISIBILITY_PUBLIC)
+            ->where(function ($query) use ($user): void {
+                $query->where('lead_user_id', $user->id)
+                    ->orWhere('created_by_user_id', $user->id)
+                    ->orWhereHas('contributorLinks', fn ($contributorQuery) => $contributorQuery->where('user_id', $user->id));
+            })
+            ->select(['id', 'group_id', 'title', 'released_at', 'updated_at']);
+
+        $ranked = DB::query()
+            ->fromSub($eligibleReleases, 'eligible_group_releases')
+            ->select([
+                'group_id',
+                'title',
+                'released_at',
+                'updated_at',
+            ])
+            ->selectRaw('ROW_NUMBER() OVER (PARTITION BY group_id ORDER BY released_at DESC, updated_at DESC) as release_rank');
+
+        return DB::query()
+            ->fromSub($ranked, 'ranked_group_releases')
+            ->where('release_rank', '<=', 3)
+            ->orderBy('group_id')
+            ->orderBy('release_rank')
+            ->get(['group_id', 'title'])
+            ->groupBy('group_id')
+            ->map(fn ($rows) => $rows->pluck('title')->map(fn ($title): string => (string) $title)->values());
+    }
+
     private function resolveFavouriteTable(): ?string
     {
         foreach (['artwork_favourites', 'user_favorites', 'artworks_favourites', 'favourites'] as $table) {
@@ -1520,7 +1746,7 @@ class ProfileController extends Controller
     private function mapArtworkCardPayload(Artwork $art): array
     {
         $present = ThumbnailPresenter::present($art, 'md');
-        $category = $art->categories->first();
+        $category = $art->resolvedPrimaryCategory();
         $contentType = $category?->contentType;
         $stats = $art->stats;
         $group = $art->group;

app/Http/Controllers/User/TodayDownloadsController.php

@@ -3,7 +3,10 @@
 namespace App\Http\Controllers\User;
 
 use App\Http\Controllers\Controller;
+use App\Models\Artwork;
 use App\Models\ArtworkDownload;
+use App\Services\ThumbnailPresenter;
+use App\Support\AvatarUrl;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -54,7 +57,7 @@ class TodayDownloadsController extends Controller
         $paginator->getCollection()->transform(function ($row) {
             $art = $row->artwork ?? null;
             if (! $art && isset($row->artwork_id)) {
-                $art = \App\Models\Artwork::find($row->artwork_id);
+                $art = Artwork::find($row->artwork_id);
             }
 
             if (! $art) {
@@ -75,9 +78,9 @@ class TodayDownloadsController extends Controller
             $picture = $art->file_name ?? null;
             $ext = pathinfo($picture ?? '', PATHINFO_EXTENSION) ?: 'jpg';
             $encoded = null;
-            $present = $art ? \App\Services\ThumbnailPresenter::present($art, 'md') : null;
+            $present = $art ? ThumbnailPresenter::present($art, 'md') : null;
             $thumb = $present ? $present['url'] : 'https://files.skinbase.org/default/missing_md.webp';
-            $primaryCategory = $art->categories->first();
+            $primaryCategory = $art->resolvedPrimaryCategory();
             $categoryId = $primaryCategory->id ?? null;
             $categoryName = $primaryCategory->name ?? '';
             $categorySlug = $primaryCategory->slug ?? '';
@@ -98,7 +101,7 @@ class TodayDownloadsController extends Controller
                 'category_slug' => $categorySlug,
                 'uname' => $art->user->name ?? 'Skinbase',
                 'username' => $art->user->username ?? '',
-                'avatar_url' => \App\Support\AvatarUrl::forUser((int) ($art->user->id ?? 0), $avatarHash, 64),
+                'avatar_url' => AvatarUrl::forUser((int) ($art->user->id ?? 0), $avatarHash, 64),
                 'width' => $art->width,
                 'height' => $art->height,
                 'published_at' => $art->published_at,

app/Http/Controllers/Web/ArtworkPageController.php

@@ -8,20 +8,19 @@ use App\Enums\ReactionType;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\ArtworkResource;
 use App\Models\Artwork;
-use App\Models\ArtworkComment;
-use Illuminate\Support\Facades\DB;
-use App\Services\ContentSanitizer;
-use App\Services\ThumbnailPresenter;
+use App\Models\Category;
+use App\Services\ArtworkNavigationService;
+use App\Services\ArtworkRelatedService;
 use App\Services\ErrorSuggestionService;
 use App\Services\GroupService;
 use App\Services\Maturity\ArtworkMaturityService;
+use App\Services\ThumbnailPresenter;
 use App\Support\Seo\SeoFactory;
-use App\Support\AvatarUrl;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Collection;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Illuminate\View\View;
 use Inertia\Inertia;
@@ -32,6 +31,8 @@ final class ArtworkPageController extends Controller
     public function __construct(
         private readonly GroupService $groups,
         private readonly ArtworkMaturityService $maturity,
+        private readonly ArtworkNavigationService $navigation,
+        private readonly ArtworkRelatedService $relatedArtworks,
     ) {}
 
     public function show(Request $request, int $id, ?string $slug = null): View|RedirectResponse|Response|InertiaResponse
@@ -42,6 +43,7 @@ final class ArtworkPageController extends Controller
         if (! $raw) {
             // Artwork never existed → contextual 404
             $suggestions = app(ErrorSuggestionService::class);
+
             return response(view('errors.contextual.artwork-not-found', [
                 'trendingArtworks' => $this->safeSuggestions(fn () => $suggestions->trendingArtworks()),
             ]), 404);
@@ -76,8 +78,9 @@ final class ArtworkPageController extends Controller
                         ->limit(6)
                         ->get()
                         ->map(function (Artwork $a) {
-                            $slug = \Illuminate\Support\Str::slug((string) ($a->slug ?: $a->title)) ?: (string) $a->id;
-                            $md   = \App\Services\ThumbnailPresenter::present($a, 'md');
+                            $slug = Str::slug((string) ($a->slug ?: $a->title)) ?: (string) $a->id;
+                            $md = ThumbnailPresenter::present($a, 'md');
+
                             return [
                                 'id' => $a->id,
                                 'title' => html_entity_decode((string) $a->title, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
@@ -98,14 +101,21 @@ final class ArtworkPageController extends Controller
             ]), 403);
         }
 
-        // ── Step 2: full load with all relations ───────────────────────────
-        $artwork = Artwork::with(['user.profile', 'group.owner.profile', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'categories.contentType', 'categories.parent.contentType', 'tags', 'stats', 'awardStat'])
-            ->where('id', $id)
-            ->public()
-            ->published()
-            ->firstOrFail();
+        // ── Step 2: hydrate the already-validated model ────────────────────
+        // The initial withTrashed lookup is intentionally retained so that
+        // missing, deleted, private, and unpublished artwork keep their
+        // distinct responses. Reusing that model avoids a second identical
+        // primary-key lookup on the public path.
+        $artwork = $raw;
+        $artwork->load(['user.profile', 'group.owner.profile', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'categories.contentType', 'categories.parent.contentType', 'primaryCategory.contentType', 'primaryCategory.parent.contentType', 'tags', 'stats', 'awardStat']);
 
-        $this->loadCategoryAncestors($artwork->categories);
+        $this->loadCategoryAncestors(
+            $artwork->categories
+                ->concat(collect([$artwork->resolvedPrimaryCategory()]))
+                ->filter()
+                ->unique('id')
+                ->values()
+        );
 
         $canonicalSlug = Str::slug((string) ($artwork->slug ?: $artwork->title));
         if ($canonicalSlug === '') {
@@ -119,12 +129,15 @@ final class ArtworkPageController extends Controller
             ], 301);
         }
 
-        $thumbMd = ThumbnailPresenter::present($artwork, 'md');
-        $thumbLg = ThumbnailPresenter::present($artwork, 'lg');
-        $thumbXl = ThumbnailPresenter::present($artwork, 'xl');
-        $thumbSq = ThumbnailPresenter::present($artwork, 'sq');
-
         $artworkData = (new ArtworkResource($artwork))->toArray($request);
+        $navigationData = $this->navigation->navigationFor($artwork);
+        // ArtworkResource is the canonical thumbnail projection. Reuse its
+        // exact values for page props and SEO instead of presenting each
+        // variant a second time in the controller.
+        $thumbMd = $artworkData['thumbs']['md'] ?? [];
+        $thumbLg = $artworkData['thumbs']['lg'] ?? [];
+        $thumbXl = $artworkData['thumbs']['xl'] ?? [];
+        $thumbSq = $artworkData['thumbs']['sq'] ?? [];
         $groupSummary = null;
 
         if ($artwork->group) {
@@ -151,37 +164,7 @@ final class ArtworkPageController extends Controller
             'xl' => $thumbXl,
         ], $canonical, $this->artworkBreadcrumbs($artwork, $canonical))->toArray();
 
-        $categoryIds = $artwork->categories->pluck('id')->filter()->values();
-        $tagIds = $artwork->tags->pluck('id')->filter()->values();
-
-        $related = Artwork::query()
-            ->with(['user', 'group', 'categories.contentType'])
-            ->whereKeyNot($artwork->id)
-            ->public()
-            ->published()
-            ->tap(fn ($builder) => $this->maturity->applyViewerFilter($builder, $request->user()))
-            ->where(function ($query) use ($artwork, $categoryIds, $tagIds): void {
-                $query->where('user_id', $artwork->user_id);
-
-                if ($artwork->group_id) {
-                    $query->orWhere('group_id', $artwork->group_id);
-                }
-
-                if ($categoryIds->isNotEmpty()) {
-                    $query->orWhereHas('categories', function ($categoryQuery) use ($categoryIds): void {
-                        $categoryQuery->whereIn('categories.id', $categoryIds->all());
-                    });
-                }
-
-                if ($tagIds->isNotEmpty()) {
-                    $query->orWhereHas('tags', function ($tagQuery) use ($tagIds): void {
-                        $tagQuery->whereIn('tags.id', $tagIds->all());
-                    });
-                }
-            })
-            ->latest('published_at')
-            ->limit(12)
-            ->get()
+        $related = $this->relatedArtworks->related($artwork, $request->user(), 12)
             ->map(function (Artwork $item): array {
                 $itemSlug = Str::slug((string) ($item->slug ?: $item->title));
                 if ($itemSlug === '') {
@@ -206,84 +189,21 @@ final class ArtworkPageController extends Controller
             ->values()
             ->all();
 
-        $approvedComments = ArtworkComment::query()
-            ->with('user.profile')
-            ->where('artwork_id', $artwork->id)
-            ->where('is_approved', true)
-            ->orderBy('created_at')
-            ->limit(500)
-            ->get();
-
-        $commentsByParent = $approvedComments->groupBy(
-            static fn (ArtworkComment $comment): string => $comment->parent_id === null
-                ? 'root'
-                : (string) $comment->parent_id
-        );
-
-        // Recursive helper to format a comment and its nested replies.
-        $formatComment = null;
-        $formatComment = function (ArtworkComment $c) use (&$formatComment, $commentsByParent): array {
-            /** @var Collection<int, ArtworkComment> $replies */
-            $replies = $commentsByParent->get((string) $c->id, collect());
-            $user = $c->user;
-            $userId = (int) ($c->user_id ?? 0);
-            $avatarHash = $user?->profile?->avatar_hash ?? null;
-            $canPublishLinks = (int) ($user?->level ?? 1) > 1 && strtolower((string) ($user?->rank ?? 'Newbie')) !== 'newbie';
-            $rawContent = (string) ($c->raw_content ?? $c->content ?? '');
-            $renderedContent = $c->rendered_content;
-
-            if (! is_string($renderedContent) || trim($renderedContent) === '') {
-                $renderedContent = $rawContent !== ''
-                    ? ContentSanitizer::render($rawContent)
-                    : nl2br(e(strip_tags((string) ($c->content ?? ''))));
-            }
-
-            return [
-                'id'               => $c->id,
-                'parent_id'        => $c->parent_id,
-                'content'          => html_entity_decode((string) $c->content, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
-                'raw_content'      => $c->raw_content ?? $c->content,
-                'rendered_content' => ContentSanitizer::sanitizeRenderedHtml($renderedContent, $canPublishLinks),
-                'created_at'       => $c->created_at?->toIso8601String(),
-                'time_ago'         => $c->created_at ? Carbon::parse($c->created_at)->diffForHumans() : null,
-                'user'             => [
-                    'id'          => $userId,
-                    'name'        => $user?->name,
-                    'username'    => $user?->username,
-                    'display'     => $user?->username ?? $user?->name ?? 'User',
-                    'profile_url' => $user?->username ? '/@' . $user->username : ($userId > 0 ? '/profile/' . $userId : null),
-                    'avatar_url'  => $avatarHash !== null
-                        ? AvatarUrl::forUser($userId, $avatarHash, 64)
-                        : AvatarUrl::default(),
-                    'level'       => (int) ($user?->level ?? 1),
-                    'rank'        => (string) ($user?->rank ?? 'Newbie'),
-                ],
-                'replies' => $replies->map($formatComment)->values()->all(),
-            ];
-        };
-
-        $comments = $commentsByParent
-            ->get('root', collect())
-            ->map($formatComment)
-            ->values()
-            ->all();
-
         $canReadSession = $request->hasSession() && ! $request->attributes->get('skinbase.session_skipped');
-
-        $userId = ($canReadSession && $request->user() !== null) ? (int) $request->user()->id : null;
+        $viewerId = ($canReadSession && $request->user() !== null) ? (int) $request->user()->id : null;
 
         return Inertia::render('ArtworkPage', [
             'artwork' => $artworkData,
+            'navigation' => $navigationData,
             'presentMd' => $thumbMd,
             'presentLg' => $thumbLg,
             'presentXl' => $thumbXl,
             'presentSq' => $thumbSq,
             'related' => $related,
             'canonicalUrl' => $canonical,
-            'comments'        => $comments,
             'groupSummary' => $groupSummary,
-            'isAuthenticated' => $userId !== null,
-            'reactionTotals'  => $this->artworkReactionTotals((int) $artwork->id, $userId),
+            'isAuthenticated' => $viewerId !== null,
+            'reactionTotals' => $this->artworkReactionTotals((int) $artwork->id, $viewerId),
             'seo' => $seo,
         ])->rootView('artworks.show');
     }
@@ -343,7 +263,7 @@ final class ArtworkPageController extends Controller
                 ->values();
 
             if ($missingParentIds->isNotEmpty()) {
-                $fetchedParents = \App\Models\Category::query()
+                $fetchedParents = Category::query()
                     ->with('contentType')
                     ->whereIn('id', $missingParentIds->all())
                     ->get()
@@ -369,12 +289,7 @@ final class ArtworkPageController extends Controller
      */
     private function artworkBreadcrumbs(Artwork $artwork, string $canonical): array
     {
-        $primaryCategory = $artwork->categories
-            ->sortBy(fn ($category) => [
-                (int) ($category->sort_order ?? 0),
-                (string) ($category->name ?? ''),
-            ])
-            ->first();
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
 
         if ($primaryCategory === null) {
             return [

app/Http/Controllers/Web/SimilarArtworksPageController.php

@@ -171,16 +171,13 @@ final class SimilarArtworksPageController extends Controller
      */
     private function resolveSimilarArtworks(Artwork $source, int $page, string $baseUrl): array
     {
-        // Priority 1 — Qdrant visual (vision) similarity
+        // Priority 1 — Qdrant visual (vision) similarity.
+        // Paginate IDs before hydrating/presenting full Artwork models so a
+        // request only pays the relation/presenter cost for the current page.
         if ($this->vectors->isConfigured()) {
-            $qdrantItems = $this->resolveViaQdrant($source);
-            if ($qdrantItems !== null && $qdrantItems->isNotEmpty()) {
-                $paginator = $this->paginateCollection(
-                    $qdrantItems->map(fn ($a) => $this->presentArtwork($a)),
-                    $page,
-                    $baseUrl,
-                );
-                return [$paginator, 'visual'];
+            $qdrantPaginator = $this->resolveViaQdrant($source, $page, $baseUrl);
+            if ($qdrantPaginator !== null && $qdrantPaginator->total() > 0) {
+                return [$qdrantPaginator, 'visual'];
             }
         }
 
@@ -192,38 +189,77 @@ final class SimilarArtworksPageController extends Controller
                 $page,
                 $baseUrl,
             );
+
             return [$paginator, 'hybrid'];
         }
 
         // Priority 3 — Meilisearch tag/category overlap
         $paginator = $this->meilisearchFallback($source, $page);
+
         return [$paginator, 'tags'];
     }
 
     /**
-     * Query Qdrant via VectorGateway, then re-hydrate full Artwork models
-     * (so we have category/dimension data for the masonry grid).
+     * Query Qdrant via VectorGateway, preserve relevance order, then paginate
+     * candidate IDs before hydrating full Artwork models for the current page.
      *
-     * Returns null when the gateway call fails, so the caller can fall through.
+     * The light eligibility query keeps the existing public/published semantics
+     * for cached Qdrant results without loading relations for every candidate.
+     * Returns null when the gateway call fails or no eligible candidates remain,
+     * allowing the caller to continue to the existing hybrid/tag fallbacks.
      */
-    private function resolveViaQdrant(Artwork $source): ?Collection
-    {
+    private function resolveViaQdrant(
+        Artwork $source,
+        int $page,
+        string $baseUrl,
+    ): ?LengthAwarePaginator {
         try {
             $raw = $this->vectors->similarToArtwork($source, self::QDRANT_LIMIT);
         } catch (RuntimeException) {
             return null;
         }
 
-        if (empty($raw)) {
+        if ($raw === []) {
             return null;
         }
 
-        // Preserve Qdrant relevance order; IDs are already filtered to public+published
-        $orderedIds = array_column($raw, 'id');
+        // Preserve Qdrant relevance order while normalising IDs defensively.
+        $orderedIds = collect(array_column($raw, 'id'))
+            ->map(static fn ($id): int => is_numeric($id) ? (int) $id : 0)
+            ->filter(static fn (int $id): bool => $id > 0 && $id !== (int) $source->id)
+            ->unique()
+            ->values();
 
+        if ($orderedIds->isEmpty()) {
+            return null;
+        }
+
+        // Keep cached Qdrant results honest if an artwork has since become
+        // private/unpublished. Fetch IDs only; do not hydrate relations yet.
+        $eligibleSet = Artwork::query()
+            ->whereIn('id', $orderedIds->all())
+            ->public()
+            ->published()
+            ->pluck('id')
+            ->mapWithKeys(static fn ($id): array => [(int) $id => true]);
+
+        $eligibleIds = $orderedIds
+            ->filter(static fn (int $id): bool => $eligibleSet->has($id))
+            ->values();
+
+        if ($eligibleIds->isEmpty()) {
+            return null;
+        }
+
+        $perPage = self::PER_PAGE;
+        $total = $eligibleIds->count();
+        $pageIds = $eligibleIds->forPage($page, $perPage)->values();
+
+        $items = collect();
+
+        if ($pageIds->isNotEmpty()) {
             $artworks = Artwork::query()
-            ->whereIn('id', $orderedIds)
-            ->where('id', '!=', $source->id)   // belt-and-braces exclusion
+                ->whereIn('id', $pageIds->all())
                 ->public()
                 ->published()
                 ->with([
@@ -236,12 +272,25 @@ final class SimilarArtworksPageController extends Controller
                 ->get()
                 ->keyBy('id');
 
-        return collect($orderedIds)
+            $items = $pageIds
                 ->map(fn (int $id) => $artworks->get($id))
                 ->filter()
+                ->map(fn (Artwork $artwork) => $this->presentArtwork($artwork))
                 ->values();
         }
 
+        return new LengthAwarePaginator(
+            $items,
+            $total,
+            $perPage,
+            $page,
+            [
+                'path' => $baseUrl,
+                'query' => [],
+            ],
+        );
+    }
+
     /**
      * Meilisearch tag-overlap query with category fallback.
      */

app/Http/Middleware/CommentCaptchaMiddleware.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use cPad\Plugins\Forum\Services\Security\BotProtectionService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Http;
+use Symfony\Component\HttpFoundation\Response;
+
+class CommentCaptchaMiddleware
+{
+    public function __construct(private readonly BotProtectionService $botProtection) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! (bool) config('comment_spam.captcha.enabled', false)) {
+            return $next($request);
+        }
+
+        $assessment = $this->botProtection->assess($request, 'comment_create');
+        if ((bool) ($assessment['blocked'] ?? false)) {
+            return response()->json(['message' => 'Suspicious activity detected.', 'errors' => ['bot' => ['Suspicious activity detected.']]], 429);
+        }
+        $threshold = (int) config('comment_spam.captcha.threshold', 40);
+        if ((int) ($assessment['risk_score'] ?? 0) < $threshold) {
+            return $next($request);
+        }
+
+        $token = (string) ($request->input('comment-turnstile-response') ?: $request->header('X-Turnstile-Token', ''));
+        $valid = false;
+        if ($token !== '') {
+            try {
+                $valid = (bool) Http::asForm()->timeout(5)->post(
+                    (string) config('comment_spam.captcha.verify_url'),
+                    ['secret' => (string) config('comment_spam.captcha.secret_key'), 'response' => $token, 'remoteip' => $request->ip()],
+                )->json('success', false);
+            } catch (\Throwable) {
+                $valid = (bool) config('comment_spam.captcha.fail_open', false);
+            }
+        }
+
+        if ($valid) {
+            return $next($request);
+        }
+
+        $payload = [
+            'message' => 'Complete the captcha challenge to continue.',
+            'errors' => ['captcha' => ['Complete the captcha challenge to continue.']],
+            'requires_captcha' => true,
+            'captcha' => [
+                'provider' => 'turnstile',
+                'siteKey' => (string) config('comment_spam.captcha.site_key'),
+                'inputName' => 'comment-turnstile-response',
+                'scriptUrl' => (string) config('comment_spam.captcha.script_url'),
+            ],
+            'captcha_provider' => 'turnstile',
+            'captcha_site_key' => (string) config('comment_spam.captcha.site_key'),
+            'captcha_input' => 'comment-turnstile-response',
+            'captcha_script_url' => (string) config('comment_spam.captcha.script_url'),
+        ];
+
+        return response()->json($payload, 422);
+    }
+}

app/Http/Middleware/TrackOnlineVisitor.php

@@ -74,6 +74,8 @@ final class TrackOnlineVisitor
             'robots.txt',
             'sitemap.xml',
             'sitemaps/*',
+            'download/artwork/*',
+            'photo/*',
         ])) {
             return false;
         }

app/Http/Requests/Artworks/ArtworkCreateRequest.php

@@ -27,6 +27,9 @@ final class ArtworkCreateRequest extends FormRequest
             'title' => 'required|string|max:150',
             'description' => 'nullable|string',
             'category' => 'nullable|integer|exists:categories,id',
+            'primary_category_id' => 'nullable|integer|exists:categories,id',
+            'secondary_category_ids' => 'nullable|array|max:'.(int) config('categories.max_secondary_categories', 5),
+            'secondary_category_ids.*' => 'integer|exists:categories,id',
             'tags' => 'nullable|string|max:200',
             'license' => 'nullable|boolean',
             'is_mature' => 'nullable|boolean',
@@ -45,7 +48,7 @@ final class ArtworkCreateRequest extends FormRequest
 
     private function denyAsNotFound(): void
     {
-        throw new NotFoundHttpException();
+        throw new NotFoundHttpException;
     }
 
     private function logUnauthorized(string $reason): void

app/Http/Requests/Studio/ApplyArtworkAiAssistRequest.php

@@ -27,6 +27,9 @@ final class ApplyArtworkAiAssistRequest extends FormRequest
             'tags.*' => ['string', 'max:64'],
             'tag_mode' => ['sometimes', Rule::in(['add', 'replace', 'remove'])],
             'category_id' => ['sometimes', 'nullable', 'integer', 'exists:categories,id'],
+            'primary_category_id' => ['sometimes', 'nullable', 'integer', 'exists:categories,id'],
+            'secondary_category_ids' => ['sometimes', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
             'content_type_id' => ['sometimes', 'nullable', 'integer', 'exists:content_types,id'],
             'similar_actions' => ['sometimes', 'array', 'max:10'],
             'similar_actions.*.artwork_id' => ['required_with:similar_actions', 'integer'],

app/Http/Resources/ArtworkResource.php

@@ -1,9 +1,10 @@
 <?php
+
 namespace App\Http\Resources;
 
+use App\Models\World;
 use App\Models\WorldRelation;
 use App\Models\WorldSubmission;
-use App\Models\World;
 use App\Services\ArtworkEvolutionService;
 use App\Services\ContentSanitizer;
 use App\Services\Maturity\ArtworkMaturityService;
@@ -12,15 +13,19 @@ use App\Services\Worlds\WorldRewardService;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
 
 class ArtworkResource extends JsonResource
 {
+    /** @var array<string, bool> */
+    private array $tablePresence = [];
+
     /**
      * Transform the resource into an array.
      */
     public function toArray($request): array
     {
-        $this->resource->loadMissing(['group', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'worldSubmissions.world', 'worldRewardGrants.world']);
+        $this->resource->loadMissing(['group', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'worldSubmissions.world']);
 
         $md = ThumbnailPresenter::present($this->resource, 'md');
         $lg = ThumbnailPresenter::present($this->resource, 'lg');
@@ -28,21 +33,19 @@ class ArtworkResource extends JsonResource
         $sq = ThumbnailPresenter::present($this->resource, 'sq');
         $screenshots = $this->resolveScreenshotAssets();
 
-        $canonicalSlug = \Illuminate\Support\Str::slug((string) ($this->slug ?: $this->title));
+        $canonicalSlug = Str::slug((string) ($this->slug ?: $this->title));
         if ($canonicalSlug === '') {
             $canonicalSlug = (string) $this->id;
         }
 
         $followerCount = 0;
         if (! empty($this->user?->id)) {
-            if (Schema::hasTable('user_statistics')) {
             $followerCount = (int) DB::table('user_statistics')
                 ->where('user_id', (int) $this->user->id)
                 ->value('followers_count');
-            }
 
             // Legacy fallback for environments where new tables are unavailable.
-            if (($followerCount <= 0) && Schema::hasTable('friends_list')) {
+            if (($followerCount <= 0) && $this->hasTable('friends_list')) {
                 $followerCount = (int) DB::table('friends_list')
                     ->where('friend_id', (int) $this->user->id)
                     ->count();
@@ -58,24 +61,22 @@ class ArtworkResource extends JsonResource
         $viewerAward = null;
         $isOwner = $viewerId > 0 && $viewerId === (int) ($this->user?->id ?? 0);
 
-        $bookmarksCount = Schema::hasTable('artwork_bookmarks')
-            ? (int) DB::table('artwork_bookmarks')->where('artwork_id', (int) $this->id)->count()
-            : 0;
+        $bookmarksCount = (int) DB::table('artwork_bookmarks')
+            ->where('artwork_id', (int) $this->id)
+            ->count();
 
         if ($viewerId > 0) {
-            if (Schema::hasTable('artwork_likes')) {
+            if ($this->hasTable('artwork_likes')) {
                 $isLiked = DB::table('artwork_likes')
                     ->where('user_id', $viewerId)
                     ->where('artwork_id', (int) $this->id)
                     ->exists();
             }
 
-            if (Schema::hasTable('artwork_bookmarks')) {
             $isBookmarked = DB::table('artwork_bookmarks')
                 ->where('user_id', $viewerId)
                 ->where('artwork_id', (int) $this->id)
                 ->exists();
-            }
 
             $isFavorited = DB::table('artwork_favourites')
                 ->where('user_id', $viewerId)
@@ -83,12 +84,12 @@ class ArtworkResource extends JsonResource
                 ->exists();
 
             if (! empty($this->user?->id)) {
-                if (Schema::hasTable('user_followers')) {
+                if ($this->hasTable('user_followers')) {
                     $isFollowing = DB::table('user_followers')
                         ->where('user_id', (int) $this->user->id)
                         ->where('follower_id', $viewerId)
                         ->exists();
-                } elseif (Schema::hasTable('friends_list')) {
+                } elseif ($this->hasTable('friends_list')) {
                     // Legacy fallback only.
                     $isFollowing = DB::table('friends_list')
                         ->where('user_id', $viewerId)
@@ -97,14 +98,14 @@ class ArtworkResource extends JsonResource
                 }
             }
 
-            if (!empty($this->group?->id) && Schema::hasTable('group_follows')) {
+            if (! empty($this->group?->id) && $this->hasTable('group_follows')) {
                 $isFollowingGroup = DB::table('group_follows')
                     ->where('group_id', (int) $this->group->id)
                     ->where('user_id', $viewerId)
                     ->exists();
             }
 
-            if (Schema::hasTable('artwork_medals')) {
+            if ($this->hasTable('artwork_medals')) {
                 $viewerAward = DB::table('artwork_medals')
                     ->where('user_id', $viewerId)
                     ->where('artwork_id', (int) $this->id)
@@ -176,6 +177,8 @@ class ArtworkResource extends JsonResource
             'title' => $decode($this->title),
             'description' => $decode($this->description),
             'description_html' => $this->renderDescriptionHtml(),
+            'download_status' => (string) ($this->download_status ?? 'unknown'),
+            'download_source' => $this->download_source,
             'dimensions' => [
                 'width' => (int) ($this->width ?? 0),
                 'height' => (int) ($this->height ?? 0),
@@ -255,12 +258,31 @@ class ArtworkResource extends JsonResource
             'maturity' => app(ArtworkMaturityService::class)->presentation($this->resource, $request->user()),
             'evolution' => app(ArtworkEvolutionService::class)->publicPayload($this->resource, $request->user()),
             'world_participation' => $this->resolveWorldParticipation(),
-            'categories' => $this->categories->map(fn ($category) => [
+            'category' => ($primary = $this->resolvedPrimaryCategory()) ? [
+                'id' => (int) $primary->id,
+                'slug' => (string) $primary->slug,
+                'name' => html_entity_decode((string) $primary->name, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
+                'content_type_slug' => (string) ($primary->contentType?->slug ?? ''),
+                'url' => $primary->contentType ? $primary->url : null,
+                'is_primary' => true,
+            ] : null,
+            'primary_category' => ($primary = $this->resolvedPrimaryCategory()) ? [
+                'id' => (int) $primary->id,
+                'slug' => (string) $primary->slug,
+                'name' => html_entity_decode((string) $primary->name, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
+                'content_type_slug' => (string) ($primary->contentType?->slug ?? ''),
+                'url' => $primary->contentType ? $primary->url : null,
+            ] : null,
+            'categories' => $this->categories->map(function ($category) {
+                $primaryId = (int) ($this->primary_category_id ?? 0);
+
+                return [
                     'id' => (int) $category->id,
                     'slug' => (string) $category->slug,
                     'name' => html_entity_decode((string) $category->name, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
                     'content_type_slug' => (string) ($category->contentType?->slug ?? ''),
                     'url' => $category->contentType ? $category->url : null,
+                    'is_primary' => $primaryId > 0 && (int) $category->id === $primaryId,
                     'parent' => $category->parent ? [
                         'id' => (int) $category->parent->id,
                         'slug' => (string) $category->parent->slug,
@@ -268,7 +290,8 @@ class ArtworkResource extends JsonResource
                         'content_type_slug' => (string) ($category->parent->contentType?->slug ?? ''),
                         'url' => $category->parent->contentType ? $category->parent->url : null,
                     ] : null,
-            ])->values(),
+                ];
+            })->values(),
             'tags' => $this->tags->map(fn ($tag) => [
                 'id' => (int) $tag->id,
                 'slug' => (string) $tag->slug,
@@ -279,10 +302,6 @@ class ArtworkResource extends JsonResource
 
     private function resolveScreenshotAssets(): array
     {
-        if (! Schema::hasTable('artwork_files')) {
-            return [];
-        }
-
         return DB::table('artwork_files')
             ->where('artwork_id', (int) $this->id)
             ->where('variant', 'like', 'shot%')
@@ -339,7 +358,6 @@ class ArtworkResource extends JsonResource
         $items = collect();
         $participationWorlds = collect();
 
-        if (Schema::hasTable('world_relations') && Schema::hasTable('worlds')) {
         $relations = WorldRelation::query()
             ->with('world')
             ->where('related_type', WorldRelation::TYPE_ARTWORK)
@@ -348,7 +366,9 @@ class ArtworkResource extends JsonResource
             ->filter(fn (WorldRelation $relation): bool => $relation->world !== null && $relation->world->isPubliclyVisible())
             ->values();
 
-            $participationWorlds = $participationWorlds->concat($relations->pluck('world')->filter());
+        $participationWorlds = $participationWorlds->concat(
+            $relations->pluck('world')->filter()
+        );
 
         $items = $items->concat(
             $relations->map(function (WorldRelation $relation): array {
@@ -367,9 +387,7 @@ class ArtworkResource extends JsonResource
                 ];
             })
         );
-        }
 
-        if (Schema::hasTable('world_submissions')) {
         $liveSubmissions = $this->worldSubmissions
             ->filter(function (WorldSubmission $submission): bool {
                 return (string) $submission->status === WorldSubmission::STATUS_LIVE
@@ -378,8 +396,13 @@ class ArtworkResource extends JsonResource
             })
             ->values();
 
-            $participationWorlds = $participationWorlds->concat($liveSubmissions->pluck('world')->filter());
-            World::primeCanonicalEditionIds($participationWorlds->pluck('recurrence_key')->all());
+        $participationWorlds = $participationWorlds->concat(
+            $liveSubmissions->pluck('world')->filter()
+        );
+
+        World::primeCanonicalEditionIds(
+            $participationWorlds->pluck('recurrence_key')->all()
+        );
 
         $items = $items->concat(
             $liveSubmissions->map(function (WorldSubmission $submission): array {
@@ -399,13 +422,11 @@ class ArtworkResource extends JsonResource
                 ];
             })
         );
-        } elseif ($participationWorlds->isNotEmpty()) {
-            World::primeCanonicalEditionIds($participationWorlds->pluck('recurrence_key')->all());
-        }
 
-        if (Schema::hasTable('world_reward_grants')) {
-            $items = $items->concat(app(WorldRewardService::class)->artworkRewardBadges($this->resource));
-        }
+        $items = $items->concat(
+            app(WorldRewardService::class)
+                ->artworkRewardBadges($this->resource)
+        );
 
         return $items
             ->sortBy('sort_priority')
@@ -421,6 +442,11 @@ class ArtworkResource extends JsonResource
             ->all();
     }
 
+    private function hasTable(string $table): bool
+    {
+        return $this->tablePresence[$table] ??= Schema::hasTable($table);
+    }
+
     private function authorCanPublishLinks(): bool
     {
         $level = (int) ($this->user?->level ?? 1);

app/Jobs/GenerateArtworkEmbeddingJob.php

@@ -7,9 +7,8 @@ namespace App\Jobs;
 use App\Models\Artwork;
 use App\Models\ArtworkEmbedding;
 use App\Services\Vision\ArtworkEmbeddingClient;
-use App\Services\Vision\ArtworkVisionImageUrl;
 use App\Services\Vision\ArtworkVectorIndexService;
-use App\Services\Vision\VectorService;
+use App\Services\Vision\ArtworkVisionImageUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -49,8 +48,7 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
         ArtworkEmbeddingClient $client,
         ArtworkVisionImageUrl $imageUrlBuilder,
         ArtworkVectorIndexService $vectors,
-    ): void
-    {
+    ): void {
         if (! (bool) config('recommendations.embedding.enabled', true)) {
             return;
         }
@@ -78,17 +76,73 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
                 ->where('model_version', $modelVersion)
                 ->first();
 
-            if ($existing && (string) ($existing->source_hash ?? '') === $sourceHash) {
+            if (
+                $existing
+                && (string) ($existing->source_hash ?? '') === $sourceHash
+                && $this->vectorIndexCoversEmbedding(
+                    $artwork,
+                    $existing
+                )
+            ) {
                 return;
             }
         }
 
-        $lockKey = $this->lockKey($artwork->id, $model, $modelVersion);
+        $lockKey = $this->lockKey(
+            $artwork->id,
+            $model,
+            $modelVersion
+        );
+
         if (! $this->acquireLock($lockKey)) {
             return;
         }
 
         try {
+            /*
+             * Another worker may have generated or indexed the
+             * embedding between our first read and lock acquisition.
+             * Re-read both records under the lock.
+             */
+            if (! $this->force) {
+                $artwork->refresh();
+
+                $existing = ArtworkEmbedding::query()
+                    ->where('artwork_id', $artwork->id)
+                    ->where('model', $model)
+                    ->where('model_version', $modelVersion)
+                    ->first();
+
+                if (
+                    $existing
+                    && (string) ($existing->source_hash ?? '')
+                        === $sourceHash
+                ) {
+                    if (
+                        $this->vectorIndexCoversEmbedding(
+                            $artwork,
+                            $existing
+                        )
+                    ) {
+                        return;
+                    }
+
+                    $storedVector = $this->decodeStoredVector(
+                        $existing
+                    );
+
+                    if ($storedVector !== []) {
+                        $this->upsertVectorIndex(
+                            $vectors,
+                            $artwork,
+                            $storedVector
+                        );
+
+                        return;
+                    }
+                }
+            }
+
             $imageUrl = $imageUrlBuilder->fromArtwork($artwork);
             if ($imageUrl === null) {
                 return;
@@ -121,23 +175,33 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
                 ]
             );
 
-            $this->upsertVectorIndex($vectors, $artwork);
+            $this->upsertVectorIndex(
+                $vectors,
+                $artwork,
+                $normalized
+            );
         } finally {
             $this->releaseLock($lockKey);
         }
     }
 
+    /**
+     * @param  array<int, float>  $vector
+     */
     private function upsertVectorIndex(
         ArtworkVectorIndexService $vectors,
-        Artwork $artwork
-    ): void
-    {
+        Artwork $artwork,
+        array $vector
+    ): void {
         if (! $vectors->isConfigured()) {
             return;
         }
 
         try {
-            $vectors->upsertArtwork($artwork);
+            $vectors->upsertArtworkVector(
+                $artwork,
+                $vector
+            );
         } catch (\Throwable $e) {
             Log::warning('GenerateArtworkEmbeddingJob vector upsert failed', [
                 'artwork_id' => (int) $artwork->id,
@@ -146,6 +210,94 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
         }
     }
 
+    private function vectorIndexCoversEmbedding(
+        Artwork $artwork,
+        ArtworkEmbedding $embedding
+    ): bool {
+        $indexedAt = $artwork->last_vector_indexed_at;
+        $generatedAt = $embedding->generated_at;
+
+        if ($indexedAt === null || $generatedAt === null) {
+            return false;
+        }
+
+        return $indexedAt->greaterThanOrEqualTo(
+            $generatedAt
+        );
+    }
+
+    /**
+     * @return array<int, float>
+     */
+    private function decodeStoredVector(
+        ArtworkEmbedding $embedding
+    ): array {
+        try {
+            $decoded = json_decode(
+                (string) $embedding->embedding_json,
+                true,
+                512,
+                JSON_THROW_ON_ERROR
+            );
+        } catch (\Throwable) {
+            return [];
+        }
+
+        if (! is_array($decoded) || $decoded === []) {
+            return [];
+        }
+
+        $vector = [];
+
+        foreach ($decoded as $value) {
+            if (! is_int($value) && ! is_float($value)) {
+                return [];
+            }
+
+            $value = (float) $value;
+
+            if (! is_finite($value)) {
+                return [];
+            }
+
+            $vector[] = $value;
+        }
+
+        $count = count($vector);
+
+        $minDim = max(
+            1,
+            (int) config(
+                'recommendations.embedding.min_dim',
+                64
+            )
+        );
+
+        $maxDim = max(
+            $minDim,
+            (int) config(
+                'recommendations.embedding.max_dim',
+                4096
+            )
+        );
+
+        if (
+            $count < $minDim
+            || $count > $maxDim
+        ) {
+            return [];
+        }
+
+        if (
+            (int) $embedding->dim > 0
+            && $count !== (int) $embedding->dim
+        ) {
+            return [];
+        }
+
+        return $vector;
+    }
+
     /**
      * @param  array<int, float>  $vector
      * @return array<int, float>
@@ -162,6 +314,7 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
         }
 
         $norm = sqrt($sumSquares);
+
         return array_map(static fn (float $value): float => $value / $norm, $vector);
     }
 
@@ -177,6 +330,7 @@ final class GenerateArtworkEmbeddingJob implements ShouldQueue
             if ($didSet) {
                 Redis::expire($key, 1800);
             }
+
             return (bool) $didSet;
         } catch (\Throwable) {
             return true;

app/Jobs/IngestUserDiscoveryEventJob.php

@@ -4,8 +4,8 @@ declare(strict_types=1);
 
 namespace App\Jobs;
 
-use App\Services\Recommendations\UserInterestProfileService;
 use App\Services\Recommendations\SessionRecoService;
+use App\Services\Recommendations\UserInterestProfileService;
 use Carbon\CarbonImmutable;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -40,8 +40,7 @@ final class IngestUserDiscoveryEventJob implements ShouldQueue
         public readonly string $algoVersion,
         public readonly string $occurredAt,
         public readonly array $meta = []
-    ) {
-    }
+    ) {}
 
     public function handle(UserInterestProfileService $profileService, SessionRecoService $sessionRecoService): void
     {
@@ -70,10 +69,9 @@ final class IngestUserDiscoveryEventJob implements ShouldQueue
             $eventVersion = (string) config('discovery.event_version', 'event-v1');
             $eventWeight = (float) ((array) config('discovery.weights', []))[$this->eventType] ?? 1.0;
 
-            $categoryId = DB::table('artwork_category')
-                ->where('artwork_id', $this->artworkId)
-                ->orderBy('category_id')
-                ->value('category_id');
+            $categoryId = DB::table('artworks')
+                ->where('id', $this->artworkId)
+                ->value('primary_category_id');
 
             $insertPayload = [
                 'event_id' => $this->eventId,

app/Jobs/SyncAdsenseJob.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Jobs;
+
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\AdsenseSyncService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Carbon;
+
+final class SyncAdsenseJob implements ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 180;
+
+    public int $uniqueFor = 600;
+
+    public function __construct(
+        public readonly int $connectionId,
+        public readonly string $from,
+        public readonly string $to,
+        public readonly bool $entitiesOnly = false,
+    ) {}
+
+    public function uniqueId(): string
+    {
+        return (string) $this->connectionId;
+    }
+
+    public function handle(AdsenseSyncService $sync): void
+    {
+        $connection = AdsenseConnection::query()->find($this->connectionId);
+        if ($connection === null || ! $connection->hasRefreshToken()) {
+            return;
+        }
+
+        $sync->sync(
+            $connection,
+            Carbon::parse($this->from)->startOfDay(),
+            Carbon::parse($this->to)->startOfDay(),
+            $this->entitiesOnly,
+        );
+    }
+}

app/Models/AdsenseConnection.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+final class AdsenseConnection extends Model
+{
+    public const STATUS_PENDING = 'pending';
+
+    public const STATUS_CONNECTED = 'connected';
+
+    public const STATUS_RECONNECT_REQUIRED = 'reconnect_required';
+
+    public const STATUS_ERROR = 'error';
+
+    public const STATUS_DISCONNECTED = 'disconnected';
+
+    protected $fillable = [
+        'account_resource_name',
+        'account_display_name',
+        'encrypted_refresh_token',
+        'status',
+        'connected_by_user_id',
+        'connected_at',
+        'last_sync_attempt_at',
+        'last_successful_sync_at',
+        'last_error',
+    ];
+
+    protected $hidden = [
+        'encrypted_refresh_token',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'encrypted_refresh_token' => 'encrypted',
+            'connected_at' => 'datetime',
+            'last_sync_attempt_at' => 'datetime',
+            'last_successful_sync_at' => 'datetime',
+        ];
+    }
+
+    public function connectedBy(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'connected_by_user_id');
+    }
+
+    public static function current(): ?self
+    {
+        return self::query()->latest('id')->first();
+    }
+
+    public function hasRefreshToken(): bool
+    {
+        return filled($this->encrypted_refresh_token);
+    }
+
+    public function isConnected(): bool
+    {
+        return $this->status === self::STATUS_CONNECTED && $this->hasRefreshToken();
+    }
+
+    public function needsReconnect(): bool
+    {
+        return $this->status === self::STATUS_RECONNECT_REQUIRED || (
+            in_array($this->status, [self::STATUS_PENDING, self::STATUS_CONNECTED, self::STATUS_ERROR], true)
+            && ! $this->hasRefreshToken()
+        );
+    }
+
+    public function isDisconnected(): bool
+    {
+        return $this->status === self::STATUS_DISCONNECTED || ! $this->hasRefreshToken();
+    }
+}

app/Models/AdsenseDailyStat.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+final class AdsenseDailyStat extends Model
+{
+    public const DIMENSION_TOTAL = 'total';
+
+    public const DIMENSION_AD_UNIT = 'ad_unit';
+
+    public const DIMENSION_CUSTOM_CHANNEL = 'custom_channel';
+
+    public const DIMENSION_PLATFORM = 'platform';
+
+    public const DIMENSION_COUNTRY = 'country';
+
+    public const TOTAL_DIMENSION_KEY = '__total__';
+
+    protected $fillable = [
+        'date',
+        'account_resource_name',
+        'dimension_type',
+        'dimension_key',
+        'dimension_label',
+        'currency_code',
+        'page_views',
+        'ad_requests',
+        'matched_ad_requests',
+        'impressions',
+        'clicks',
+        'estimated_earnings',
+        'page_views_ctr',
+        'page_views_rpm',
+        'ad_requests_coverage',
+        'ad_requests_ctr',
+        'ad_requests_rpm',
+        'impressions_ctr',
+        'impressions_rpm',
+        'cost_per_click',
+        'last_synced_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'date' => 'date',
+            'page_views' => 'integer',
+            'ad_requests' => 'integer',
+            'matched_ad_requests' => 'integer',
+            'impressions' => 'integer',
+            'clicks' => 'integer',
+            'estimated_earnings' => 'decimal:6',
+            'page_views_ctr' => 'decimal:8',
+            'page_views_rpm' => 'decimal:6',
+            'ad_requests_coverage' => 'decimal:8',
+            'ad_requests_ctr' => 'decimal:8',
+            'ad_requests_rpm' => 'decimal:6',
+            'impressions_ctr' => 'decimal:8',
+            'impressions_rpm' => 'decimal:6',
+            'cost_per_click' => 'decimal:6',
+            'last_synced_at' => 'datetime',
+        ];
+    }
+}

app/Models/AdsenseEntity.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+final class AdsenseEntity extends Model
+{
+    public const TYPE_AD_UNIT = 'ad_unit';
+
+    public const TYPE_CUSTOM_CHANNEL = 'custom_channel';
+
+    protected $fillable = [
+        'account_resource_name',
+        'ad_client_resource_name',
+        'type',
+        'resource_name',
+        'reporting_dimension_id',
+        'display_name',
+        'active',
+        'last_seen_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'active' => 'boolean',
+            'last_seen_at' => 'datetime',
+        ];
+    }
+}

app/Models/Artwork.php

@@ -66,6 +66,9 @@ class Artwork extends Model
         'description',
         'file_name',
         'file_path',
+        'download_status',
+        'download_source',
+        'download_checked_at',
         'hash',
         'file_ext',
         'thumb_ext',
@@ -81,6 +84,10 @@ class Artwork extends Model
         'is_public',
         'visibility',
         'is_approved',
+        'approval_source',
+        'moderated_at',
+        'moderated_by',
+        'moderation_note',
         'is_mature',
         'maturity_level',
         'maturity_source',
@@ -117,6 +124,7 @@ class Artwork extends Model
         'description_source',
         'tags_source',
         'category_source',
+        'primary_category_id',
         // Versioning
         'current_version_id',
         'version_count',
@@ -132,6 +140,7 @@ class Artwork extends Model
         'is_public' => 'boolean',
         'visibility' => 'string',
         'is_approved' => 'boolean',
+        'moderated_at' => 'datetime',
         'is_mature' => 'boolean',
         'maturity_level' => 'string',
         'maturity_source' => 'string',
@@ -171,6 +180,7 @@ class Artwork extends Model
         'category_source' => 'string',
         'version_updated_at' => 'datetime',
         'requires_reapproval' => 'boolean',
+        'download_checked_at' => 'datetime',
     ];
 
     /**
@@ -449,6 +459,32 @@ class Artwork extends Model
         return $this->belongsToMany(Category::class, 'artwork_category', 'artwork_id', 'category_id');
     }
 
+    public function primaryCategory(): BelongsTo
+    {
+        return $this->belongsTo(Category::class, 'primary_category_id');
+    }
+
+    public function resolvedPrimaryCategory(): ?Category
+    {
+        if ($this->relationLoaded('primaryCategory') && $this->getRelation('primaryCategory') instanceof Category) {
+            return $this->getRelation('primaryCategory');
+        }
+
+        $primaryId = $this->primary_category_id !== null ? (int) $this->primary_category_id : 0;
+        if ($primaryId > 0 && $this->relationLoaded('categories')) {
+            $match = $this->categories->firstWhere('id', $primaryId);
+            if ($match instanceof Category) {
+                return $match;
+            }
+        }
+
+        if ($primaryId > 0) {
+            return $this->primaryCategory;
+        }
+
+        return null;
+    }
+
     public function collections(): BelongsToMany
     {
         return $this->belongsToMany(Collection::class, 'collection_artwork', 'artwork_id', 'collection_id')
@@ -559,19 +595,25 @@ class Artwork extends Model
      */
     public function toSearchableArray(): array
     {
-        $this->loadMissing(['user', 'group', 'tags', 'categories.contentType', 'stats', 'awardStat']);
+        $this->loadMissing(['user', 'group', 'tags', 'categories.contentType', 'primaryCategory.contentType', 'stats', 'awardStat']);
 
         $stat = $this->stats;
         $awardStat = $this->awardStat;
         $publishedSortAt = $this->published_at ?? $this->created_at;
-        $sortedCategories = $this->categories->sortBy(
-            fn ($category) => sprintf(
-                '%010d|%s|%010d',
+        $primaryCategory = $this->resolvedPrimaryCategory();
+        $sortedCategories = $this->categories
+            ->sortBy(function ($category) use ($primaryCategory) {
+                $isPrimary = $primaryCategory && (int) $category->id === (int) $primaryCategory->id;
+
+                return sprintf(
+                    '%d|%010d|%s|%010d',
+                    $isPrimary ? 0 : 1,
                     (int) ($category->sort_order ?? 999999999),
                     strtolower((string) ($category->name ?? '')),
                     (int) ($category->id ?? 0)
-            )
-        )->values();
+                );
+            })
+            ->values();
 
         // Orientation derived from pixel dimensions
         $orientation = 'square';
@@ -588,8 +630,6 @@ class Artwork extends Model
             ? $this->width.'x'.$this->height
             : '';
 
-        // Primary category slug follows the same sort_order-first semantics used by page presenters.
-        $primaryCategory = $sortedCategories->first();
         $categorySlugs = $sortedCategories
             ->pluck('slug')
             ->filter()
@@ -619,6 +659,13 @@ class Artwork extends Model
             'author_name' => $this->group?->name ?? $this->user?->name ?? 'Skinbase',
             'published_as_type' => $this->publishedAsType(),
             'category' => $category,
+            'primary_category_id' => $primaryCategory?->id ? (int) $primaryCategory->id : null,
+            'category_ids' => $this->categories
+                ->pluck('id')
+                ->map(static fn ($id): int => (int) $id)
+                ->unique()
+                ->values()
+                ->all(),
             'categories' => $categorySlugs,
             'content_type' => $content_type,
             'content_types' => $contentTypeSlugs,

app/Models/ArtworkAward.php

@@ -4,9 +4,12 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Observers\ArtworkAwardObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
+#[ObservedBy([ArtworkAwardObserver::class])]
 class ArtworkAward extends Model
 {
     protected $table = 'artwork_medals';

app/Models/ArtworkComment.php

@@ -1,11 +1,16 @@
 <?php
+
 namespace App\Models;
 
+use App\Observers\ArtworkCommentObserver;
+use App\Services\ContentSanitizer;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * App\Models\ArtworkComment
@@ -19,8 +24,9 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
  * @property bool $is_approved
  * @property-read Artwork $artwork
  * @property-read User    $user
- * @property-read \Illuminate\Database\Eloquent\Collection|CommentReaction[] $reactions
+ * @property-read Collection|CommentReaction[] $reactions
  */
+#[ObservedBy([ArtworkCommentObserver::class])]
 class ArtworkComment extends Model
 {
     use HasFactory, SoftDeletes;
@@ -36,10 +42,18 @@ class ArtworkComment extends Model
         'raw_content',
         'rendered_content',
         'is_approved',
+        'spam_score',
+        'spam_probability',
+        'spam_reason',
+        'moderation_source',
+        'moderated_at',
     ];
 
     protected $casts = [
         'is_approved' => 'boolean',
+        'spam_score' => 'integer',
+        'spam_probability' => 'integer',
+        'moderated_at' => 'datetime',
     ];
 
     public function artwork(): BelongsTo
@@ -90,6 +104,7 @@ class ArtworkComment extends Model
 
         // Lazy render: raw_content takes priority over legacy content
         $raw = $this->raw_content ?? $this->content ?? '';
-		return \App\Services\ContentSanitizer::render($raw);
+
+        return ContentSanitizer::render($raw);
     }
 }

app/Models/ArtworkFavourite.php

@@ -2,6 +2,9 @@
 
 namespace App\Models;
 
+use App\Observers\ArtworkFavouriteObserver;
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
@@ -12,12 +15,12 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
  * @property int $user_id
  * @property int $artwork_id
  * @property int|null $legacy_id Original favourite_id from the old site
- * @property \Carbon\Carbon $created_at
- * @property \Carbon\Carbon $updated_at
- *
+ * @property Carbon $created_at
+ * @property Carbon $updated_at
  * @property-read User    $user
  * @property-read Artwork $artwork
  */
+#[ObservedBy([ArtworkFavouriteObserver::class])]
 class ArtworkFavourite extends Model
 {
     protected $table = 'artwork_favourites';

app/Models/ArtworkFeature.php

@@ -1,10 +1,14 @@
 <?php
+
 namespace App\Models;
 
+use App\Observers\ArtworkFeatureObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
+#[ObservedBy([ArtworkFeatureObserver::class])]
 class ArtworkFeature extends Model
 {
     use SoftDeletes;

app/Models/ArtworkReaction.php

@@ -2,6 +2,8 @@
 
 namespace App\Models;
 
+use App\Observers\ArtworkReactionObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
@@ -11,6 +13,7 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
  * @property int $user_id
  * @property string $reaction ReactionType slug (e.g. thumbs_up, heart, fire…)
  */
+#[ObservedBy([ArtworkReactionObserver::class])]
 class ArtworkReaction extends Model
 {
     public $timestamps = false;

app/Models/CommentSpamSignature.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class CommentSpamSignature extends Model
+{
+    public $timestamps = false;
+
+    protected $fillable = [
+        'content_hash', 'pattern_signature', 'source', 'reason',
+        'confidence', 'hit_count', 'reviewed_by', 'metadata', 'created_at',
+    ];
+
+    protected $casts = [
+        'confidence' => 'integer',
+        'hit_count' => 'integer',
+        'metadata' => 'array',
+        'created_at' => 'datetime',
+    ];
+}

app/Models/ContentType.php

@@ -2,12 +2,13 @@
 
 namespace App\Models;
 
+use App\Observers\ContentTypeObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
+use Illuminate\Database\Eloquent\Builder as EloquentBuilder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Builder as EloquentBuilder;
-
-use App\Models\Artwork;
 
+#[ObservedBy([ContentTypeObserver::class])]
 class ContentType extends Model
 {
     protected $fillable = ['name', 'slug', 'description', 'order', 'hide_from_menu', 'mascot_path', 'cover_art_path'];

app/Models/GroupRelease.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Observers\GroupReleaseObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -11,29 +13,44 @@ use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
+#[ObservedBy([GroupReleaseObserver::class])]
 class GroupRelease extends Model
 {
     use HasFactory;
     use SoftDeletes;
 
     public const STATUS_PLANNED = 'planned';
+
     public const STATUS_IN_PROGRESS = 'in_progress';
+
     public const STATUS_INTERNAL_REVIEW = 'internal_review';
+
     public const STATUS_SCHEDULED = 'scheduled';
+
     public const STATUS_RELEASED = 'released';
+
     public const STATUS_ARCHIVED = 'archived';
+
     public const STATUS_CANCELLED = 'cancelled';
 
     public const STAGE_CONCEPT = 'concept';
+
     public const STAGE_PRODUCTION = 'production';
+
     public const STAGE_REVIEW = 'review';
+
     public const STAGE_PACKAGING = 'packaging';
+
     public const STAGE_APPROVAL = 'approval';
+
     public const STAGE_PUBLISHING = 'publishing';
+
     public const STAGE_RELEASED = 'released';
 
     public const VISIBILITY_PUBLIC = 'public';
+
     public const VISIBILITY_UNLISTED = 'unlisted';
+
     public const VISIBILITY_PRIVATE = 'private';
 
     protected $fillable = [

app/Models/GroupReleaseContributor.php

@@ -4,10 +4,13 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Observers\GroupReleaseContributorObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
+#[ObservedBy([GroupReleaseContributorObserver::class])]
 class GroupReleaseContributor extends Model
 {
     use HasFactory;

app/Models/HomepageAnnouncement.php

@@ -4,48 +4,75 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use App\Observers\HomepageAnnouncementObserver;
+use Illuminate\Database\Eloquent\Attributes\ObservedBy;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Carbon;
 
+#[ObservedBy([HomepageAnnouncementObserver::class])]
 class HomepageAnnouncement extends Model
 {
     use SoftDeletes;
 
     public const STATUS_DRAFT = 'draft';
+
     public const STATUS_PUBLISHED = 'published';
+
     public const STATUS_ARCHIVED = 'archived';
 
     public const TYPE_ANNOUNCEMENT = 'announcement';
+
     public const TYPE_LAUNCH = 'launch';
+
     public const TYPE_NEWS = 'news';
+
     public const TYPE_WORLD = 'world';
+
     public const TYPE_EVENT = 'event';
+
     public const TYPE_NOTICE = 'notice';
+
     public const TYPE_MAINTENANCE = 'maintenance';
 
     public const PLACEMENT_HOMEPAGE_AFTER_FEATURED = 'homepage_after_featured';
 
     public const LINK_TYPE_NONE = 'none';
+
     public const LINK_TYPE_CUSTOM_URL = 'custom_url';
+
     public const LINK_TYPE_NEWS = 'news';
+
     public const LINK_TYPE_WORLD = 'world';
+
     public const LINK_TYPE_ARTWORK = 'artwork';
+
     public const LINK_TYPE_COLLECTION = 'collection';
+
     public const LINK_TYPE_GROUP = 'group';
+
     public const LINK_TYPE_PROFILE = 'profile';
+
     public const LINK_TYPE_EXPLORE = 'explore';
+
     public const LINK_TYPE_UPLOAD = 'upload';
 
     public const GRADIENT_NOVA_AURORA = 'nova_aurora';
+
     public const GRADIENT_DEEP_SPACE = 'deep_space';
+
     public const GRADIENT_SUNRISE = 'sunrise';
+
     public const GRADIENT_OCEAN_GLOW = 'ocean_glow';
+
     public const GRADIENT_SPRING_VIBES = 'spring_vibes';
+
     public const GRADIENT_FANTASY_REALMS = 'fantasy_realms';
+
     public const GRADIENT_MINIMAL_LIGHT = 'minimal_light';
+
     public const GRADIENT_DARK_GLASS = 'dark_glass';
 
     protected $table = 'homepage_announcements';

app/Models/Upload.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class Upload extends Model
 {
@@ -23,6 +24,7 @@ class Upload extends Model
         'title',
         'slug',
         'category_id',
+        'secondary_category_ids',
         'description',
         'tags',
         'license',
@@ -41,6 +43,7 @@ class Upload extends Model
 
     protected $casts = [
         'tags' => 'array',
+        'secondary_category_ids' => 'array',
         'nsfw' => 'boolean',
         'is_scanned' => 'boolean',
         'has_tags' => 'boolean',
@@ -48,4 +51,14 @@ class Upload extends Model
         'expires_at' => 'datetime',
         'moderated_at' => 'datetime',
     ];
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function category(): BelongsTo
+    {
+        return $this->belongsTo(Category::class);
+    }
 }

app/Notifications/NewArtworkReviewNotification.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Notifications;
+
+use App\Models\Artwork;
+use App\Models\User;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+final class NewArtworkReviewNotification extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public function __construct(
+        private readonly Artwork $artwork,
+        private readonly User $uploader,
+        private readonly array $reasons,
+    ) {}
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject('Skinbase: new artwork awaiting review')
+            ->greeting('New artwork review')
+            ->line(sprintf('“%s” by %s is being held before publication.', $this->artwork->title ?: 'Untitled artwork', $this->uploader->username ?: $this->uploader->name))
+            ->line('Reasons: '.implode(', ', $this->reasons))
+            ->action('Open moderation queue', url('/moderation/uploads'))
+            ->line('The artwork is not public until it is approved.');
+    }
+}

app/Providers/AppServiceProvider.php

@@ -3,53 +3,59 @@
 namespace App\Providers;
 
 use App\Contracts\Images\SubjectDetectorInterface;
-use Illuminate\Cache\RateLimiting\Limit;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\RateLimiter;
-use Illuminate\Support\ServiceProvider;
+use App\Contracts\Moderation\CommentSpamClassifier;
+use App\Events\Achievements\AchievementCheckRequested;
+use App\Events\Achievements\UserXpUpdated;
+use App\Events\Posts\ArtworkShared;
+use App\Events\Posts\PostCommented;
+use App\Http\Middleware\ConditionalCors;
+use App\Listeners\Academy\HandleAcademyStripeWebhook;
+use App\Listeners\Academy\HandleAcademyStripeWebhookHandled;
+use App\Listeners\Achievements\CheckUserAchievements;
+use App\Listeners\Posts\AwardXpForPostCommented;
+use App\Listeners\Posts\SendArtworkSharedNotification;
+use App\Listeners\Posts\SendPostCommentedNotification;
 use App\Models\Artwork;
-use App\Models\ArtworkAward;
-use App\Models\ArtworkComment;
-use App\Models\ArtworkFeature;
-use App\Models\ArtworkFavourite;
-use App\Models\ArtworkMedal;
-use App\Models\ArtworkReaction;
 use App\Models\ContentType;
-use App\Models\GroupRelease;
-use App\Models\GroupReleaseContributor;
-use App\Models\HomepageAnnouncement;
-use App\Observers\ArtworkAwardObserver;
-use App\Observers\ArtworkCommentObserver;
-use App\Observers\ArtworkFeatureObserver;
-use App\Observers\ArtworkFavouriteObserver;
 use App\Observers\ArtworkObserver;
-use App\Observers\ArtworkReactionObserver;
-use App\Observers\ContentTypeObserver;
-use App\Observers\GroupReleaseContributorObserver;
-use App\Observers\GroupReleaseObserver;
-use App\Observers\HomepageAnnouncementObserver;
-use App\Services\Upload\Contracts\UploadDraftServiceInterface;
-use App\Services\Upload\UploadDraftService;
 use App\Services\ContentTypes\ContentTypeSlugResolver;
-use App\Services\Worlds\WorldService;
-use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\View;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Event;
-use Illuminate\Support\Facades\Log;
-use Illuminate\Queue\Events\JobFailed;
-use App\Services\ReceivedCommentsInboxService;
+use App\Services\Countries\CountryRemoteProvider;
+use App\Services\Countries\CountryRemoteProviderInterface;
+use App\Services\EarlyGrowth\SpotlightEngine;
+use App\Services\EarlyGrowth\SpotlightEngineInterface;
 use App\Services\Images\Detectors\ChainedSubjectDetector;
 use App\Services\Images\Detectors\HeuristicSubjectDetector;
 use App\Services\Images\Detectors\NullSubjectDetector;
 use App\Services\Images\Detectors\VisionSubjectDetector;
+use App\Services\Moderation\TogetherCommentSpamClassifier;
+use App\Services\ReceivedCommentsInboxService;
+use App\Services\Recommendations\VectorSimilarity\VectorAdapterFactory;
+use App\Services\Recommendations\VectorSimilarity\VectorAdapterInterface;
+use App\Services\Upload\Contracts\UploadDraftServiceInterface;
+use App\Services\Upload\UploadDraftService;
+use App\Services\Worlds\WorldService;
+use App\Support\Http\TimedInertiaSsrGateway;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Contracts\Http\Kernel;
+use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Middleware\HandleCors;
+use Illuminate\Http\Request;
+use Illuminate\Queue\Events\JobFailed;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\View\Factory;
+use Inertia\Ssr\Gateway;
 use Klevze\ControlPanel\Framework\Core\Menu;
 use Laravel\Cashier\Events\WebhookHandled;
 use Laravel\Cashier\Events\WebhookReceived;
-use App\Listeners\Academy\HandleAcademyStripeWebhook;
-use App\Listeners\Academy\HandleAcademyStripeWebhookHandled;
+use Meilisearch\Client;
+use SocialiteProviders\Discord\DiscordExtendSocialite;
+use SocialiteProviders\Manager\SocialiteWasCalled;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -58,14 +64,18 @@ class AppServiceProvider extends ServiceProvider
      */
     public function register(): void
     {
+        $this->app->bind(CommentSpamClassifier::class, function ($app) {
+            return $app->make(TogetherCommentSpamClassifier::class);
+        });
+
         $this->app->bind(
-            \Inertia\Ssr\Gateway::class,
-            \App\Support\Http\TimedInertiaSsrGateway::class,
+            Gateway::class,
+            TimedInertiaSsrGateway::class,
         );
 
         $this->app->singleton(
-            \App\Services\Countries\CountryRemoteProviderInterface::class,
-            \App\Services\Countries\CountryRemoteProvider::class,
+            CountryRemoteProviderInterface::class,
+            CountryRemoteProvider::class,
         );
 
         // Bind UploadDraftService interface to implementation
@@ -75,14 +85,14 @@ class AppServiceProvider extends ServiceProvider
 
         // Bind vector adapter interface for similarity system (resolves via factory)
         $this->app->bind(
-            \App\Services\Recommendations\VectorSimilarity\VectorAdapterInterface::class,
-            fn () => \App\Services\Recommendations\VectorSimilarity\VectorAdapterFactory::make(),
+            VectorAdapterInterface::class,
+            fn () => VectorAdapterFactory::make(),
         );
 
         // EGS: bind SpotlightEngineInterface to the concrete SpotlightEngine
         $this->app->singleton(
-            \App\Services\EarlyGrowth\SpotlightEngineInterface::class,
-            \App\Services\EarlyGrowth\SpotlightEngine::class,
+            SpotlightEngineInterface::class,
+            SpotlightEngine::class,
         );
 
         $this->app->singleton(SubjectDetectorInterface::class, function ($app) {
@@ -97,7 +107,7 @@ class AppServiceProvider extends ServiceProvider
         // with no HTTP timeout, so a slow/overloaded Meilisearch leaves PHP-FPM
         // workers blocked forever in curl_exec(), draining the whole pool under
         // a search traffic spike. Fail fast instead.
-        $this->app->singleton(\Meilisearch\Client::class, function ($app) {
+        $this->app->singleton(Client::class, function ($app) {
             $config = $app['config']->get('scout.meilisearch');
 
             $httpClient = new \GuzzleHttp\Client([
@@ -105,7 +115,7 @@ class AppServiceProvider extends ServiceProvider
                 'timeout' => 5,
             ]);
 
-            return new \Meilisearch\Client($config['host'], $config['key'], $httpClient);
+            return new Client($config['host'], $config['key'], $httpClient);
         });
     }
 
@@ -119,12 +129,29 @@ class AppServiceProvider extends ServiceProvider
         // Map the 'legacy' view namespace to resources/views/_legacy so all
         // view('legacy::foo') and @include('legacy::foo') calls resolve correctly
         // after the folder was renamed from legacy/ to _legacy/.
-        View::addNamespace('legacy', resource_path('views/_legacy'));
+        $legacyViewPath = resource_path('views/_legacy');
+        $registerLegacyViewNamespace = static function (Factory $view) use ($legacyViewPath): void {
+            $view->addNamespace('legacy', $legacyViewPath);
+        };
+
+        if ($this->app->resolved('view')) {
+            $registerLegacyViewNamespace($this->app->make('view'));
+        } else {
+            $this->app->afterResolving('view', $registerLegacyViewNamespace);
+        }
 
         $exceptionRendererComponentsPath = base_path('vendor/laravel/framework/src/Illuminate/Foundation/resources/exceptions/renderer/components');
 
+        $registerExceptionRendererComponents = static function ($compiler) use ($exceptionRendererComponentsPath): void {
             if (is_dir($exceptionRendererComponentsPath)) {
-            Blade::anonymousComponentNamespace($exceptionRendererComponentsPath, 'laravel-exceptions-renderer');
+                $compiler->anonymousComponentNamespace($exceptionRendererComponentsPath, 'laravel-exceptions-renderer');
+            }
+        };
+
+        if ($this->app->resolved('blade.compiler')) {
+            $registerExceptionRendererComponents($this->app->make('blade.compiler'));
+        } else {
+            $this->app->afterResolving('blade.compiler', $registerExceptionRendererComponents);
         }
 
         $this->configureAuthRateLimiters();
@@ -140,45 +167,35 @@ class AppServiceProvider extends ServiceProvider
         $this->configureSettingsRateLimiters();
         $this->configureMailFailureLogging();
 
-        ArtworkAward::observe(ArtworkAwardObserver::class);
-        ArtworkMedal::observe(ArtworkAwardObserver::class);
         Artwork::observe(ArtworkObserver::class);
-        ArtworkFeature::observe(ArtworkFeatureObserver::class);
-        ArtworkFavourite::observe(ArtworkFavouriteObserver::class);
-        ArtworkComment::observe(ArtworkCommentObserver::class);
-        ArtworkReaction::observe(ArtworkReactionObserver::class);
-        ContentType::observe(ContentTypeObserver::class);
-        GroupRelease::observe(GroupReleaseObserver::class);
-        GroupReleaseContributor::observe(GroupReleaseContributorObserver::class);
-        HomepageAnnouncement::observe(HomepageAnnouncementObserver::class);
 
         // ── OAuth / SocialiteProviders ──────────────────────────────────────
         Event::listen(
-            \SocialiteProviders\Manager\SocialiteWasCalled::class,
-            \SocialiteProviders\Discord\DiscordExtendSocialite::class,
+            SocialiteWasCalled::class,
+            DiscordExtendSocialite::class,
         );
         // Apple provider removed — no listener registered
 
         // ── Posts / Feed System Events ──────────────────────────────────────
         Event::listen(
-            \App\Events\Posts\ArtworkShared::class,
-            \App\Listeners\Posts\SendArtworkSharedNotification::class,
+            ArtworkShared::class,
+            SendArtworkSharedNotification::class,
         );
         Event::listen(
-            \App\Events\Posts\PostCommented::class,
-            \App\Listeners\Posts\SendPostCommentedNotification::class,
+            PostCommented::class,
+            SendPostCommentedNotification::class,
         );
         Event::listen(
-            \App\Events\Posts\PostCommented::class,
-            \App\Listeners\Posts\AwardXpForPostCommented::class,
+            PostCommented::class,
+            AwardXpForPostCommented::class,
         );
         Event::listen(
-            \App\Events\Achievements\AchievementCheckRequested::class,
-            \App\Listeners\Achievements\CheckUserAchievements::class,
+            AchievementCheckRequested::class,
+            CheckUserAchievements::class,
         );
         Event::listen(
-            \App\Events\Achievements\UserXpUpdated::class,
-            \App\Listeners\Achievements\CheckUserAchievements::class,
+            UserXpUpdated::class,
+            CheckUserAchievements::class,
         );
         Event::listen(
             WebhookReceived::class,
@@ -190,7 +207,8 @@ class AppServiceProvider extends ServiceProvider
         );
 
         // Provide toolbar counts and user info to layout views (port of legacy toolbar logic)
-        View::composer(['layouts.nova', 'layouts.nova.*'], function ($view) {
+        $registerNovaLayoutComposer = function (Factory $factory): void {
+            $factory->composer(['layouts.nova', 'layouts.nova.*'], function ($view) {
                 $uploadCount = $favCount = $msgCount = $noticeCount = $receivedCommentsCount = 0;
                 $avatarHash = null;
                 $displayName = null;
@@ -198,7 +216,7 @@ class AppServiceProvider extends ServiceProvider
                 $toolbarContentTypes = collect();
                 $toolbarActiveCampaign = null;
                 $request = request();
-            $canReadSessionAuth = $request instanceof \Illuminate\Http\Request
+                $canReadSessionAuth = $request instanceof Request
                     && $request->hasSession()
                     && $request->attributes->get('skinbase.session_skipped') !== true;
                 $authUser = $canReadSessionAuth ? Auth::user() : null;
@@ -301,19 +319,26 @@ class AppServiceProvider extends ServiceProvider
 
                 $view->with(compact('userId', 'uploadCount', 'favCount', 'msgCount', 'noticeCount', 'receivedCommentsCount', 'avatarHash', 'displayName', 'toolbarContentTypes', 'toolbarActiveCampaign'));
             });
+        };
+
+        if ($this->app->resolved('view')) {
+            $registerNovaLayoutComposer($this->app->make('view'));
+        } else {
+            $this->app->afterResolving('view', $registerNovaLayoutComposer);
+        }
 
         // Replace the framework HandleCors with our ConditionalCors so the
         // CP_ENABLE_CORS / config('cors.paths') toggle takes effect.
         try {
-            $middlewareConfig = $this->app->make(\Illuminate\Foundation\Configuration\Middleware::class);
+            $middlewareConfig = $this->app->make(Middleware::class);
             $middlewareConfig->replace(
-                \Illuminate\Http\Middleware\HandleCors::class,
-                \App\Http\Middleware\ConditionalCors::class
+                HandleCors::class,
+                ConditionalCors::class
             );
         } catch (\Throwable $_) {
             // Fallback: push to kernel if replace isn't available in this app instance
-            $this->app->make(\Illuminate\Contracts\Http\Kernel::class)
-                ->pushMiddleware(\App\Http\Middleware\ConditionalCors::class);
+            $this->app->make(Kernel::class)
+                ->pushMiddleware(ConditionalCors::class);
         }
     }
 

app/Providers/LazyCarbonServiceProvider.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Providers;
+
+use Carbon\Carbon;
+use Carbon\CarbonImmutable;
+use Carbon\CarbonInterval;
+use Carbon\CarbonPeriod;
+use Illuminate\Contracts\Events\Dispatcher as DispatcherContract;
+use Illuminate\Foundation\Events\LocaleUpdated;
+use Illuminate\Support\Carbon as IlluminateCarbon;
+use Illuminate\Support\Facades\Date;
+use Illuminate\Support\ServiceProvider;
+use Throwable;
+
+final class LazyCarbonServiceProvider extends ServiceProvider
+{
+    private bool $localeListenerRegistered = false;
+
+    public function register(): void
+    {
+        $registerListener = function (DispatcherContract $events): void {
+            if ($this->localeListenerRegistered) {
+                return;
+            }
+
+            $this->localeListenerRegistered = true;
+
+            $events->listen(
+                LocaleUpdated::class,
+                function (LocaleUpdated $event): void {
+                    $this->synchronizeCarbonLocale($event->locale);
+                }
+            );
+        };
+
+        if ($this->app->resolved('events')) {
+            $registerListener(
+                $this->app->make('events')
+            );
+
+            return;
+        }
+
+        $this->app->afterResolving(
+            'events',
+            $registerListener
+        );
+    }
+
+    private function synchronizeCarbonLocale(string $locale): void
+    {
+        $fallback = (string) $this->app['config']->get(
+            'app.fallback_locale',
+            'en'
+        );
+
+        Carbon::setLocale($locale);
+        CarbonImmutable::setLocale($locale);
+        CarbonPeriod::setLocale($locale);
+        CarbonInterval::setLocale($locale);
+
+        Carbon::setFallbackLocale($fallback);
+        CarbonImmutable::setFallbackLocale($fallback);
+        CarbonPeriod::setFallbackLocale($fallback);
+        CarbonInterval::setFallbackLocale($fallback);
+
+        IlluminateCarbon::setLocale($locale);
+
+        if (
+            method_exists(
+                IlluminateCarbon::class,
+                'setFallbackLocale'
+            )
+        ) {
+            IlluminateCarbon::setFallbackLocale($fallback);
+        }
+
+        try {
+            $date = Date::getFacadeRoot();
+
+            if ($date && method_exists($date, 'setLocale')) {
+                $date->setLocale($locale);
+            }
+
+            if (
+                $date &&
+                method_exists($date, 'setFallbackLocale')
+            ) {
+                $date->setFallbackLocale($fallback);
+            }
+        } catch (Throwable) {
+            // Preserve Carbon provider tolerance for custom Date drivers.
+        }
+    }
+}

app/Services/Adsense/AdsenseAnalyticsQueryService.php

@@ -0,0 +1,288 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+use App\Models\AdsenseConnection;
+use App\Models\AdsenseDailyStat;
+use App\Models\AdsenseEntity;
+use App\Models\Country;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Schema;
+
+final class AdsenseAnalyticsQueryService
+{
+    /**
+     * @return array{from: Carbon, to: Carbon, previous_from: Carbon, previous_to: Carbon, period: string}
+     */
+    public function resolveRange(?string $period, ?string $from, ?string $to): array
+    {
+        $period = $period ?: '30d';
+        $today = now()->startOfDay();
+
+        [$start, $end] = match ($period) {
+            'today' => [$today->copy(), $today->copy()],
+            'yesterday' => [$today->copy()->subDay(), $today->copy()->subDay()],
+            '7d' => [$today->copy()->subDays(6), $today->copy()],
+            'custom' => [
+                Carbon::parse($from ?: $today->copy()->subDays(29)->toDateString())->startOfDay(),
+                Carbon::parse($to ?: $today->toDateString())->startOfDay(),
+            ],
+            default => [$today->copy()->subDays(29), $today->copy()],
+        };
+
+        if ($end->lt($start)) {
+            [$start, $end] = [$end, $start];
+        }
+
+        $days = $start->diffInDays($end) + 1;
+        $previousEnd = $start->copy()->subDay();
+        $previousStart = $previousEnd->copy()->subDays($days - 1);
+
+        return [
+            'from' => $start,
+            'to' => $end,
+            'previous_from' => $previousStart,
+            'previous_to' => $previousEnd,
+            'period' => $period === 'custom' ? 'custom' : (in_array($period, ['today', 'yesterday', '7d', '30d'], true) ? $period : '30d'),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function dashboard(AdsenseConnection $connection, Carbon $from, Carbon $to, Carbon $previousFrom, Carbon $previousTo): array
+    {
+        $account = (string) $connection->account_resource_name;
+        $current = $this->totals($account, $from, $to);
+        $previous = $this->totals($account, $previousFrom, $previousTo);
+        $currency = $current['currency_code'] ?? $previous['currency_code'] ?? 'USD';
+
+        return [
+            'kpis' => [
+                $this->kpi('estimated_earnings', 'Estimated Earnings', $current['estimated_earnings'], $previous['estimated_earnings'], 'money', $currency),
+                $this->kpi('page_views', 'Page Views', $current['page_views'], $previous['page_views'], 'integer'),
+                $this->kpi('impressions', 'Ad Impressions', $current['impressions'], $previous['impressions'], 'integer'),
+                $this->kpi('clicks', 'Clicks', $current['clicks'], $previous['clicks'], 'integer'),
+                $this->kpi('page_views_ctr', 'Page CTR', $this->ratio($current['clicks'], $current['page_views']), $this->ratio($previous['clicks'], $previous['page_views']), 'percent'),
+                $this->kpi('page_views_rpm', 'Page RPM', $this->rpm($current['estimated_earnings'], $current['page_views']), $this->rpm($previous['estimated_earnings'], $previous['page_views']), 'money', $currency),
+                $this->kpi('ad_requests_coverage', 'Ad Request Coverage', $this->ratio($current['matched_ad_requests'], $current['ad_requests']), $this->ratio($previous['matched_ad_requests'], $previous['ad_requests']), 'percent'),
+                $this->kpi('cost_per_click', 'CPC', $this->cpc($current['estimated_earnings'], $current['clicks']), $this->cpc($previous['estimated_earnings'], $previous['clicks']), 'money', $currency),
+            ],
+            'chart' => $this->chart($account, $from, $to),
+            'placements' => $this->dimensionTable($account, AdsenseDailyStat::DIMENSION_AD_UNIT, $from, $to, $currency),
+            'platforms' => $this->dimensionTable($account, AdsenseDailyStat::DIMENSION_PLATFORM, $from, $to, $currency),
+            'countries' => array_slice($this->dimensionTable($account, AdsenseDailyStat::DIMENSION_COUNTRY, $from, $to, $currency), 0, 20),
+            'currency_code' => $currency,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function totals(string $account, Carbon $from, Carbon $to): array
+    {
+        $row = AdsenseDailyStat::query()
+            ->where('account_resource_name', $account)
+            ->where('dimension_type', AdsenseDailyStat::DIMENSION_TOTAL)
+            ->whereDate('date', '>=', $from->toDateString())
+            ->whereDate('date', '<=', $to->toDateString())
+            ->selectRaw('
+                SUM(page_views) as page_views,
+                SUM(ad_requests) as ad_requests,
+                SUM(matched_ad_requests) as matched_ad_requests,
+                SUM(impressions) as impressions,
+                SUM(clicks) as clicks,
+                SUM(estimated_earnings) as estimated_earnings,
+                MAX(currency_code) as currency_code
+            ')
+            ->first();
+
+        return [
+            'page_views' => (int) ($row?->page_views ?? 0),
+            'ad_requests' => (int) ($row?->ad_requests ?? 0),
+            'matched_ad_requests' => (int) ($row?->matched_ad_requests ?? 0),
+            'impressions' => (int) ($row?->impressions ?? 0),
+            'clicks' => (int) ($row?->clicks ?? 0),
+            'estimated_earnings' => (string) ($row?->estimated_earnings ?? '0'),
+            'currency_code' => $row?->currency_code,
+        ];
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function chart(string $account, Carbon $from, Carbon $to): array
+    {
+        $rows = AdsenseDailyStat::query()
+            ->where('account_resource_name', $account)
+            ->where('dimension_type', AdsenseDailyStat::DIMENSION_TOTAL)
+            ->whereDate('date', '>=', $from->toDateString())
+            ->whereDate('date', '<=', $to->toDateString())
+            ->orderBy('date')
+            ->get();
+
+        return $rows->map(function (AdsenseDailyStat $row): array {
+            return [
+                'date' => optional($row->date)?->toDateString(),
+                'estimated_earnings' => (float) $row->estimated_earnings,
+                'page_views' => (int) $row->page_views,
+                'page_views_rpm' => (float) $row->page_views_rpm,
+                'clicks' => (int) $row->clicks,
+            ];
+        })->values()->all();
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function dimensionTable(string $account, string $dimensionType, Carbon $from, Carbon $to, ?string $currency): array
+    {
+        $rows = AdsenseDailyStat::query()
+            ->where('account_resource_name', $account)
+            ->where('dimension_type', $dimensionType)
+            ->whereDate('date', '>=', $from->toDateString())
+            ->whereDate('date', '<=', $to->toDateString())
+            ->selectRaw('
+                dimension_key,
+                MAX(dimension_label) as dimension_label,
+                SUM(page_views) as page_views,
+                SUM(impressions) as impressions,
+                SUM(clicks) as clicks,
+                SUM(estimated_earnings) as estimated_earnings
+            ')
+            ->groupBy('dimension_key')
+            ->orderByDesc('estimated_earnings')
+            ->get();
+
+        $labels = $this->entityLabels($account, $dimensionType);
+        $countryNames = $dimensionType === AdsenseDailyStat::DIMENSION_COUNTRY ? $this->countryNames() : collect();
+
+        return $rows->map(function ($row) use ($labels, $countryNames, $currency, $dimensionType): array {
+            $key = (string) $row->dimension_key;
+            $label = (string) ($labels[$key] ?? $countryNames[$key] ?? $row->dimension_label ?? $key);
+            if ($dimensionType === AdsenseDailyStat::DIMENSION_PLATFORM) {
+                $label = $this->platformLabel($key, $label);
+            }
+
+            $pageViews = (int) $row->page_views;
+            $impressions = (int) $row->impressions;
+            $clicks = (int) $row->clicks;
+            $earnings = (string) ($row->estimated_earnings ?? '0');
+
+            return [
+                'key' => $key,
+                'label' => $label,
+                'page_views' => $pageViews,
+                'impressions' => $impressions,
+                'clicks' => $clicks,
+                'ctr' => $this->ratio($clicks, $pageViews),
+                'rpm' => $this->rpm($earnings, $pageViews),
+                'revenue' => $earnings,
+                'currency_code' => $currency,
+            ];
+        })->values()->all();
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function entityLabels(string $account, string $dimensionType): array
+    {
+        if (! in_array($dimensionType, [AdsenseDailyStat::DIMENSION_AD_UNIT, AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL], true)) {
+            return [];
+        }
+
+        return AdsenseEntity::query()
+            ->where('account_resource_name', $account)
+            ->where('type', $dimensionType)
+            ->pluck('display_name', 'reporting_dimension_id')
+            ->all();
+    }
+
+    /**
+     * @return Collection<string, string>
+     */
+    private function countryNames(): Collection
+    {
+        if (! Schema::hasTable('countries')) {
+            return collect();
+        }
+
+        return Country::query()
+            ->get(['iso2', 'name', 'name_common'])
+            ->mapWithKeys(function (Country $country): array {
+                $code = strtoupper((string) $country->iso2);
+                $name = (string) ($country->name_common ?: $country->name ?: $code);
+
+                return $code !== '' ? [$code => $name] : [];
+            });
+    }
+
+    private function platformLabel(string $key, string $fallback): string
+    {
+        return match (strtoupper($key)) {
+            'DESKTOP' => 'Desktop',
+            'HIGH_END_MOBILE', 'MOBILE' => 'Mobile',
+            'TABLET' => 'Tablet',
+            default => $fallback !== '' ? $fallback : $key,
+        };
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function kpi(string $key, string $label, mixed $current, mixed $previous, string $format, ?string $currency = null): array
+    {
+        return [
+            'key' => $key,
+            'label' => $label,
+            'value' => $current,
+            'previous' => $previous,
+            'change_percent' => $this->changePercent($current, $previous),
+            'format' => $format,
+            'currency_code' => $currency,
+        ];
+    }
+
+    private function changePercent(mixed $current, mixed $previous): ?float
+    {
+        $current = (float) $current;
+        $previous = (float) $previous;
+
+        if ($previous == 0.0) {
+            return null;
+        }
+
+        return (($current - $previous) / $previous) * 100;
+    }
+
+    private function ratio(int $numerator, int $denominator): ?float
+    {
+        if ($denominator === 0) {
+            return null;
+        }
+
+        return $numerator / $denominator;
+    }
+
+    private function rpm(string|float|int|null $earnings, int $pageViews): ?float
+    {
+        if ($pageViews === 0) {
+            return null;
+        }
+
+        return ((float) $earnings / $pageViews) * 1000;
+    }
+
+    private function cpc(string|float|int|null $earnings, int $clicks): ?float
+    {
+        if ($clicks === 0) {
+            return null;
+        }
+
+        return (float) $earnings / $clicks;
+    }
+}

app/Services/Adsense/AdsenseApiClient.php

@@ -0,0 +1,350 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\Exceptions\AdsenseApiException;
+use App\Services\Adsense\Exceptions\AdsenseAuthorizationException;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+
+final class AdsenseApiClient
+{
+    public function __construct(private readonly AdsenseOAuthService $oauth) {}
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function listAccounts(AdsenseConnection $connection): array
+    {
+        return $this->paginate($connection, '/accounts', 'accounts');
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function listAdClients(AdsenseConnection $connection, string $accountResourceName): array
+    {
+        return $this->paginate($connection, '/'.$this->trimPath($accountResourceName).'/adclients', 'adClients');
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function listAdUnits(AdsenseConnection $connection, string $adClientResourceName): array
+    {
+        return $this->paginate($connection, '/'.$this->trimPath($adClientResourceName).'/adunits', 'adUnits');
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    public function listCustomChannels(AdsenseConnection $connection, string $adClientResourceName): array
+    {
+        return $this->paginate($connection, '/'.$this->trimPath($adClientResourceName).'/customchannels', 'customChannels');
+    }
+
+    /**
+     * @param  list<string>  $dimensions
+     * @param  list<string>  $metrics
+     * @return array<string, mixed>
+     */
+    public function generateReport(
+        AdsenseConnection $connection,
+        string $accountResourceName,
+        array $dimensions,
+        array $metrics,
+        Carbon $from,
+        Carbon $to,
+        string $report = '',
+    ): array {
+        $path = '/'.$this->trimPath($accountResourceName).'/reports:generate';
+        $merged = [
+            'headers' => [],
+            'rows' => [],
+        ];
+
+        $pageToken = null;
+
+        do {
+            $query = $this->reportQuery($dimensions, $metrics, $from, $to, $pageToken);
+            $json = $this->getJson($connection, $path, $query, $report);
+
+            if ($merged['headers'] === [] && isset($json['headers']) && is_array($json['headers'])) {
+                $merged['headers'] = $json['headers'];
+            }
+
+            $rows = $json['rows'] ?? [];
+            if (is_array($rows) && $rows !== []) {
+                $merged['rows'] = array_merge($merged['rows'], $rows);
+            }
+
+            foreach (['totals', 'averages', 'startDate', 'endDate', 'warnings'] as $metaKey) {
+                if (! isset($merged[$metaKey]) && isset($json[$metaKey])) {
+                    $merged[$metaKey] = $json[$metaKey];
+                }
+            }
+
+            $pageToken = isset($json['nextPageToken']) && is_string($json['nextPageToken']) && $json['nextPageToken'] !== ''
+                ? $json['nextPageToken']
+                : null;
+        } while ($pageToken !== null);
+
+        return $merged;
+    }
+
+    /**
+     * @param  array<string, scalar|null>  $query
+     * @return list<array<string, mixed>>
+     */
+    private function paginate(AdsenseConnection $connection, string $path, string $itemsKey): array
+    {
+        $items = [];
+        $pageToken = null;
+
+        do {
+            $query = [];
+            if ($pageToken !== null) {
+                $query['pageToken'] = $pageToken;
+            }
+
+            $json = $this->getJson($connection, $path, $query);
+            $pageItems = $json[$itemsKey] ?? [];
+            if (is_array($pageItems)) {
+                foreach ($pageItems as $item) {
+                    if (is_array($item)) {
+                        $items[] = $item;
+                    }
+                }
+            }
+
+            $pageToken = isset($json['nextPageToken']) && is_string($json['nextPageToken']) && $json['nextPageToken'] !== ''
+                ? $json['nextPageToken']
+                : null;
+        } while ($pageToken !== null);
+
+        return $items;
+    }
+
+    /**
+     * @param  list<string>  $dimensions
+     * @param  list<string>  $metrics
+     * @return array<string, scalar>
+     */
+    private function reportQuery(array $dimensions, array $metrics, Carbon $from, Carbon $to, ?string $pageToken): array
+    {
+        $query = [
+            'startDate.year' => $from->year,
+            'startDate.month' => $from->month,
+            'startDate.day' => $from->day,
+            'endDate.year' => $to->year,
+            'endDate.month' => $to->month,
+            'endDate.day' => $to->day,
+        ];
+
+        foreach ($dimensions as $index => $dimension) {
+            $query['dimensions'.$index] = $dimension;
+        }
+
+        foreach ($metrics as $index => $metric) {
+            $query['metrics'.$index] = $metric;
+        }
+
+        if ($pageToken !== null) {
+            $query['pageToken'] = $pageToken;
+        }
+
+        return $query;
+    }
+
+    /**
+     * @param  array<string, scalar|null>  $query
+     * @return array<string, mixed>
+     */
+    private function getJson(AdsenseConnection $connection, string $path, array $query = [], string $report = ''): array
+    {
+        $url = $this->url($path, $query);
+        $response = $this->send($connection, $url, $report);
+        $json = $response->json();
+
+        if (! is_array($json)) {
+            throw new AdsenseApiException('Malformed AdSense API response.', $response->status(), $report);
+        }
+
+        return $json;
+    }
+
+    private function send(AdsenseConnection $connection, string $url, string $report = ''): Response
+    {
+        $maxAttempts = max(1, (int) config('adsense.retry_times', 3));
+        $sleepMs = max(0, (int) config('adsense.retry_sleep_ms', 400));
+        $refreshed = false;
+        $attempt = 0;
+
+        while (true) {
+            $attempt++;
+
+            try {
+                $response = Http::acceptJson()
+                    ->withToken($this->oauth->accessToken($connection))
+                    ->timeout((int) config('adsense.timeout', 20))
+                    ->connectTimeout((int) config('adsense.connect_timeout', 5))
+                    ->get($url);
+            } catch (AdsenseAuthorizationException $exception) {
+                throw $exception;
+            } catch (ConnectionException $exception) {
+                if ($attempt < $maxAttempts) {
+                    $this->backoff($sleepMs, $attempt);
+
+                    continue;
+                }
+
+                Log::warning('AdSense API connection failed.', AdsenseLogSanitizer::context([
+                    'message' => $exception->getMessage(),
+                    'report' => $report,
+                ]));
+
+                throw new AdsenseApiException('AdSense API connection failed.', 0, $report, $exception);
+            }
+
+            $status = $response->status();
+
+            if ($status === 401 && ! $refreshed) {
+                $this->oauth->forgetAccessToken((int) $connection->id);
+
+                try {
+                    $this->oauth->accessToken($connection, true);
+                } catch (AdsenseAuthorizationException $exception) {
+                    throw $exception;
+                }
+
+                $refreshed = true;
+                $attempt--;
+
+                continue;
+            }
+
+            if (in_array($status, [429, 500, 502, 503, 504], true) && $attempt < $maxAttempts) {
+                $this->backoff($sleepMs, $attempt);
+
+                continue;
+            }
+
+            if ($status === 401 || $status === 403) {
+                $message = $this->errorMessage($response, 'AdSense API authorization failed.');
+                Log::warning('AdSense API authorization failed.', AdsenseLogSanitizer::context([
+                    'status' => $status,
+                    'report' => $report,
+                ]));
+
+                if ($this->isRevoked($response, $message)) {
+                    $this->oauth->markReconnectRequired($connection, 'AdSense authorization expired or was revoked.');
+
+                    throw new AdsenseAuthorizationException('AdSense authorization expired or was revoked.');
+                }
+
+                throw new AdsenseApiException($message, $status, $report);
+            }
+
+            if ($response->failed()) {
+                $message = $this->errorMessage($response, 'AdSense API request failed.');
+                Log::warning('AdSense API request failed.', AdsenseLogSanitizer::context([
+                    'status' => $status,
+                    'report' => $report,
+                ]));
+
+                throw new AdsenseApiException($message, $status, $report);
+            }
+
+            return $response;
+        }
+    }
+
+    /**
+     * @param  array<string, scalar|null>  $query
+     */
+    private function url(string $path, array $query): string
+    {
+        $base = rtrim((string) config('adsense.api_base'), '/');
+        $url = $base.'/'.$this->trimPath($path);
+
+        $parts = [];
+        foreach ($query as $key => $value) {
+            if ($value === null || $value === '') {
+                continue;
+            }
+
+            if (str_starts_with((string) $key, 'dimensions')) {
+                $parts[] = 'dimensions='.rawurlencode((string) $value);
+
+                continue;
+            }
+
+            if (str_starts_with((string) $key, 'metrics')) {
+                $parts[] = 'metrics='.rawurlencode((string) $value);
+
+                continue;
+            }
+
+            $parts[] = rawurlencode((string) $key).'='.rawurlencode((string) $value);
+        }
+
+        if ($parts === []) {
+            return $url;
+        }
+
+        return $url.'?'.implode('&', $parts);
+    }
+
+    private function trimPath(string $path): string
+    {
+        return ltrim($path, '/');
+    }
+
+    private function backoff(int $sleepMs, int $attempt): void
+    {
+        if ($sleepMs <= 0) {
+            return;
+        }
+
+        usleep($sleepMs * 1000 * $attempt);
+    }
+
+    private function errorMessage(Response $response, string $fallback): string
+    {
+        $json = $response->json();
+        if (! is_array($json)) {
+            return $fallback;
+        }
+
+        $error = $json['error'] ?? null;
+        if (is_string($error) && $error !== '') {
+            return $error;
+        }
+
+        if (is_array($error)) {
+            $status = (string) ($error['status'] ?? '');
+            $message = (string) ($error['message'] ?? '');
+            $combined = trim($status.' '.$message);
+
+            return $combined !== '' ? $combined : $fallback;
+        }
+
+        return $fallback;
+    }
+
+    private function isRevoked(Response $response, string $message): bool
+    {
+        $haystack = Str::lower($message.' '.$response->body());
+
+        return str_contains($haystack, 'invalid_grant')
+            || str_contains($haystack, 'invalid credentials')
+            || str_contains($haystack, 'revoked');
+    }
+}

app/Services/Adsense/AdsenseLogSanitizer.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+final class AdsenseLogSanitizer
+{
+    /**
+     * @var list<string>
+     */
+    private const SENSITIVE_KEYS = [
+        'access_token',
+        'refresh_token',
+        'id_token',
+        'token',
+        'code',
+        'client_secret',
+        'authorization',
+        'encrypted_refresh_token',
+    ];
+
+    /**
+     * @param  array<string, mixed>  $context
+     * @return array<string, mixed>
+     */
+    public static function context(array $context): array
+    {
+        $clean = [];
+
+        foreach ($context as $key => $value) {
+            $normalized = strtolower((string) $key);
+
+            if (in_array($normalized, self::SENSITIVE_KEYS, true) || str_contains($normalized, 'token') || str_contains($normalized, 'secret')) {
+                continue;
+            }
+
+            if (is_array($value)) {
+                $clean[$key] = self::context($value);
+
+                continue;
+            }
+
+            if (is_string($value) && self::looksLikeSecret($value)) {
+                continue;
+            }
+
+            $clean[$key] = $value;
+        }
+
+        return $clean;
+    }
+
+    public static function looksLikeSecret(string $value): bool
+    {
+        if ($value === '') {
+            return false;
+        }
+
+        foreach (['refresh-secret', 'access-secret', 'ya29.', '1//'] as $marker) {
+            if (str_contains($value, $marker)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

app/Services/Adsense/AdsenseOAuthService.php

@@ -0,0 +1,327 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\Exceptions\AdsenseAuthorizationException;
+use App\Services\Adsense\Exceptions\AdsenseOAuthException;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+
+final class AdsenseOAuthService
+{
+    public const SESSION_STATE_KEY = 'adsense.oauth_state';
+
+    public const SESSION_PENDING_ACCOUNTS_KEY = 'adsense.pending_accounts';
+
+    public function isConfigured(): bool
+    {
+        return $this->clientId() !== '' && $this->clientSecret() !== '' && $this->redirectUri() !== '';
+    }
+
+    public function authorizationUrl(Request $request, bool $promptConsent = true): string
+    {
+        if (! $this->isConfigured()) {
+            throw new AdsenseOAuthException('Google AdSense OAuth is not configured.');
+        }
+
+        $state = bin2hex(random_bytes(32));
+        $request->session()->put(self::SESSION_STATE_KEY, $state);
+
+        $query = [
+            'client_id' => $this->clientId(),
+            'redirect_uri' => $this->redirectUri(),
+            'response_type' => 'code',
+            'scope' => (string) config('adsense.scope'),
+            'access_type' => 'offline',
+            'include_granted_scopes' => 'true',
+            'state' => $state,
+        ];
+
+        if ($promptConsent) {
+            $query['prompt'] = 'consent';
+        }
+
+        return (string) config('adsense.oauth_authorize_url').'?'.http_build_query($query);
+    }
+
+    /**
+     * @return array{access_token: string, refresh_token: ?string, expires_in: int}
+     */
+    public function exchangeAuthorizationCode(string $code): array
+    {
+        return $this->requestToken([
+            'grant_type' => 'authorization_code',
+            'code' => $code,
+            'redirect_uri' => $this->redirectUri(),
+            'client_id' => $this->clientId(),
+            'client_secret' => $this->clientSecret(),
+        ]);
+    }
+
+    /**
+     * @return array{access_token: string, refresh_token: ?string, expires_in: int}
+     */
+    public function refreshAccessToken(string $refreshToken): array
+    {
+        try {
+            return $this->requestToken([
+                'grant_type' => 'refresh_token',
+                'refresh_token' => $refreshToken,
+                'client_id' => $this->clientId(),
+                'client_secret' => $this->clientSecret(),
+            ]);
+        } catch (AdsenseOAuthException $exception) {
+            if ($this->isInvalidGrant($exception)) {
+                throw new AdsenseAuthorizationException(
+                    'AdSense authorization expired or was revoked.',
+                    0,
+                    $exception,
+                );
+            }
+
+            throw $exception;
+        }
+    }
+
+    public function persistTokens(AdsenseConnection $connection, array $tokens, ?int $userId = null): void
+    {
+        $refreshToken = $tokens['refresh_token'] ?? null;
+        if (is_string($refreshToken) && $refreshToken !== '') {
+            $connection->encrypted_refresh_token = $refreshToken;
+        }
+
+        if (! $connection->hasRefreshToken()) {
+            throw new AdsenseOAuthException('Google did not return a refresh token. Reconnect with consent.');
+        }
+
+        if ($userId !== null) {
+            $connection->connected_by_user_id = $userId;
+        }
+
+        if ($connection->connected_at === null) {
+            $connection->connected_at = now();
+        }
+
+        if ($connection->status === AdsenseConnection::STATUS_DISCONNECTED) {
+            $connection->status = AdsenseConnection::STATUS_PENDING;
+        }
+
+        $connection->last_error = null;
+        $connection->save();
+
+        if (isset($tokens['access_token']) && is_string($tokens['access_token']) && $tokens['access_token'] !== '') {
+            $this->cacheAccessToken(
+                (int) $connection->id,
+                $tokens['access_token'],
+                (int) ($tokens['expires_in'] ?? 3600),
+            );
+        }
+    }
+
+    public function accessToken(AdsenseConnection $connection, bool $forceRefresh = false): string
+    {
+        if (! $connection->hasRefreshToken()) {
+            $this->markReconnectRequired($connection, 'AdSense authorization expired or was revoked.');
+
+            throw new AdsenseAuthorizationException('AdSense authorization expired or was revoked.');
+        }
+
+        $cacheKey = $this->cacheKey((int) $connection->id);
+
+        if (! $forceRefresh) {
+            $cached = Cache::get($cacheKey);
+            if (is_string($cached) && $cached !== '') {
+                return $cached;
+            }
+        }
+
+        try {
+            $tokens = $this->refreshAccessToken((string) $connection->encrypted_refresh_token);
+        } catch (AdsenseAuthorizationException $exception) {
+            $this->forgetAccessToken((int) $connection->id);
+            $this->markReconnectRequired($connection, $exception->getMessage());
+
+            throw $exception;
+        }
+
+        $accessToken = (string) ($tokens['access_token'] ?? '');
+        if ($accessToken === '') {
+            throw new AdsenseOAuthException('Google did not return an access token.');
+        }
+
+        if (isset($tokens['refresh_token']) && is_string($tokens['refresh_token']) && $tokens['refresh_token'] !== '') {
+            $connection->encrypted_refresh_token = $tokens['refresh_token'];
+            $connection->save();
+        }
+
+        $this->cacheAccessToken((int) $connection->id, $accessToken, (int) ($tokens['expires_in'] ?? 3600));
+
+        return $accessToken;
+    }
+
+    public function cacheAccessToken(int $connectionId, string $accessToken, int $expiresIn): void
+    {
+        $ttl = max(30, $expiresIn - (int) config('adsense.access_token_skew_seconds', 60));
+        Cache::put($this->cacheKey($connectionId), $accessToken, $ttl);
+    }
+
+    public function forgetAccessToken(int $connectionId): void
+    {
+        Cache::forget($this->cacheKey($connectionId));
+    }
+
+    public function markReconnectRequired(AdsenseConnection $connection, string $message): void
+    {
+        $connection->status = AdsenseConnection::STATUS_RECONNECT_REQUIRED;
+        $connection->last_error = $message;
+        $connection->save();
+    }
+
+    public function disconnect(AdsenseConnection $connection): void
+    {
+        $refreshToken = $connection->encrypted_refresh_token;
+        $this->forgetAccessToken((int) $connection->id);
+
+        if (is_string($refreshToken) && $refreshToken !== '') {
+            $this->revokeToken($refreshToken);
+        }
+
+        $connection->encrypted_refresh_token = null;
+        $connection->status = AdsenseConnection::STATUS_DISCONNECTED;
+        $connection->last_error = null;
+        $connection->save();
+    }
+
+    public function revokeToken(string $token): void
+    {
+        try {
+            Http::asForm()
+                ->timeout((int) config('adsense.timeout', 20))
+                ->connectTimeout((int) config('adsense.connect_timeout', 5))
+                ->post((string) config('adsense.oauth_revoke_url'), [
+                    'token' => $token,
+                ]);
+        } catch (\Throwable $exception) {
+            Log::warning('AdSense token revocation failed.', AdsenseLogSanitizer::context([
+                'message' => $exception->getMessage(),
+            ]));
+        }
+    }
+
+    public function assertValidCallback(Request $request): string
+    {
+        $error = trim((string) $request->query('error', ''));
+        if ($error !== '') {
+            $description = trim((string) $request->query('error_description', ''));
+            $request->session()->forget(self::SESSION_STATE_KEY);
+
+            throw new AdsenseOAuthException(
+                $description !== ''
+                    ? 'Google AdSense authorization was denied: '.$description
+                    : 'Google AdSense authorization was denied.'
+            );
+        }
+
+        $expected = (string) $request->session()->pull(self::SESSION_STATE_KEY, '');
+        $provided = (string) $request->query('state', '');
+
+        if ($expected === '' || $provided === '' || ! hash_equals($expected, $provided)) {
+            throw new AdsenseOAuthException('Invalid OAuth state.');
+        }
+
+        $code = trim((string) $request->query('code', ''));
+        if ($code === '') {
+            throw new AdsenseOAuthException('Missing authorization code.');
+        }
+
+        return $code;
+    }
+
+    /**
+     * @param  array<string, string>  $payload
+     * @return array{access_token: string, refresh_token: ?string, expires_in: int}
+     */
+    private function requestToken(array $payload): array
+    {
+        try {
+            $response = Http::asForm()
+                ->acceptJson()
+                ->timeout((int) config('adsense.timeout', 20))
+                ->connectTimeout((int) config('adsense.connect_timeout', 5))
+                ->post((string) config('adsense.oauth_token_url'), $payload);
+        } catch (ConnectionException $exception) {
+            Log::warning('AdSense OAuth token request failed.', AdsenseLogSanitizer::context([
+                'message' => $exception->getMessage(),
+            ]));
+
+            throw new AdsenseOAuthException('Unable to contact Google OAuth.', 0, $exception);
+        }
+
+        $json = $response->json();
+        $json = is_array($json) ? $json : [];
+
+        if ($response->failed()) {
+            $error = $json['error'] ?? 'oauth_error';
+            if (is_array($error)) {
+                $error = (string) ($error['message'] ?? $error['status'] ?? 'oauth_error');
+            } else {
+                $error = (string) $error;
+            }
+            Log::warning('AdSense OAuth token request rejected.', AdsenseLogSanitizer::context([
+                'status' => $response->status(),
+                'error' => $error,
+            ]));
+
+            throw new AdsenseOAuthException($error, $response->status());
+        }
+
+        $accessToken = (string) ($json['access_token'] ?? '');
+        if ($accessToken === '') {
+            throw new AdsenseOAuthException('Google did not return an access token.');
+        }
+
+        $refreshToken = $json['refresh_token'] ?? null;
+
+        return [
+            'access_token' => $accessToken,
+            'refresh_token' => is_string($refreshToken) && $refreshToken !== '' ? $refreshToken : null,
+            'expires_in' => (int) ($json['expires_in'] ?? 3600),
+        ];
+    }
+
+    private function isInvalidGrant(AdsenseOAuthException $exception): bool
+    {
+        $message = Str::lower($exception->getMessage());
+
+        return str_contains($message, 'invalid_grant')
+            || str_contains($message, 'revoked')
+            || str_contains($message, 'invalid_token');
+    }
+
+    private function cacheKey(int $connectionId): string
+    {
+        return (string) config('adsense.access_token_cache_prefix', 'adsense.access_token.').$connectionId;
+    }
+
+    private function clientId(): string
+    {
+        return trim((string) config('adsense.client_id'));
+    }
+
+    private function clientSecret(): string
+    {
+        return trim((string) config('adsense.client_secret'));
+    }
+
+    public function redirectUri(): string
+    {
+        return trim((string) config('adsense.redirect_uri'));
+    }
+}

app/Services/Adsense/AdsenseReportParser.php

@@ -0,0 +1,216 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+use App\Models\AdsenseDailyStat;
+
+final class AdsenseReportParser
+{
+    /**
+     * @var array<string, string>
+     */
+    private const METRIC_COLUMNS = [
+        'ESTIMATED_EARNINGS' => 'estimated_earnings',
+        'PAGE_VIEWS' => 'page_views',
+        'PAGE_VIEWS_CTR' => 'page_views_ctr',
+        'PAGE_VIEWS_RPM' => 'page_views_rpm',
+        'AD_REQUESTS' => 'ad_requests',
+        'AD_REQUESTS_COVERAGE' => 'ad_requests_coverage',
+        'AD_REQUESTS_CTR' => 'ad_requests_ctr',
+        'AD_REQUESTS_RPM' => 'ad_requests_rpm',
+        'MATCHED_AD_REQUESTS' => 'matched_ad_requests',
+        'IMPRESSIONS' => 'impressions',
+        'IMPRESSIONS_CTR' => 'impressions_ctr',
+        'IMPRESSIONS_RPM' => 'impressions_rpm',
+        'CLICKS' => 'clicks',
+        'COST_PER_CLICK' => 'cost_per_click',
+    ];
+
+    /**
+     * @var list<string>
+     */
+    private const INTEGER_COLUMNS = [
+        'page_views',
+        'ad_requests',
+        'matched_ad_requests',
+        'impressions',
+        'clicks',
+    ];
+
+    /**
+     * @param  array<string, mixed>  $report
+     * @return list<array<string, mixed>>
+     */
+    public function parse(array $report, string $dimensionType, string $accountResourceName): array
+    {
+        $indexByName = $this->headerIndex($report['headers'] ?? []);
+        $currencyCode = $this->currencyCode($report['headers'] ?? []);
+        $rows = [];
+
+        foreach ($report['rows'] ?? [] as $row) {
+            if (! is_array($row)) {
+                continue;
+            }
+
+            $cells = $row['cells'] ?? [];
+            if (! is_array($cells)) {
+                continue;
+            }
+
+            $date = $this->cell($cells, $indexByName, 'DATE');
+            if (! is_string($date) || $date === '') {
+                continue;
+            }
+
+            $dimensionKey = $this->dimensionKey($cells, $indexByName, $dimensionType);
+            if ($dimensionKey === null || $dimensionKey === '') {
+                continue;
+            }
+
+            $parsed = [
+                'date' => $date,
+                'account_resource_name' => $accountResourceName,
+                'dimension_type' => $dimensionType,
+                'dimension_key' => $dimensionKey,
+                'dimension_label' => $this->dimensionLabel($cells, $indexByName, $dimensionType, $dimensionKey),
+                'currency_code' => $currencyCode,
+            ];
+
+            foreach (self::METRIC_COLUMNS as $header => $column) {
+                $parsed[$column] = $this->metricValue($cells, $indexByName, $header, $column);
+            }
+
+            $rows[] = $parsed;
+        }
+
+        return $rows;
+    }
+
+    public function currencyCode(array $headers): ?string
+    {
+        foreach ($headers as $header) {
+            if (! is_array($header)) {
+                continue;
+            }
+
+            $type = strtoupper((string) ($header['type'] ?? ''));
+            $code = trim((string) ($header['currencyCode'] ?? ''));
+            if ($type === 'METRIC_CURRENCY' && $code !== '') {
+                return $code;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * @return array<string, int>
+     */
+    private function headerIndex(mixed $headers): array
+    {
+        $index = [];
+        if (! is_array($headers)) {
+            return $index;
+        }
+
+        foreach ($headers as $position => $header) {
+            if (! is_array($header)) {
+                continue;
+            }
+
+            $name = strtoupper(trim((string) ($header['name'] ?? '')));
+            if ($name === '') {
+                continue;
+            }
+
+            $index[$name] = (int) $position;
+        }
+
+        return $index;
+    }
+
+    /**
+     * @param  array<int, mixed>  $cells
+     * @param  array<string, int>  $indexByName
+     */
+    private function dimensionKey(array $cells, array $indexByName, string $dimensionType): ?string
+    {
+        return match ($dimensionType) {
+            AdsenseDailyStat::DIMENSION_TOTAL => AdsenseDailyStat::TOTAL_DIMENSION_KEY,
+            AdsenseDailyStat::DIMENSION_AD_UNIT => $this->cell($cells, $indexByName, 'AD_UNIT_ID')
+                ?? $this->cell($cells, $indexByName, 'AD_UNIT_NAME'),
+            AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL => $this->cell($cells, $indexByName, 'CUSTOM_CHANNEL_ID')
+                ?? $this->cell($cells, $indexByName, 'CUSTOM_CHANNEL_NAME'),
+            AdsenseDailyStat::DIMENSION_PLATFORM => $this->cell($cells, $indexByName, 'PLATFORM_TYPE_CODE')
+                ?? $this->cell($cells, $indexByName, 'PLATFORM_TYPE_NAME'),
+            AdsenseDailyStat::DIMENSION_COUNTRY => $this->cell($cells, $indexByName, 'COUNTRY_CODE')
+                ?? $this->cell($cells, $indexByName, 'COUNTRY_NAME'),
+            default => null,
+        };
+    }
+
+    /**
+     * @param  array<int, mixed>  $cells
+     * @param  array<string, int>  $indexByName
+     */
+    private function dimensionLabel(array $cells, array $indexByName, string $dimensionType, string $dimensionKey): string
+    {
+        $label = match ($dimensionType) {
+            AdsenseDailyStat::DIMENSION_TOTAL => 'Total',
+            AdsenseDailyStat::DIMENSION_AD_UNIT => $this->cell($cells, $indexByName, 'AD_UNIT_NAME'),
+            AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL => $this->cell($cells, $indexByName, 'CUSTOM_CHANNEL_NAME'),
+            AdsenseDailyStat::DIMENSION_PLATFORM => $this->cell($cells, $indexByName, 'PLATFORM_TYPE_NAME')
+                ?? $this->cell($cells, $indexByName, 'PLATFORM_TYPE_CODE'),
+            AdsenseDailyStat::DIMENSION_COUNTRY => $this->cell($cells, $indexByName, 'COUNTRY_NAME')
+                ?? $this->cell($cells, $indexByName, 'COUNTRY_CODE'),
+            default => $dimensionKey,
+        };
+
+        return is_string($label) && $label !== '' ? $label : $dimensionKey;
+    }
+
+    /**
+     * @param  array<int, mixed>  $cells
+     * @param  array<string, int>  $indexByName
+     */
+    private function cell(array $cells, array $indexByName, string $name): ?string
+    {
+        $name = strtoupper($name);
+        if (! array_key_exists($name, $indexByName)) {
+            return null;
+        }
+
+        $cell = $cells[$indexByName[$name]] ?? null;
+        if (is_array($cell)) {
+            $value = $cell['value'] ?? null;
+
+            return is_scalar($value) ? (string) $value : null;
+        }
+
+        return is_scalar($cell) ? (string) $cell : null;
+    }
+
+    /**
+     * @param  array<int, mixed>  $cells
+     * @param  array<string, int>  $indexByName
+     */
+    private function metricValue(array $cells, array $indexByName, string $header, string $column): int|string|null
+    {
+        $raw = $this->cell($cells, $indexByName, $header);
+        if ($raw === null || $raw === '') {
+            return null;
+        }
+
+        if (in_array($column, self::INTEGER_COLUMNS, true)) {
+            return (int) $raw;
+        }
+
+        if (! is_numeric($raw)) {
+            return null;
+        }
+
+        return $raw;
+    }
+}

app/Services/Adsense/AdsenseSyncResult.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+final class AdsenseSyncResult
+{
+    /**
+     * @param  list<string>  $failedReports
+     */
+    public function __construct(
+        public string $accountDisplayName = '',
+        public string $from = '',
+        public string $to = '',
+        public int $adUnits = 0,
+        public int $customChannels = 0,
+        public int $totalRows = 0,
+        public int $adUnitRows = 0,
+        public int $customChannelRows = 0,
+        public int $platformRows = 0,
+        public int $countryRows = 0,
+        public array $failedReports = [],
+        public bool $entitiesSynced = false,
+        public bool $reconnectRequired = false,
+    ) {}
+
+    public function succeeded(): bool
+    {
+        return ! $this->reconnectRequired && $this->failedReports === [];
+    }
+}

app/Services/Adsense/AdsenseSyncService.php

@@ -0,0 +1,358 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense;
+
+use App\Models\AdsenseConnection;
+use App\Models\AdsenseDailyStat;
+use App\Models\AdsenseEntity;
+use App\Services\Adsense\Exceptions\AdsenseApiException;
+use App\Services\Adsense\Exceptions\AdsenseAuthorizationException;
+use App\Services\Adsense\Exceptions\AdsenseOAuthException;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Log;
+
+final class AdsenseSyncService
+{
+    public function __construct(
+        private readonly AdsenseApiClient $api,
+        private readonly AdsenseReportParser $parser,
+        private readonly AdsenseOAuthService $oauth,
+    ) {}
+
+    public function sync(
+        AdsenseConnection $connection,
+        Carbon $from,
+        Carbon $to,
+        bool $entitiesOnly = false,
+    ): AdsenseSyncResult {
+        $result = new AdsenseSyncResult(
+            accountDisplayName: (string) ($connection->account_display_name ?: $connection->account_resource_name),
+            from: $from->toDateString(),
+            to: $to->toDateString(),
+        );
+
+        $connection->last_sync_attempt_at = now();
+        $connection->save();
+
+        try {
+            $this->syncEntities($connection, $result);
+
+            if (! $entitiesOnly) {
+                $this->syncReports($connection, $from, $to, $result);
+            }
+
+            if ($result->reconnectRequired) {
+                return $result;
+            }
+
+            $connection->last_successful_sync_at = now();
+            $connection->status = $result->failedReports === []
+                ? AdsenseConnection::STATUS_CONNECTED
+                : AdsenseConnection::STATUS_ERROR;
+            $connection->last_error = $result->failedReports === []
+                ? null
+                : 'Partial AdSense sync failure: '.implode(', ', $result->failedReports);
+            $connection->save();
+        } catch (AdsenseAuthorizationException $exception) {
+            $result->reconnectRequired = true;
+            $this->oauth->markReconnectRequired($connection, $exception->getMessage());
+        } catch (AdsenseOAuthException $exception) {
+            $result->failedReports[] = 'oauth';
+            $connection->status = AdsenseConnection::STATUS_ERROR;
+            $connection->last_error = $exception->getMessage();
+            $connection->save();
+        } catch (AdsenseApiException $exception) {
+            $result->failedReports[] = 'entities';
+            Log::warning('AdSense entity synchronization failed.', AdsenseLogSanitizer::context([
+                'status' => $exception->status,
+                'message' => $exception->getMessage(),
+            ]));
+            $connection->status = AdsenseConnection::STATUS_ERROR;
+            $connection->last_error = $exception->getMessage();
+            $connection->save();
+        }
+
+        return $result;
+    }
+
+    public function syncEntities(AdsenseConnection $connection, ?AdsenseSyncResult $result = null): AdsenseSyncResult
+    {
+        $result ??= new AdsenseSyncResult(
+            accountDisplayName: (string) ($connection->account_display_name ?: $connection->account_resource_name),
+        );
+
+        $account = (string) $connection->account_resource_name;
+        if ($account === '') {
+            throw new AdsenseApiException('No AdSense account is selected.');
+        }
+
+        $adClients = $this->api->listAdClients($connection, $account);
+        $now = now();
+        $adUnits = 0;
+        $customChannels = 0;
+
+        foreach ($adClients as $client) {
+            $clientName = (string) ($client['name'] ?? '');
+            if ($clientName === '' || ! $this->supportsInventory($client)) {
+                continue;
+            }
+
+            try {
+                foreach ($this->api->listAdUnits($connection, $clientName) as $unit) {
+                    $this->upsertEntity($account, $clientName, AdsenseEntity::TYPE_AD_UNIT, $unit, $now);
+                    $adUnits++;
+                }
+            } catch (AdsenseAuthorizationException $exception) {
+                throw $exception;
+            } catch (AdsenseApiException $exception) {
+                $this->logSkippedClient($clientName, 'ad_units', $exception);
+            }
+
+            try {
+                foreach ($this->api->listCustomChannels($connection, $clientName) as $channel) {
+                    $this->upsertEntity($account, $clientName, AdsenseEntity::TYPE_CUSTOM_CHANNEL, $channel, $now);
+                    $customChannels++;
+                }
+            } catch (AdsenseAuthorizationException $exception) {
+                throw $exception;
+            } catch (AdsenseApiException $exception) {
+                $this->logSkippedClient($clientName, 'custom_channels', $exception);
+            }
+        }
+
+        $result->adUnits = $adUnits;
+        $result->customChannels = $customChannels;
+        $result->entitiesSynced = true;
+
+        return $result;
+    }
+
+    private function syncReports(
+        AdsenseConnection $connection,
+        Carbon $from,
+        Carbon $to,
+        AdsenseSyncResult $result,
+    ): void {
+        $account = (string) $connection->account_resource_name;
+        $metrics = array_values((array) config('adsense.metrics', []));
+
+        $definitions = [
+            AdsenseDailyStat::DIMENSION_TOTAL => ['DATE'],
+            AdsenseDailyStat::DIMENSION_AD_UNIT => ['DATE', 'AD_UNIT_ID'],
+            AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL => ['DATE', 'CUSTOM_CHANNEL_ID'],
+            AdsenseDailyStat::DIMENSION_PLATFORM => ['DATE', 'PLATFORM_TYPE_CODE'],
+            AdsenseDailyStat::DIMENSION_COUNTRY => ['DATE', 'COUNTRY_CODE'],
+        ];
+
+        foreach ($definitions as $dimensionType => $dimensions) {
+            try {
+                $report = $this->api->generateReport(
+                    $connection,
+                    $account,
+                    $dimensions,
+                    $metrics,
+                    $from,
+                    $to,
+                    $dimensionType,
+                );
+                $rows = $this->parser->parse($report, $dimensionType, $account);
+                $this->applyEntityLabels($rows, $account, $dimensionType);
+                $saved = $this->upsertStats($rows);
+
+                match ($dimensionType) {
+                    AdsenseDailyStat::DIMENSION_TOTAL => $result->totalRows = $saved,
+                    AdsenseDailyStat::DIMENSION_AD_UNIT => $result->adUnitRows = $saved,
+                    AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL => $result->customChannelRows = $saved,
+                    AdsenseDailyStat::DIMENSION_PLATFORM => $result->platformRows = $saved,
+                    AdsenseDailyStat::DIMENSION_COUNTRY => $result->countryRows = $saved,
+                    default => null,
+                };
+            } catch (AdsenseAuthorizationException $exception) {
+                $result->reconnectRequired = true;
+                throw $exception;
+            } catch (AdsenseApiException $exception) {
+                $result->failedReports[] = $dimensionType;
+                Log::warning('AdSense report synchronization failed.', AdsenseLogSanitizer::context([
+                    'report' => $dimensionType,
+                    'status' => $exception->status,
+                    'message' => $exception->getMessage(),
+                ]));
+            }
+        }
+    }
+
+    /**
+     * Website content ad clients (AFC / ca-pub-...) expose ad units.
+     * YouTube host clients (ca-yt-host-pub-...) are listed by Google but 404 on adunits.
+     *
+     * @param  array<string, mixed>  $client
+     */
+    private function supportsInventory(array $client): bool
+    {
+        $name = strtolower((string) ($client['name'] ?? ''));
+        $reportingId = strtolower((string) ($client['reportingDimensionId'] ?? ''));
+        $haystack = $name.' '.$reportingId;
+
+        foreach ((array) config('adsense.inventory_excluded_client_prefixes', ['ca-yt-host-']) as $prefix) {
+            $prefix = strtolower(trim((string) $prefix));
+            if ($prefix !== '' && str_contains($haystack, $prefix)) {
+                return false;
+            }
+        }
+
+        $product = strtoupper(trim((string) ($client['productCode'] ?? '')));
+        $allowed = array_values(array_filter(array_map(
+            static fn (mixed $code): string => strtoupper(trim((string) $code)),
+            (array) config('adsense.inventory_product_codes', ['AFC']),
+        )));
+
+        if ($product !== '' && $allowed !== [] && ! in_array($product, $allowed, true)) {
+            return false;
+        }
+
+        return true;
+    }
+
+    private function logSkippedClient(string $clientName, string $kind, AdsenseApiException $exception): void
+    {
+        Log::warning('AdSense skipped an ad client inventory request.', AdsenseLogSanitizer::context([
+            'client' => $clientName,
+            'kind' => $kind,
+            'status' => $exception->status,
+            'message' => $exception->getMessage(),
+        ]));
+    }
+
+    /**
+     * @param  array<string, mixed>  $entity
+     */
+    private function upsertEntity(
+        string $account,
+        string $adClient,
+        string $type,
+        array $entity,
+        Carbon $seenAt,
+    ): void {
+        $resourceName = (string) ($entity['name'] ?? '');
+        $reportingId = (string) ($entity['reportingDimensionId'] ?? '');
+        if ($reportingId === '' && $resourceName !== '') {
+            $reportingId = (string) str($resourceName)->afterLast('/');
+        }
+        if ($reportingId === '') {
+            return;
+        }
+
+        $state = strtoupper((string) ($entity['state'] ?? ''));
+        $active = $state === '' ? null : $state === 'ACTIVE' || $state === 'READY';
+
+        AdsenseEntity::query()->updateOrCreate(
+            [
+                'account_resource_name' => $account,
+                'type' => $type,
+                'reporting_dimension_id' => $reportingId,
+            ],
+            [
+                'ad_client_resource_name' => $adClient,
+                'resource_name' => $resourceName !== '' ? $resourceName : null,
+                'display_name' => (string) ($entity['displayName'] ?? $reportingId),
+                'active' => $active,
+                'last_seen_at' => $seenAt,
+            ],
+        );
+    }
+
+    /**
+     * @param  list<array<string, mixed>>  $rows
+     */
+    private function applyEntityLabels(array &$rows, string $account, string $dimensionType): void
+    {
+        if (! in_array($dimensionType, [AdsenseDailyStat::DIMENSION_AD_UNIT, AdsenseDailyStat::DIMENSION_CUSTOM_CHANNEL], true)) {
+            return;
+        }
+
+        $labels = AdsenseEntity::query()
+            ->where('account_resource_name', $account)
+            ->where('type', $dimensionType)
+            ->pluck('display_name', 'reporting_dimension_id');
+
+        foreach ($rows as &$row) {
+            $key = (string) ($row['dimension_key'] ?? '');
+            if ($key !== '' && isset($labels[$key]) && is_string($labels[$key]) && $labels[$key] !== '') {
+                $row['dimension_label'] = $labels[$key];
+            }
+        }
+        unset($row);
+    }
+
+    /**
+     * @param  list<array<string, mixed>>  $rows
+     */
+    private function upsertStats(array $rows): int
+    {
+        if ($rows === []) {
+            return 0;
+        }
+
+        $now = now();
+        $payload = [];
+
+        foreach ($rows as $row) {
+            $payload[] = [
+                'date' => $row['date'],
+                'account_resource_name' => $row['account_resource_name'],
+                'dimension_type' => $row['dimension_type'],
+                'dimension_key' => $row['dimension_key'],
+                'dimension_label' => $row['dimension_label'] ?? null,
+                'currency_code' => $row['currency_code'] ?? null,
+                'page_views' => $row['page_views'] ?? null,
+                'ad_requests' => $row['ad_requests'] ?? null,
+                'matched_ad_requests' => $row['matched_ad_requests'] ?? null,
+                'impressions' => $row['impressions'] ?? null,
+                'clicks' => $row['clicks'] ?? null,
+                'estimated_earnings' => $row['estimated_earnings'] ?? null,
+                'page_views_ctr' => $row['page_views_ctr'] ?? null,
+                'page_views_rpm' => $row['page_views_rpm'] ?? null,
+                'ad_requests_coverage' => $row['ad_requests_coverage'] ?? null,
+                'ad_requests_ctr' => $row['ad_requests_ctr'] ?? null,
+                'ad_requests_rpm' => $row['ad_requests_rpm'] ?? null,
+                'impressions_ctr' => $row['impressions_ctr'] ?? null,
+                'impressions_rpm' => $row['impressions_rpm'] ?? null,
+                'cost_per_click' => $row['cost_per_click'] ?? null,
+                'last_synced_at' => $now,
+                'created_at' => $now,
+                'updated_at' => $now,
+            ];
+        }
+
+        foreach (array_chunk($payload, 200) as $chunk) {
+            AdsenseDailyStat::query()->upsert(
+                $chunk,
+                ['account_resource_name', 'date', 'dimension_type', 'dimension_key'],
+                [
+                    'dimension_label',
+                    'currency_code',
+                    'page_views',
+                    'ad_requests',
+                    'matched_ad_requests',
+                    'impressions',
+                    'clicks',
+                    'estimated_earnings',
+                    'page_views_ctr',
+                    'page_views_rpm',
+                    'ad_requests_coverage',
+                    'ad_requests_ctr',
+                    'ad_requests_rpm',
+                    'impressions_ctr',
+                    'impressions_rpm',
+                    'cost_per_click',
+                    'last_synced_at',
+                    'updated_at',
+                ],
+            );
+        }
+
+        return count($payload);
+    }
+}

app/Services/Adsense/Exceptions/AdsenseApiException.php

@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense\Exceptions;
+
+final class AdsenseApiException extends AdsenseException
+{
+    public function __construct(
+        string $message,
+        public readonly int $status = 0,
+        public readonly string $report = '',
+        ?\Throwable $previous = null,
+    ) {
+        parent::__construct($message, $status, $previous);
+    }
+}

app/Services/Adsense/Exceptions/AdsenseAuthorizationException.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense\Exceptions;
+
+final class AdsenseAuthorizationException extends AdsenseException {}

app/Services/Adsense/Exceptions/AdsenseException.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense\Exceptions;
+
+use RuntimeException;
+
+class AdsenseException extends RuntimeException {}

app/Services/Adsense/Exceptions/AdsenseOAuthException.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Adsense\Exceptions;
+
+final class AdsenseOAuthException extends AdsenseException {}

app/Services/ArtworkNavigationService.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Artwork;
+use Illuminate\Support\Str;
+
+final class ArtworkNavigationService
+{
+    /**
+     * Build the public previous/next navigation payload for an already loaded
+     * current artwork. No current-artwork lookup is performed here.
+     */
+    public function navigationFor(Artwork $artwork): array
+    {
+        $scope = Artwork::published()
+            ->select(['id', 'title', 'slug', 'hash', 'file_path', 'file_name'])
+            ->where('user_id', $artwork->user_id);
+
+        $prev = (clone $scope)->where('id', '<', $artwork->id)->orderByDesc('id')->first();
+        $next = (clone $scope)->where('id', '>', $artwork->id)->orderBy('id')->first();
+
+        if (! $prev) {
+            $prev = (clone $scope)->where('id', '!=', $artwork->id)->orderByDesc('id')->first();
+        }
+        if (! $next) {
+            $next = (clone $scope)->where('id', '!=', $artwork->id)->orderBy('id')->first();
+        }
+
+        $prevSlug = $this->canonicalSlug($prev);
+        $nextSlug = $this->canonicalSlug($next);
+
+        return [
+            'prev_id' => $prev?->id,
+            'next_id' => $next?->id,
+            'prev_url' => $prev ? url('/art/'.$prev->id.'/'.$prevSlug) : null,
+            'next_url' => $next ? url('/art/'.$next->id.'/'.$nextSlug) : null,
+            'prev_slug' => $prevSlug,
+            'next_slug' => $nextSlug,
+            'prev_preview' => $this->preview($prev),
+            'next_preview' => $this->preview($next),
+        ];
+    }
+
+    private function canonicalSlug(?Artwork $artwork): ?string
+    {
+        if (! $artwork) {
+            return null;
+        }
+
+        return Str::slug($artwork->slug ?: $artwork->title) ?: (string) $artwork->id;
+    }
+
+    private function preview(?Artwork $artwork): ?array
+    {
+        if (! $artwork) {
+            return null;
+        }
+
+        return [
+            'id' => (int) $artwork->id,
+            'title' => (string) $artwork->title,
+            'slug' => (string) $artwork->slug,
+            'thumbs' => [
+                'md' => ThumbnailPresenter::present($artwork, 'md'),
+                'lg' => ThumbnailPresenter::present($artwork, 'lg'),
+            ],
+        ];
+    }
+}

app/Services/ArtworkOriginalFileLocator.php

@@ -10,6 +10,12 @@ use Illuminate\Support\Facades\Storage;
 
 final class ArtworkOriginalFileLocator
 {
+    /** @var list<string> */
+    private const ALLOWED_EXTENSIONS = [
+        'jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp', 'tiff',
+        'zip', 'rar', '7z', 'tar', 'gz',
+    ];
+
     public function __construct(
         private readonly UploadStorageService $storage,
     ) {}
@@ -27,7 +33,7 @@ final class ArtworkOriginalFileLocator
         }
 
         $hash = strtolower((string) $artwork->hash);
-        $ext = strtolower(ltrim((string) $artwork->file_ext, '.'));
+        $ext = $this->safeExtension($artwork);
 
         if (! $this->isValidHash($hash) || $ext === '') {
             return '';
@@ -41,17 +47,136 @@ final class ArtworkOriginalFileLocator
             . DIRECTORY_SEPARATOR . $hash . '.' . $ext;
     }
 
+    /** @return array{status:string,source:?string,disk:?string,path:string,object_key:string,exists:bool,size:?int,file_name:string,file_ext:string} */
+    public function resolve(Artwork $artwork): array
+    {
+        $fileName = trim((string) ($artwork->file_name ?? ''));
+        $extension = $this->safeExtension($artwork);
+        $localPath = $this->resolveLocalPath($artwork);
+
+        if ($localPath !== '' && is_file($localPath)) {
+            return $this->result('available', 'local', null, $localPath, '', true, (int) filesize($localPath), $fileName, $extension);
+        }
+
+        if ($this->isTruePending($artwork)) {
+            return $this->result('pending', null, null, $localPath, '', false, null, $fileName, $extension);
+        }
+
+        $objectKey = $this->resolveObjectPath($artwork);
+        if ($objectKey !== '') {
+            try {
+                $diskName = $this->storage->objectDiskName();
+                $disk = Storage::disk($diskName);
+                if ($disk->exists($objectKey)) {
+                    return $this->result('available', 'object', $diskName, '', $objectKey, true, (int) $disk->size($objectKey), $fileName, $extension);
+                }
+            } catch (\Throwable) {
+                // Treat unavailable storage as unresolved; the route logs context.
+            }
+        }
+
+        $legacyPath = $this->resolveReadonlyLegacyPath($artwork);
+        if ($legacyPath !== '' && is_file($legacyPath)) {
+            return $this->result('available', 'legacy', null, $legacyPath, '', true, (int) filesize($legacyPath), $fileName, $extension);
+        }
+
+        if ($this->hasIncompleteLegacyMetadata($artwork)) {
+            return $this->result('unknown', null, null, $localPath, $objectKey, false, null, $fileName, $extension);
+        }
+
+        return $this->result('missing', null, null, $localPath, $objectKey, false, null, $fileName, $extension);
+    }
+
+    private function isTruePending(Artwork $artwork): bool
+    {
+        return strtolower(trim((string) ($artwork->file_name ?? ''))) === 'pending'
+            && trim((string) ($artwork->hash ?? '')) === ''
+            && trim((string) ($artwork->file_ext ?? '')) === ''
+            && trim((string) ($artwork->file_path ?? '')) === '';
+    }
+
+    private function hasIncompleteLegacyMetadata(Artwork $artwork): bool
+    {
+        return ! $this->isValidHash(strtolower((string) ($artwork->hash ?? '')))
+            || $this->safeExtension($artwork) === '';
+    }
+
+    private function resolveReadonlyLegacyPath(Artwork $artwork): string
+    {
+        $legacyRoot = rtrim(str_replace(['/', '\\'], DIRECTORY_SEPARATOR, trim((string) config('uploads.legacy_originals_root', ''))), DIRECTORY_SEPARATOR);
+        $legacyRelative = $this->legacyRelativePath($artwork);
+        if ($legacyRoot !== '' && $legacyRelative !== '') {
+            return $legacyRoot . DIRECTORY_SEPARATOR . str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $legacyRelative);
+        }
+
+        $root = rtrim(str_replace(['/', '\\'], DIRECTORY_SEPARATOR, trim((string) config('uploads.readonly_backup_originals_root', ''))), DIRECTORY_SEPARATOR);
+        $hash = strtolower((string) $artwork->hash);
+        $extension = $this->safeExtension($artwork);
+        if ($root === '' || ! $this->isValidHash($hash) || $extension === '') {
+            return '';
+        }
+
+        return $root . DIRECTORY_SEPARATOR . substr($hash, 0, 2) . DIRECTORY_SEPARATOR . substr($hash, 2, 2) . DIRECTORY_SEPARATOR . $hash . '.' . $extension;
+    }
+
+    private function legacyRelativePath(Artwork $artwork): string
+    {
+        $path = trim((string) ($artwork->file_path ?? ''), '/\\');
+        if ($path === '' || ! str_starts_with(strtolower($path), 'legacy/uploads/')) {
+            return '';
+        }
+
+        $relative = substr($path, strlen('legacy/uploads/'));
+        if ($relative === false || $relative === '' || str_contains($relative, '..')) {
+            return '';
+        }
+
+        return 'legacy/uploads/' . ltrim($relative, '/\\');
+    }
+
+    private function safeExtension(Artwork $artwork): string
+    {
+        $stored = strtolower(ltrim(trim((string) ($artwork->file_ext ?? '')), '.'));
+        if (in_array($stored, self::ALLOWED_EXTENSIONS, true)) {
+            return $stored;
+        }
+
+        foreach ([(string) ($artwork->file_name ?? ''), (string) ($artwork->file_path ?? '')] as $candidate) {
+            $inferred = strtolower(ltrim((string) pathinfo($candidate, PATHINFO_EXTENSION), '.'));
+            if (in_array($inferred, self::ALLOWED_EXTENSIONS, true)) {
+                return $inferred;
+            }
+        }
+
+        return '';
+    }
+
+    private function result(string $status, ?string $source, ?string $disk, string $path, string $objectKey, bool $exists, ?int $size, string $fileName, string $extension): array
+    {
+        return [
+            'status' => $status,
+            'source' => $source,
+            'disk' => $disk,
+            'path' => $path,
+            'object_key' => $objectKey,
+            'exists' => $exists,
+            'size' => $size,
+            'file_name' => $fileName,
+            'file_ext' => $extension,
+        ];
+    }
+
     public function resolveObjectPath(Artwork $artwork): string
     {
         $relative = trim((string) $artwork->file_path, '/');
         $prefix = $this->originalObjectPrefix();
 
-        if ($relative !== '' && str_starts_with($relative, $prefix)) {
+        if ($relative !== '' && (str_starts_with($relative, $prefix) || str_starts_with(strtolower($relative), 'legacy/uploads/'))) {
             return $relative;
         }
 
         $hash = strtolower((string) $artwork->hash);
-        $ext = strtolower(ltrim((string) $artwork->file_ext, '.'));
+        $ext = $this->safeExtension($artwork);
 
         if (! $this->isValidHash($hash) || $ext === '') {
             return '';
@@ -77,6 +202,6 @@ final class ArtworkOriginalFileLocator
 
     private function isValidHash(string $hash): bool
     {
-        return $hash !== '' && preg_match('/^[a-f0-9]+$/', $hash) === 1;
+        return preg_match('/^[a-f0-9]{40}$/', $hash) === 1;
     }
 }

app/Services/ArtworkRelatedService.php

@@ -0,0 +1,163 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services;
+
+use App\Models\Artwork;
+use App\Models\User;
+use App\Services\Maturity\ArtworkMaturityService;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+final class ArtworkRelatedService
+{
+    private const SPLIT_PIVOT_ROW_THRESHOLD = 1000;
+
+    private const RELATIONS = ['user', 'group', 'categories.contentType'];
+
+    public function __construct(private readonly ArtworkMaturityService $maturity) {}
+
+    /**
+     * Return the related artwork models used by the artwork page.
+     *
+     * The fallback query is intentionally kept equivalent to the controller's
+     * original OR/EXISTS query. The split path only changes how candidates are
+     * found; the final models and their relations remain the same.
+     */
+    public function related(Artwork $artwork, ?User $viewer, int $limit = 12): EloquentCollection
+    {
+        $categoryIds = $artwork->categories->pluck('id')->filter()->values();
+        $tagIds = $artwork->tags->pluck('id')->filter()->values();
+
+        if ($categoryIds->isEmpty() || $this->matchingPivotRows($categoryIds) > self::SPLIT_PIVOT_ROW_THRESHOLD) {
+            return $this->originalQuery($artwork, $viewer, $categoryIds, $tagIds, $limit)->get();
+        }
+
+        $candidateRows = collect()
+            ->merge($this->topAuthorCandidates($artwork, $viewer, $limit))
+            ->merge($this->topGroupCandidates($artwork, $viewer, $limit))
+            ->merge($this->topCategoryCandidates($artwork, $viewer, $categoryIds, $limit))
+            ->merge($this->topTagCandidates($artwork, $viewer, $tagIds, $limit))
+            ->reject(fn (object $row): bool => (int) $row->id === (int) $artwork->id)
+            ->unique(fn (object $row): string => (string) $row->id)
+            ->sortByDesc(fn (object $row): mixed => $row->published_at)
+            ->take($limit)
+            ->values();
+
+        $ids = $candidateRows->pluck('id')->map(static fn ($id): int => (int) $id)->all();
+        if ($ids === []) {
+            return new EloquentCollection;
+        }
+
+        $hydrated = Artwork::query()
+            ->with(self::RELATIONS)
+            ->whereIn('id', $ids)
+            ->tap(fn (Builder $builder) => $this->maturity->applyViewerFilter($builder, $viewer))
+            ->get()
+            ->keyBy('id');
+
+        return new EloquentCollection(collect($ids)
+            ->map(fn (int $id): ?Artwork => $hydrated->get($id))
+            ->filter()
+            ->values()
+            ->all());
+    }
+
+    private function matchingPivotRows(Collection $categoryIds): int
+    {
+        return (int) DB::table('artwork_category')
+            ->whereIn('category_id', $categoryIds->all())
+            ->count();
+    }
+
+    private function candidateQuery(Artwork $artwork, ?User $viewer): Builder
+    {
+        return Artwork::query()
+            ->select(['artworks.id', 'artworks.published_at'])
+            ->whereKeyNot($artwork->id)
+            ->public()
+            ->published()
+            ->tap(fn (Builder $builder) => $this->maturity->applyViewerFilter($builder, $viewer));
+    }
+
+    private function topAuthorCandidates(Artwork $artwork, ?User $viewer, int $limit): Collection
+    {
+        return $this->candidateQuery($artwork, $viewer)
+            ->where('user_id', $artwork->user_id)
+            ->latest('published_at')
+            ->limit($limit)
+            ->get();
+    }
+
+    private function topGroupCandidates(Artwork $artwork, ?User $viewer, int $limit): Collection
+    {
+        if (! $artwork->group_id) {
+            return collect();
+        }
+
+        return $this->candidateQuery($artwork, $viewer)
+            ->where('group_id', $artwork->group_id)
+            ->latest('published_at')
+            ->limit($limit)
+            ->get();
+    }
+
+    private function topCategoryCandidates(Artwork $artwork, ?User $viewer, Collection $categoryIds, int $limit): Collection
+    {
+        return $this->candidateQuery($artwork, $viewer)
+            ->join('artwork_category', 'artwork_category.artwork_id', '=', 'artworks.id')
+            ->whereIn('artwork_category.category_id', $categoryIds->all())
+            ->select(['artworks.id', 'artworks.published_at'])
+            ->distinct()
+            ->orderByDesc('artworks.published_at')
+            ->limit($limit)
+            ->get();
+    }
+
+    private function topTagCandidates(Artwork $artwork, ?User $viewer, Collection $tagIds, int $limit): Collection
+    {
+        if ($tagIds->isEmpty()) {
+            return collect();
+        }
+
+        return $this->candidateQuery($artwork, $viewer)
+            ->whereHas('tags', fn ($query) => $query->whereIn('tags.id', $tagIds->all()))
+            ->latest('published_at')
+            ->limit($limit)
+            ->get();
+    }
+
+    private function originalQuery(Artwork $artwork, ?User $viewer, Collection $categoryIds, Collection $tagIds, int $limit): Builder
+    {
+        return Artwork::query()
+            ->with(self::RELATIONS)
+            ->whereKeyNot($artwork->id)
+            ->public()
+            ->published()
+            ->tap(fn (Builder $builder) => $this->maturity->applyViewerFilter($builder, $viewer))
+            ->where(function ($query) use ($artwork, $categoryIds, $tagIds): void {
+                $query->where('user_id', $artwork->user_id);
+
+                if ($artwork->group_id) {
+                    $query->orWhere('group_id', $artwork->group_id);
+                }
+
+                if ($categoryIds->isNotEmpty()) {
+                    $query->orWhereHas('categories', function ($categoryQuery) use ($categoryIds): void {
+                        $categoryQuery->whereIn('categories.id', $categoryIds->all());
+                    });
+                }
+
+                if ($tagIds->isNotEmpty()) {
+                    $query->orWhereHas('tags', function ($tagQuery) use ($tagIds): void {
+                        $tagQuery->whereIn('tags.id', $tagIds->all());
+                    });
+                }
+            })
+            ->latest('published_at')
+            ->limit($limit);
+    }
+}

app/Services/Artworks/ArtworkCategoryService.php

@@ -0,0 +1,201 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Artworks;
+
+use App\Models\Artwork;
+use App\Models\Category;
+use App\Services\ArtworkSearchIndexer;
+use App\Services\ArtworkService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\ValidationException;
+
+final class ArtworkCategoryService
+{
+    public function __construct(
+        private readonly ArtworkSearchIndexer $searchIndexer,
+        private readonly ArtworkService $artworkService,
+    ) {}
+
+    public function maxSecondary(): int
+    {
+        return max(0, (int) config('categories.max_secondary_categories', 5));
+    }
+
+    /**
+     * @param  list<int|string>|null  $secondaryCategoryIds  null keeps existing secondaries that remain compatible
+     */
+    public function sync(
+        Artwork $artwork,
+        ?int $primaryCategoryId,
+        ?array $secondaryCategoryIds = [],
+        ?string $source = null,
+        bool $reindex = true,
+    ): void {
+        $primaryCategoryId = $primaryCategoryId !== null && $primaryCategoryId > 0 ? $primaryCategoryId : null;
+        $secondaryCategoryIds = $secondaryCategoryIds === null
+            ? $this->existingSecondaryIds($artwork, $primaryCategoryId)
+            : $this->normalizeIds($secondaryCategoryIds);
+
+        if ($primaryCategoryId === null) {
+            if ($secondaryCategoryIds !== []) {
+                throw ValidationException::withMessages([
+                    'primary_category_id' => ['A primary category is required when additional categories are selected.'],
+                ]);
+            }
+
+            $this->persist($artwork, null, [], $source, $reindex);
+
+            return;
+        }
+
+        $secondaryCategoryIds = array_values(array_filter(
+            $secondaryCategoryIds,
+            static fn (int $id): bool => $id !== $primaryCategoryId,
+        ));
+
+        if (count($secondaryCategoryIds) > $this->maxSecondary()) {
+            throw ValidationException::withMessages([
+                'secondary_category_ids' => [sprintf('You can add at most %d additional categories.', $this->maxSecondary())],
+            ]);
+        }
+
+        $requestedIds = array_values(array_unique([$primaryCategoryId, ...$secondaryCategoryIds]));
+        $categories = Category::query()
+            ->whereIn('id', $requestedIds)
+            ->get()
+            ->keyBy('id');
+
+        if ($categories->count() !== count($requestedIds)) {
+            throw ValidationException::withMessages([
+                'primary_category_id' => ['One or more selected categories do not exist.'],
+            ]);
+        }
+
+        $primary = $categories->get($primaryCategoryId);
+        if (! $primary) {
+            throw ValidationException::withMessages([
+                'primary_category_id' => ['Choose a valid primary category.'],
+            ]);
+        }
+
+        if (! $primary->is_active) {
+            throw ValidationException::withMessages([
+                'primary_category_id' => ['The primary category is not available.'],
+            ]);
+        }
+
+        $contentTypeId = (int) $primary->content_type_id;
+
+        foreach ($secondaryCategoryIds as $secondaryId) {
+            $category = $categories->get($secondaryId);
+            if (! $category || ! $category->is_active) {
+                throw ValidationException::withMessages([
+                    'secondary_category_ids' => ['One or more additional categories are not available.'],
+                ]);
+            }
+
+            if ((int) $category->content_type_id !== $contentTypeId) {
+                throw ValidationException::withMessages([
+                    'secondary_category_ids' => ['Additional categories must belong to the same content type as the primary category.'],
+                ]);
+            }
+        }
+
+        $this->persist($artwork, $primaryCategoryId, $secondaryCategoryIds, $source, $reindex);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function presentCategory(Category $category, bool $isPrimary): array
+    {
+        return [
+            'id' => (int) $category->id,
+            'name' => html_entity_decode((string) $category->name, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
+            'slug' => (string) $category->slug,
+            'content_type_slug' => (string) ($category->contentType?->slug ?? ''),
+            'url' => $category->contentType ? $category->url : null,
+            'is_primary' => $isPrimary,
+            'parent' => $category->parent ? [
+                'id' => (int) $category->parent->id,
+                'slug' => (string) $category->parent->slug,
+                'name' => html_entity_decode((string) $category->parent->name, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
+                'content_type_slug' => (string) ($category->parent->contentType?->slug ?? ''),
+                'url' => $category->parent->contentType ? $category->parent->url : null,
+            ] : null,
+        ];
+    }
+
+    /**
+     * @param  list<int|string>  $ids
+     * @return list<int>
+     */
+    private function normalizeIds(array $ids): array
+    {
+        $normalized = [];
+
+        foreach ($ids as $id) {
+            $value = (int) $id;
+            if ($value > 0 && ! in_array($value, $normalized, true)) {
+                $normalized[] = $value;
+            }
+        }
+
+        return $normalized;
+    }
+
+    /**
+     * @return list<int>
+     */
+    private function existingSecondaryIds(Artwork $artwork, ?int $primaryCategoryId): array
+    {
+        return $artwork->categories()
+            ->pluck('categories.id')
+            ->map(static fn ($id): int => (int) $id)
+            ->reject(static fn (int $id): bool => $primaryCategoryId !== null && $id === $primaryCategoryId)
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @param  list<int>  $secondaryCategoryIds
+     */
+    private function persist(
+        Artwork $artwork,
+        ?int $primaryCategoryId,
+        array $secondaryCategoryIds,
+        ?string $source,
+        bool $reindex,
+    ): void {
+        $membershipIds = $primaryCategoryId === null
+            ? []
+            : array_values(array_unique([$primaryCategoryId, ...$secondaryCategoryIds]));
+
+        DB::transaction(function () use ($artwork, $primaryCategoryId, $membershipIds, $source): void {
+            $artwork->categories()->sync($membershipIds);
+            $artwork->primary_category_id = $primaryCategoryId;
+
+            if ($source !== null) {
+                $artwork->category_source = $source;
+            }
+
+            $artwork->save();
+        });
+
+        $artwork->unsetRelation('categories');
+        $artwork->unsetRelation('primaryCategory');
+
+        if (! $reindex) {
+            return;
+        }
+
+        DB::afterCommit(function () use ($artwork): void {
+            $this->artworkService->clearArtworkCache($artwork->fresh() ?? $artwork);
+            Cache::forget('categories.directory.v1');
+            $this->searchIndexer->update($artwork);
+        });
+    }
+}

app/Services/Artworks/ArtworkDraftService.php

@@ -17,12 +17,16 @@ final class ArtworkDraftService
 {
     public function __construct(
         private readonly GroupService $groups,
+        private readonly ArtworkCategoryService $categories,
     ) {
     }
 
-    public function createDraft(User $user, string $title, ?string $description, ?int $categoryId = null, bool $isMature = false, string|int|null $groupIdentifier = null): ArtworkDraftResult
+    /**
+     * @param  list<int>  $secondaryCategoryIds
+     */
+    public function createDraft(User $user, string $title, ?string $description, ?int $categoryId = null, bool $isMature = false, string|int|null $groupIdentifier = null, array $secondaryCategoryIds = []): ArtworkDraftResult
     {
-        return DB::transaction(function () use ($user, $title, $description, $categoryId, $isMature, $groupIdentifier) {
+        return DB::transaction(function () use ($user, $title, $description, $categoryId, $isMature, $groupIdentifier, $secondaryCategoryIds) {
             $slug = $this->makeSlug($title);
             $group = $this->resolveGroup($user, $groupIdentifier);
 
@@ -50,9 +54,8 @@ final class ArtworkDraftService
                 'artwork_status' => 'draft',
             ]);
 
-            // Attach the selected category to the artwork pivot table
-            if ($categoryId !== null && \App\Models\Category::where('id', $categoryId)->exists()) {
-                $artwork->categories()->sync([$categoryId]);
+            if ($categoryId !== null || $secondaryCategoryIds !== []) {
+                $this->categories->sync($artwork, $categoryId, $secondaryCategoryIds, 'user', false);
             }
 
             if ($group) {

app/Services/CollectionAiCurationService.php

@@ -140,7 +140,7 @@ class CollectionAiCurationService
                 ->first();
 
             $label = $tag?->name
-                ?: ($artwork->categories->first()?->name)
+                ?: ($artwork->resolvedPrimaryCategory()?->name)
                 ?: ($artwork->stats?->views ? 'Popular highlights' : 'Curated picks');
 
             if (! isset($themeBuckets[$label])) {
@@ -673,7 +673,7 @@ class CollectionAiCurationService
         $artworks = $this->candidateArtworks($collection, $draft, 36);
         $themes = $this->topThemes($artworks);
         $categories = $artworks
-            ->map(fn (Artwork $artwork) => $artwork->categories->first()?->name)
+            ->map(fn (Artwork $artwork) => $artwork->resolvedPrimaryCategory()?->name)
             ->filter()
             ->countBy()
             ->sortDesc();

app/Services/CollectionLinkService.php

@@ -95,7 +95,7 @@ class CollectionLinkService
                 'label' => (string) $artwork->title,
                 'description' => collect([
                     $artwork->user?->username ? '@' . strtolower((string) $artwork->user->username) : null,
-                    $artwork->categories->first()?->contentType?->name,
+                    $artwork->resolvedPrimaryCategory()?->contentType?->name,
                 ])->filter()->join(' • ') ?: 'Published artwork',
             ])
             ->values()
@@ -343,7 +343,7 @@ class CollectionLinkService
                 'title' => (string) $entity->title,
                 'subtitle' => collect([
                     $entity->user?->username ? '@' . strtolower((string) $entity->user->username) : null,
-                    $entity->categories->first()?->contentType?->name,
+                    $entity->resolvedPrimaryCategory()?->contentType?->name,
                 ])->filter()->join(' • ') ?: 'Artwork',
                 'description' => $link->relationship_type ?: 'Linked artwork',
                 'url' => route('art.show', [

app/Services/CollectionService.php

@@ -861,6 +861,14 @@ class CollectionService
             ? $collections
             : new EloquentCollection(is_array($collections) ? $collections : iterator_to_array($collections));
 
+        // The profile producer already eager-loads these relations. Keep the
+        // mapper safe for direct callers as well, so the card loop never
+        // triggers relation lazy-loading one collection at a time.
+        $collectionList->loadMissing([
+            'user:id,username,name',
+            'coverArtwork:id,user_id,title,slug,hash,thumb_ext,published_at,is_public,is_approved,deleted_at',
+        ]);
+
         $collectionIds = $collectionList->pluck('id')->map(static fn ($id) => (int) $id)->all();
         $hideMatureCovers = ! $ownerView && $this->viewerShouldHideMature($viewer);
 
@@ -879,12 +887,16 @@ class CollectionService
                 ->all()
             : [];
 
-        return $collectionList->map(function (Collection $collection) use ($ownerView, $viewer, $firstArtworkMap, $savedCollectionIds) {
+        return $collectionList->map(function (Collection $collection) use ($ownerView, $viewer, $firstArtworkMap, $savedCollectionIds, $hideMatureCovers) {
+            // Manual collections have their explicit cover eager-loaded. The
+            // already bulk-loaded first artwork map is the exact fallback
+            // used by resolvedCoverArtwork() when that cover is absent or not
+            // visible, so no per-card relation query is needed here.
             $resolvedCover = $collection->isSmart()
                 ? $this->smartCollections->firstArtwork($collection, $ownerView)
-                : $collection->resolvedCoverArtwork(! $ownerView, ! $ownerView && $this->viewerShouldHideMature($viewer));
+                : ($collection->relationLoaded('coverArtwork') ? $collection->coverArtwork : null);
             $fallbackCover = $firstArtworkMap->get((int) $collection->id);
-            $cover = $this->eligibleCoverArtwork($resolvedCover, ! $ownerView, ! $ownerView && $this->viewerShouldHideMature($viewer))
+            $cover = $this->eligibleCoverArtwork($resolvedCover, ! $ownerView, $hideMatureCovers)
                 ? $resolvedCover
                 : $fallbackCover;
             $summary = $collection->summary ?? $collection->description;
@@ -1264,7 +1276,7 @@ class CollectionService
 
     private function mapArtworkPayload(Artwork $artwork, array $extra = []): array
     {
-        $category = $artwork->categories->first();
+        $category = $artwork->resolvedPrimaryCategory();
         $contentType = $category?->contentType;
         $stats = $artwork->stats;
 

app/Services/CommentReactionService.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services;
+
+use App\Enums\ReactionType;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Bulk reaction read model for artwork comment trees.
+ *
+ * The returned value intentionally matches ReactionController's `totals`
+ * contract so SSR and API comment payloads can hydrate ReactionBar directly.
+ */
+final class CommentReactionService
+{
+    /**
+     * @param  iterable<int|string>  $commentIds
+     * @return array<int, array<string, array{emoji:string, label:string, count:int, mine:bool}>>
+     */
+    public function forComments(iterable $commentIds, ?int $userId = null): array
+    {
+        $ids = collect($commentIds)
+            ->map(static fn ($id): int => (int) $id)
+            ->filter(static fn (int $id): bool => $id > 0)
+            ->unique()
+            ->values()
+            ->all();
+
+        if ($ids === []) {
+            return [];
+        }
+
+        $counts = DB::table('comment_reactions')
+            ->whereIn('comment_id', $ids)
+            ->selectRaw('comment_id, reaction, COUNT(*) as total')
+            ->groupBy('comment_id', 'reaction')
+            ->get()
+            ->groupBy('comment_id');
+
+        $mine = collect();
+        if ($userId !== null) {
+            $mine = DB::table('comment_reactions')
+                ->whereIn('comment_id', $ids)
+                ->where('user_id', $userId)
+                ->get(['comment_id', 'reaction'])
+                ->groupBy('comment_id');
+        }
+
+        $result = [];
+        foreach ($ids as $commentId) {
+            $commentCounts = $counts->get($commentId, collect())->keyBy('reaction');
+            $commentMine = $mine->get($commentId, collect())->pluck('reaction')->flip();
+
+            $totals = [];
+            foreach (ReactionType::cases() as $type) {
+                $slug = $type->value;
+                $totals[$slug] = [
+                    'emoji' => $type->emoji(),
+                    'label' => $type->label(),
+                    'count' => (int) ($commentCounts->get($slug)->total ?? 0),
+                    'mine' => $commentMine->has($slug),
+                ];
+            }
+
+            $result[$commentId] = $totals;
+        }
+
+        return $result;
+    }
+}

app/Services/CommunityActivityService.php

@@ -33,8 +33,10 @@ final class CommunityActivityService
     public function getFeed(?User $viewer, string $filter = self::FILTER_ALL, int $page = 1, int $perPage = self::DEFAULT_PER_PAGE, ?int $actorUserId = null): array
     {
         $normalizedFilter = $this->normalizeFilter($filter);
-        $resolvedPage = max(1, $page);
-        $resolvedPerPage = max(1, min(50, $perPage));
+        $resolvedPage = $viewer ? max(1, $page) : 1;
+        $resolvedPerPage = $viewer
+            ? max(1, min(50, $perPage))
+            : 20;
 
         $cacheKey = sprintf(
             'community_activity:%s:%d:%d:%d:%d',
@@ -68,20 +70,55 @@ final class CommunityActivityService
 
     private function buildFeed(?User $viewer, string $filter, int $page, int $perPage, ?int $actorUserId): array
     {
-        $sourceLimit = max(80, $page * $perPage * 6);
+        // Guests only receive the latest page. Since every source is ordered
+        // newest-first, one page per source is sufficient to produce the
+        // globally newest page after merging, while avoiding historical
+        // over-fetching for anonymous traffic.
+        $sourceLimit = $viewer === null
+            ? $perPage
+            : max(80, $page * $perPage * 6);
         $followingIds = $filter === self::FILTER_FOLLOWING && $viewer
             ? $viewer->following()->pluck('users.id')->map(fn ($id) => (int) $id)->all()
             : [];
+        $actorIds = match ($filter) {
+            self::FILTER_FOLLOWING => $followingIds,
+            self::FILTER_MY => $viewer ? [(int) $viewer->id] : [],
+            default => null,
+        };
 
-        $commentModels = $this->fetchCommentModels($sourceLimit, repliesOnly: false);
-        $replyModels = $this->fetchCommentModels($sourceLimit, repliesOnly: true);
-        $reactionModels = $this->fetchReactionModels($sourceLimit);
-        $recordedActivities = $this->fetchRecordedActivities($sourceLimit);
+        if ($actorUserId !== null) {
+            $actorIds = $actorIds === null
+                ? [(int) $actorUserId]
+                : array_values(array_intersect($actorIds, [(int) $actorUserId]));
+        }
+
+        // A comments/replies feed can only contain its matching comment type.
+        // Avoid loading and hydrating the other activity sources only to discard
+        // them in the merge filter below. Actor-scoped filters also constrain
+        // each source query while preserving the final in-memory safety filter.
+        $commentModels = in_array($filter, [self::FILTER_ALL, self::FILTER_COMMENTS, self::FILTER_FOLLOWING, self::FILTER_MY], true)
+            ? $this->fetchCommentModels($sourceLimit, repliesOnly: false, actorIds: $actorIds)
+            : collect();
+        $replyModels = in_array($filter, [self::FILTER_ALL, self::FILTER_REPLIES, self::FILTER_FOLLOWING, self::FILTER_MY], true)
+            ? $this->fetchCommentModels($sourceLimit, repliesOnly: true, actorIds: $actorIds)
+            : collect();
+        $reactionModels = in_array($filter, [self::FILTER_ALL, self::FILTER_FOLLOWING, self::FILTER_MY], true)
+            ? $this->fetchReactionModels($sourceLimit, actorIds: $actorIds)
+            : collect();
+        $recordedActivities = in_array($filter, [self::FILTER_ALL, self::FILTER_FOLLOWING, self::FILTER_MY], true)
+            ? $this->fetchRecordedActivities($sourceLimit, actorIds: $actorIds)
+            : collect();
 
         $commentActivities = $commentModels->map(fn (ArtworkComment $comment) => $this->mapCommentActivity($comment, 'comment'));
         $replyActivities = $replyModels->map(fn (ArtworkComment $comment) => $this->mapCommentActivity($comment, 'reply'));
         $reactionActivities = $reactionModels->map(fn (CommentReaction $reaction) => $this->mapReactionActivity($reaction));
-        $mentionActivities = $this->fetchMentionActivities($sourceLimit);
+        $mentionActivities = in_array($filter, [self::FILTER_ALL, self::FILTER_FOLLOWING, self::FILTER_MY], true)
+            ? $this->fetchMentionActivities(
+                $sourceLimit,
+                actorIds: $actorIds,
+                mentionedUserId: $filter === self::FILTER_MY ? $viewer?->id : null,
+            )
+            : collect();
 
         $merged = $recordedActivities
             ->concat($commentActivities)
@@ -140,7 +177,7 @@ final class CommunityActivityService
         ];
     }
 
-    private function fetchRecordedActivities(int $limit): Collection
+    private function fetchRecordedActivities(int $limit, ?array $actorIds = null): Collection
     {
         $events = ActivityEvent::query()
             ->select(['id', 'actor_id', 'type', 'target_type', 'target_id', 'meta', 'created_at'])
@@ -153,6 +190,7 @@ final class CommunityActivityService
                 },
             ])
             ->whereHas('actor', fn ($query) => $query->where('is_active', true)->whereNull('deleted_at'))
+            ->when($actorIds !== null, fn ($query) => $query->whereIn('actor_id', $actorIds))
             ->latest('created_at')
             ->limit($limit)
             ->get();
@@ -223,7 +261,7 @@ final class CommunityActivityService
             ->values();
     }
 
-    private function fetchCommentModels(int $limit, bool $repliesOnly): Collection
+    private function fetchCommentModels(int $limit, bool $repliesOnly, ?array $actorIds = null): Collection
     {
         return ArtworkComment::query()
             ->select([
@@ -250,6 +288,7 @@ final class CommunityActivityService
             ])
             ->where('is_approved', true)
             ->whereNull('deleted_at')
+            ->when($actorIds !== null, fn ($query) => $query->whereIn('user_id', $actorIds))
             ->when($repliesOnly, fn ($query) => $query->whereNotNull('parent_id'), fn ($query) => $query->whereNull('parent_id'))
             ->whereHas('user', function ($query) {
                 $query->where('is_active', true)->whereNull('deleted_at');
@@ -262,7 +301,7 @@ final class CommunityActivityService
             ->get();
     }
 
-    private function fetchReactionModels(int $limit): Collection
+    private function fetchReactionModels(int $limit, ?array $actorIds = null): Collection
     {
         return CommentReaction::query()
             ->select(['id', 'comment_id', 'user_id', 'reaction', 'created_at'])
@@ -292,6 +331,7 @@ final class CommunityActivityService
             ->whereHas('user', function ($query) {
                 $query->where('is_active', true)->whereNull('deleted_at');
             })
+            ->when($actorIds !== null, fn ($query) => $query->whereIn('user_id', $actorIds))
             ->whereHas('comment', function ($query) {
                 $query
                     ->where('is_approved', true)
@@ -395,7 +435,7 @@ final class CommunityActivityService
         ];
     }
 
-    private function fetchMentionActivities(int $limit): Collection
+    private function fetchMentionActivities(int $limit, ?array $actorIds = null, ?int $mentionedUserId = null): Collection
     {
         if (! Schema::hasTable('user_mentions')) {
             return collect();
@@ -403,6 +443,15 @@ final class CommunityActivityService
 
         return UserMention::query()
             ->select(['id', 'user_id', 'mentioned_user_id', 'artwork_id', 'comment_id', 'created_at'])
+            ->when($actorIds !== null, function ($query) use ($actorIds, $mentionedUserId): void {
+                $query->where(function ($scope) use ($actorIds, $mentionedUserId): void {
+                    $scope->whereIn('user_id', $actorIds);
+
+                    if ($mentionedUserId !== null) {
+                        $scope->orWhere('mentioned_user_id', $mentionedUserId);
+                    }
+                });
+            })
             ->with([
                 'actor' => function ($query) {
                     $query

app/Services/FollowService.php

@@ -7,6 +7,7 @@ use App\Services\Activity\UserActivityService;
 use App\Events\Achievements\AchievementCheckRequested;
 use App\Services\FollowAnalyticsService;
 use App\Support\AvatarUrl;
+use Illuminate\Contracts\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 
@@ -160,6 +161,38 @@ final class FollowService
             ->value('followers_count');
     }
 
+    /**
+     * People who follow $userId (user_id = the profile owner being followed).
+     *
+     * @return LengthAwarePaginator<int, array<string, mixed>>
+     */
+    public function paginatedFollowers(int $userId, int $perPage = 24, int $page = 1): LengthAwarePaginator
+    {
+        return $this->paginateFollowRelationship(
+            ownerColumn: 'uf.user_id',
+            relatedUserColumn: 'uf.follower_id',
+            ownerId: $userId,
+            perPage: $perPage,
+            page: $page,
+        );
+    }
+
+    /**
+     * People $userId follows (follower_id = the profile owner).
+     *
+     * @return LengthAwarePaginator<int, array<string, mixed>>
+     */
+    public function paginatedFollowing(int $userId, int $perPage = 24, int $page = 1): LengthAwarePaginator
+    {
+        return $this->paginateFollowRelationship(
+            ownerColumn: 'uf.follower_id',
+            relatedUserColumn: 'uf.user_id',
+            ownerId: $userId,
+            perPage: $perPage,
+            page: $page,
+        );
+    }
+
     public function followingCount(int $userId): int
     {
         return (int) DB::table('user_statistics')
@@ -216,6 +249,58 @@ final class FollowService
 
     // ─── Private helpers ─────────────────────────────────────────────────────
 
+    /**
+     * @return LengthAwarePaginator<int, array<string, mixed>>
+     */
+    private function paginateFollowRelationship(
+        string $ownerColumn,
+        string $relatedUserColumn,
+        int $ownerId,
+        int $perPage,
+        int $page,
+    ): LengthAwarePaginator {
+        $perPage = max(1, min($perPage, 100));
+        $page = max(1, $page);
+
+        return DB::table('user_followers as uf')
+            ->join('users as u', 'u.id', '=', $relatedUserColumn)
+            ->leftJoin('user_profiles as up', 'up.user_id', '=', 'u.id')
+            ->where($ownerColumn, $ownerId)
+            ->whereNull('u.deleted_at')
+            ->orderByDesc('uf.created_at')
+            ->select([
+                'u.id',
+                'u.username',
+                'u.name',
+                'u.level',
+                'u.rank',
+                'up.avatar_hash',
+                'uf.created_at as followed_at',
+            ])
+            ->paginate($perPage, ['*'], 'page', $page)
+            ->through(fn ($row) => $this->mapPublicFollowUser($row));
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapPublicFollowUser(object $row): array
+    {
+        $username = (string) ($row->username ?? '');
+
+        return [
+            'id' => (int) $row->id,
+            'username' => $username,
+            'name' => (string) ($row->name ?? $username),
+            'display_name' => $username !== '' ? $username : (string) ($row->name ?? ''),
+            'avatar_url' => AvatarUrl::forUser((int) $row->id, $row->avatar_hash ?? null, 50),
+            'profile_url' => '/@' . strtolower($username !== '' ? $username : (string) $row->id),
+            'followed_at' => $row->followed_at,
+            'level' => (int) ($row->level ?? 1),
+            'rank' => (string) ($row->rank ?? 'Newbie'),
+        ];
+    }
+
     private function incrementCounter(int $userId, string $column): void
     {
         DB::table('user_statistics')->updateOrInsert(

app/Services/GroupArtworkReviewService.php

@@ -10,6 +10,7 @@ use App\Models\Group;
 use App\Jobs\IndexArtworkJob;
 use App\Models\Tag;
 use App\Models\User;
+use App\Services\Artworks\ArtworkCategoryService;
 use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
@@ -23,6 +24,7 @@ class GroupArtworkReviewService
         private readonly GroupHistoryService $history,
         private readonly NotificationService $notifications,
         private readonly GroupMembershipService $memberships,
+        private readonly ArtworkCategoryService $artworkCategories,
     ) {
     }
 
@@ -108,6 +110,10 @@ class GroupArtworkReviewService
             'group_reviewed_at' => now(),
             'group_review_notes' => $notes,
             'is_approved' => true,
+            'approval_source' => 'moderator',
+            'moderated_at' => now(),
+            'moderated_by' => $actor->id,
+            'moderation_note' => $notes,
             'artwork_status' => 'published',
             'published_at' => now(),
             'publish_at' => null,
@@ -363,9 +369,20 @@ class GroupArtworkReviewService
         $artwork->uploaded_by_user_id = $artwork->uploaded_by_user_id ?: (int) $actor->id;
         $artwork->primary_author_user_id = $artwork->primary_author_user_id ?: (int) $actor->id;
 
-        $categoryId = isset($validated['category']) ? (int) $validated['category'] : null;
-        if ($categoryId > 0 && Category::query()->where('id', $categoryId)->exists()) {
-            $artwork->categories()->sync([$categoryId]);
+        $categoryId = isset($validated['primary_category_id'])
+            ? (int) $validated['primary_category_id']
+            : (isset($validated['category']) ? (int) $validated['category'] : null);
+        $secondaryCategoryIds = array_key_exists('secondary_category_ids', $validated)
+            ? array_values(array_map('intval', (array) $validated['secondary_category_ids']))
+            : [];
+        if ($categoryId > 0) {
+            $this->artworkCategories->sync(
+                $artwork,
+                $categoryId,
+                $secondaryCategoryIds,
+                'user',
+                false,
+            );
         }
 
         if (array_key_exists('tags', $validated) && is_array($validated['tags'])) {

app/Services/Metrics/ArtworkHourlySnapshotWindow.php

@@ -102,42 +102,48 @@ final class ArtworkHourlySnapshotWindow
      */
     public function artworkPeriodDeltas(CarbonInterface|\DateTimeInterface $start, ?int $userId = null): Builder
     {
-        $inWindow = DB::table('artwork_metric_snapshots_hourly as snapshots');
-        $this->constrainOwner($inWindow, $userId);
-        $inWindow
-            ->where('snapshots.bucket_hour', '>=', $start)
-            ->groupBy('snapshots.artwork_id')
-            ->select('snapshots.artwork_id')
-            ->selectRaw('MAX(snapshots.views_count) as views_latest')
-            ->selectRaw('MIN(snapshots.views_count) as views_min')
-            ->selectRaw('MAX(snapshots.downloads_count) as downloads_latest')
-            ->selectRaw('MIN(snapshots.downloads_count) as downloads_min')
-            ->selectRaw('MAX(snapshots.favourites_count) as favourites_latest')
-            ->selectRaw('MIN(snapshots.favourites_count) as favourites_min')
-            ->selectRaw('MAX(snapshots.comments_count) as comments_latest')
-            ->selectRaw('MIN(snapshots.comments_count) as comments_min')
-            ->selectRaw('MAX(snapshots.shares_count) as shares_latest')
-            ->selectRaw('MIN(snapshots.shares_count) as shares_min');
+        $start = \Carbon\Carbon::parse($start);
+        $baselineFrom = (clone $start)->subHours(self::BASELINE_LOOKBACK_HOURS);
 
-        $baselineFrom = \Carbon\Carbon::parse($start)->subHours(self::BASELINE_LOOKBACK_HOURS);
-        $baseline = DB::table('artwork_metric_snapshots_hourly as snapshots');
-        $this->constrainOwner($baseline, $userId);
-        $baseline
-            ->where('snapshots.bucket_hour', '<', $start)
-            ->where('snapshots.bucket_hour', '>=', $baselineFrom)
-            ->groupBy('snapshots.artwork_id')
-            ->select('snapshots.artwork_id')
-            ->selectRaw('MAX(snapshots.views_count) as views_baseline')
-            ->selectRaw('MAX(snapshots.downloads_count) as downloads_baseline')
-            ->selectRaw('MAX(snapshots.favourites_count) as favourites_baseline')
-            ->selectRaw('MAX(snapshots.comments_count) as comments_baseline')
-            ->selectRaw('MAX(snapshots.shares_count) as shares_baseline');
+        // Resolve the three global hourly buckets first. These are cheap indexed
+        // lookups and avoid aggregating millions of cumulative snapshot rows.
+        $latestBucket = DB::table('artwork_metric_snapshots_hourly')
+            ->where('bucket_hour', '>=', $start)
+            ->max('bucket_hour');
+
+        $firstBucket = DB::table('artwork_metric_snapshots_hourly')
+            ->where('bucket_hour', '>=', $start)
+            ->min('bucket_hour');
+
+        $baselineBucket = DB::table('artwork_metric_snapshots_hourly')
+            ->where('bucket_hour', '<', $start)
+            ->where('bucket_hour', '>=', $baselineFrom)
+            ->max('bucket_hour');
+
+        $latest = $this->exactBucketSnapshot(
+            $latestBucket,
+            $userId,
+            'latest',
+        );
+
+        $first = $this->exactBucketSnapshot(
+            $firstBucket,
+            $userId,
+            'min',
+        );
+
+        $baseline = $this->exactBucketSnapshot(
+            $baselineBucket,
+            $userId,
+            'baseline',
+        );
 
         $bornSql = $this->quotedTimestamp($start);
 
         return DB::query()
-            ->fromSub($inWindow, 'win')
+            ->fromSub($latest, 'win')
             ->leftJoinSub($baseline, 'base', 'base.artwork_id', '=', 'win.artwork_id')
+            ->leftJoinSub($first, 'first', 'first.artwork_id', '=', 'win.artwork_id')
             ->join('artworks', 'artworks.id', '=', 'win.artwork_id')
             ->select('win.artwork_id')
             ->selectRaw($this->deltaExpression('views', $bornSql) . ' as views_delta')
@@ -147,6 +153,7 @@ final class ArtworkHourlySnapshotWindow
             ->selectRaw($this->deltaExpression('shares', $bornSql) . ' as shares_delta');
     }
 
+
     /**
      * @return array{oldest_bucket: ?string, newest_bucket: ?string, coverage_days: float, window_complete: bool, requested_days: int}
      */
@@ -194,6 +201,34 @@ final class ArtworkHourlySnapshotWindow
             ->whereNull('owner_artworks.deleted_at');
     }
 
+    private function exactBucketSnapshot(
+        ?string $bucket,
+        ?int $userId,
+        string $suffix,
+    ): Builder {
+        $query = DB::table('artwork_metric_snapshots_hourly as snapshots');
+
+        if (DB::connection()->getDriverName() === 'mysql') {
+            $query->forceIndex('idx_bucket_artwork');
+        }
+
+        $this->constrainOwner($query, $userId);
+
+        if ($bucket === null) {
+            $query->whereRaw('1 = 0');
+        } else {
+            $query->where('snapshots.bucket_hour', $bucket);
+        }
+
+        return $query
+            ->select('snapshots.artwork_id')
+            ->selectRaw("snapshots.views_count as views_{$suffix}")
+            ->selectRaw("snapshots.downloads_count as downloads_{$suffix}")
+            ->selectRaw("snapshots.favourites_count as favourites_{$suffix}")
+            ->selectRaw("snapshots.comments_count as comments_{$suffix}")
+            ->selectRaw("snapshots.shares_count as shares_{$suffix}");
+    }
+
     private function quotedTimestamp(CarbonInterface|\DateTimeInterface $start): string
     {
         return DB::getPdo()->quote(\Carbon\Carbon::parse($start)->toDateTimeString());
@@ -202,7 +237,7 @@ final class ArtworkHourlySnapshotWindow
     private function deltaExpression(string $metric, string $bornSql): string
     {
         $latest = "COALESCE(win.{$metric}_latest, 0)";
-        $min = "COALESCE(win.{$metric}_min, 0)";
+        $min = "COALESCE(first.{$metric}_min, 0)";
         $base = "base.{$metric}_baseline";
         $bornInWindow = "COALESCE(artworks.published_at, artworks.created_at) >= {$bornSql}";
         $observed = $this->clampNonNegative("{$latest} - {$min}");

app/Services/Moderation/ArtworkUploadPolicy.php

@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Moderation;
+
+use App\Models\Artwork;
+use App\Models\User;
+
+final class ArtworkUploadPolicy
+{
+    /** @return array{requires_review: bool, reasons: array<int, string>, approved_uploads: int} */
+    public function assess(User $user, ?Artwork $artwork = null): array
+    {
+        if ($user->isAdmin()) {
+            return ['requires_review' => false, 'reasons' => [], 'approved_uploads' => PHP_INT_MAX];
+        }
+
+        $approvedUploads = $this->approvedArtworkCount($user, $artwork);
+        $minimumApproved = max(1, (int) config('uploads.moderation.minimum_approved_uploads', 5));
+
+        $reasons = [];
+
+        if ($approvedUploads < $minimumApproved) {
+            $reasons[] = 'insufficient_approved_uploads';
+
+            if ($user->email_verified_at === null) {
+                $reasons[] = 'email_not_verified';
+            }
+
+            $minimumAgeDays = max(0, (int) config('uploads.moderation.minimum_account_age_days', 7));
+            if ($user->created_at?->gt(now()->subDays($minimumAgeDays))) {
+                $reasons[] = 'new_account';
+            }
+
+            if ((int) ($user->level ?? 1) <= (int) config('uploads.moderation.maximum_untrusted_level', 1)) {
+                $reasons[] = 'low_level';
+            }
+
+            if ((int) ($user->bot_risk_score ?? 0) >= (int) config('uploads.moderation.bot_risk_review_threshold', 40)) {
+                $reasons[] = 'bot_risk';
+            }
+
+            if ((int) ($user->spam_reports ?? 0) > 0) {
+                $reasons[] = 'spam_reports';
+            }
+        }
+
+        if ($artwork && $this->looksPromotional($artwork)) {
+            $reasons[] = 'promotional_content';
+        }
+
+        return [
+            'requires_review' => $reasons !== [],
+            'reasons' => array_values(array_unique($reasons)),
+            'approved_uploads' => $approvedUploads,
+        ];
+    }
+
+    private function approvedArtworkCount(User $user, ?Artwork $artwork): int
+    {
+        $query = $user->artworks()
+            ->where('is_approved', true)
+            ->whereNotNull('published_at')
+            ->where(function ($status): void {
+                $status->whereNull('artwork_status')
+                    ->orWhereNotIn('artwork_status', ['review', 'rejected', 'scheduled', 'draft']);
+            })
+            ->where(function ($source): void {
+                $source->whereNull('approval_source')
+                    ->orWhere('approval_source', 'moderator');
+            });
+
+        if ($artwork?->exists) {
+            $query->whereKeyNot($artwork->getKey());
+        }
+
+        return (int) $query->count();
+    }
+
+    private function looksPromotional(Artwork $artwork): bool
+    {
+        $text = strtolower(implode(' ', [
+            (string) $artwork->title,
+            (string) $artwork->description,
+            (string) $artwork->file_name,
+        ]));
+
+        foreach ((array) config('uploads.moderation.promotional_patterns', []) as $pattern) {
+            if ($pattern !== '' && str_contains($text, strtolower((string) $pattern))) {
+                return true;
+            }
+        }
+
+        return (bool) preg_match('/(?:https?:\/\/|www\.|\b[a-z0-9-]+\.(?:com|net|org|io|co)\b)/i', $text);
+    }
+}

app/Services/Moderation/CommentSpamService.php

@@ -0,0 +1,179 @@
+<?php
+
+namespace App\Services\Moderation;
+
+use App\Contracts\Moderation\CommentSpamClassifier;
+use App\Models\ArtworkComment;
+use App\Models\CommentSpamSignature;
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Schema;
+use Throwable;
+
+class CommentSpamService
+{
+    public function __construct(
+        private readonly ContentModerationProcessingService $processing,
+        private readonly CommentSpamClassifier $ai,
+    ) {}
+
+    /**
+     * Classify after the comment exists, so the existing moderation queue can
+     * retain the full source context and admin review workflow.
+     *
+     * @return array{status:string, score:int, probability:int, source:string, reason:string}
+     */
+    public function moderate(ArtworkComment $comment, User $user, ?string $mode = null): array
+    {
+        $mode ??= (string) config('comment_spam.mode', 'enforce');
+        $content = (string) ($comment->raw_content ?? $comment->content ?? '');
+        $hash = hash('sha256', $this->normalize($content));
+
+        if (! (bool) config('comment_spam.enabled', true) || $mode === 'off') {
+            return $this->saveMetadata($comment, 0, 0, 'disabled', 'Comment spam protection disabled.');
+        }
+
+        $signature = $this->signature($hash);
+        if ($signature !== null) {
+            $this->recordSignatureHit($signature);
+            $isSpam = ($signature->source === 'spam' || $signature->source === 'admin_spam');
+
+            return $this->finish($comment, $mode, $isSpam ? 100 : 0, $isSpam ? 100 : 0, 'signature', (string) $signature->reason, $isSpam);
+        }
+
+        $scan = $this->processing->process($content, [
+            'content_type' => 'artwork_comment',
+            'content_id' => (int) $comment->id,
+            'artwork_id' => (int) $comment->artwork_id,
+            'user_id' => (int) $user->id,
+            'content_snapshot' => $content,
+            'comment_spam_mode' => $mode,
+        ], true);
+
+        $local = (int) $scan['result']->score;
+        $probability = $local;
+        $source = 'local';
+        $reason = implode(' ', array_slice($scan['result']->reasons, 0, 2));
+        $isSpam = $local >= (int) config('comment_spam.local_spam_min', 70);
+        $needsAi = $local > (int) config('comment_spam.local_safe_max', 29) && ! $isSpam;
+        $aiPending = false;
+
+        // Repeated external links and explicit copy/paste promotions are
+        // deterministic spam signals. Do not let an AI false negative make
+        // an obvious advertisement public.
+        if ($this->isObviousPromotionalSpam($content, (array) $scan['result']->matchedLinks)) {
+            $local = max($local, (int) config('comment_spam.local_spam_min', 70));
+            $probability = 100;
+            $isSpam = true;
+            $needsAi = false;
+            $source = 'local_hard_rule';
+            $reason = trim($reason.' Repeated promotional external link pattern.');
+        }
+
+        if ($needsAi && (bool) config('comment_spam.ai_enabled', true)) {
+            try {
+                $assessment = $this->ai->classify($content);
+                $probability = $assessment->spam
+                    ? max($local, (int) round($assessment->confidence * 100))
+                    : $local;
+                $source = 'local+ai';
+                $reason = trim(implode(' ', array_filter([$reason, $assessment->reason])));
+                $isSpam = $assessment->spam && $assessment->confidence >= (float) config('comment_spam.ai.spam_confidence', 0.90);
+                $aiPending = $assessment->spam && ! $isSpam;
+                Log::info('comment_spam_ai_classification', ['comment_id' => $comment->id, 'provider' => $assessment->provider, 'model' => $assessment->model, 'spam' => $assessment->spam, 'confidence' => $assessment->confidence, 'latency_ms' => $assessment->latencyMs, 'decision' => $isSpam ? 'spam' : ($assessment->spam ? 'pending' : 'approved')]);
+            } catch (Throwable) {
+                $source = 'local+ai_error';
+                $aiPending = true;
+            }
+        }
+
+        $status = $mode === 'observe'
+            ? 'observed'
+            : ($isSpam ? 'spam' : ($needsAi && $aiPending ? 'pending' : 'approved'));
+
+        $comment->forceFill([
+            'is_approved' => $mode === 'enforce' ? ! in_array($status, ['spam', 'pending'], true) : true,
+            'spam_score' => min(100, $local),
+            'spam_probability' => min(100, $probability),
+            'spam_reason' => $reason !== '' ? mb_substr($reason, 0, 500) : null,
+            'moderation_source' => $source,
+            'moderated_at' => now(),
+        ])->save();
+
+        if ($mode === 'enforce' && $status === 'spam') {
+            $this->rememberSignature($hash, 'spam', $reason, $probability);
+        }
+
+        return compact('status', 'local', 'probability', 'source', 'reason') + ['score' => $local];
+    }
+
+    private function finish(ArtworkComment $comment, string $mode, int $score, int $probability, string $source, string $reason, ?bool $isSpam = null): array
+    {
+        $isSpam ??= $score >= (int) config('comment_spam.local_spam_min', 70);
+        $status = $mode === 'observe' ? 'observed' : ($isSpam ? 'spam' : 'approved');
+        $comment->forceFill([
+            'is_approved' => $mode !== 'enforce' || ! $isSpam,
+            'spam_score' => $score,
+            'spam_probability' => $probability,
+            'spam_reason' => mb_substr($reason, 0, 500),
+            'moderation_source' => $source,
+            'moderated_at' => now(),
+        ])->save();
+
+        return compact('status', 'score', 'probability', 'source', 'reason');
+    }
+
+    private function saveMetadata(ArtworkComment $comment, int $score, int $probability, string $source, string $reason): array
+    {
+        $comment->forceFill(['spam_score' => $score, 'spam_probability' => $probability, 'spam_reason' => $reason, 'moderation_source' => $source, 'moderated_at' => now()])->save();
+
+        return ['status' => 'approved', 'score' => $score, 'probability' => $probability, 'source' => $source, 'reason' => $reason];
+    }
+
+    private function signature(string $hash): ?CommentSpamSignature
+    {
+        return Cache::remember('comment-spam:'.$hash, now()->addMinutes((int) config('comment_spam.signature_cache_minutes', 1440)), fn () => CommentSpamSignature::query()->where('content_hash', $hash)->first());
+    }
+
+    private function recordSignatureHit(CommentSpamSignature $signature): void
+    {
+        try {
+            if (! Schema::hasColumn('comment_spam_signatures', 'hit_count')) {
+                return;
+            }
+
+            CommentSpamSignature::query()->whereKey($signature->getKey())->increment('hit_count');
+        } catch (Throwable $e) {
+            Log::warning('comment_spam_signature_hit_failed', [
+                'signature_id' => $signature->getKey(),
+                'message' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    private function rememberSignature(string $hash, string $source, string $reason, int $confidence): void
+    {
+        CommentSpamSignature::query()->updateOrCreate(['content_hash' => $hash], ['source' => $source, 'reason' => mb_substr($reason, 0, 500), 'confidence' => min(100, $confidence), 'created_at' => now()]);
+        Cache::forget('comment-spam:'.$hash);
+    }
+
+    private function normalize(string $content): string
+    {
+        return mb_strtolower((string) preg_replace('/\s+/u', ' ', trim($content)));
+    }
+
+    private function isObviousPromotionalSpam(string $content, array $matchedLinks): bool
+    {
+        $links = array_values(array_unique(array_map(
+            fn (string $link): string => mb_strtolower(trim($link)),
+            array_filter($matchedLinks, 'is_string'),
+        )));
+        preg_match_all('#https?://[^\s<>\[\]"\'`\)]+#iu', $content, $matches);
+        $allLinks = array_map('mb_strtolower', $matches[0] ?? []);
+        $hasRepeatedLink = count($allLinks) >= 2 && count(array_unique($allLinks)) < count($allLinks);
+        $hasPromotion = preg_match('/\b(copy\s*(?:&|and)\s*paste|buy\s+now|cheap\s+seo|guaranteed\s+traffic|visit\s+my\s+profile)\b/iu', $content) === 1;
+
+        return $hasRepeatedLink || ($hasPromotion && $links !== []);
+    }
+}

app/Services/Moderation/ContentModerationPersistenceService.php

@@ -3,8 +3,8 @@
 namespace App\Services\Moderation;
 
 use App\Data\Moderation\ModerationResultData;
-use App\Enums\ModerationEscalationStatus;
 use App\Enums\ModerationContentType;
+use App\Enums\ModerationEscalationStatus;
 use App\Enums\ModerationStatus;
 use App\Models\ContentModerationAiSuggestion;
 use App\Models\ContentModerationFinding;
@@ -14,8 +14,7 @@ class ContentModerationPersistenceService
     public function __construct(
         private readonly ContentModerationReviewService $review,
         private readonly ContentModerationActionLogService $actionLogs,
-    ) {
-    }
+    ) {}
 
     public function shouldQueue(ModerationResultData $result): bool
     {
@@ -56,7 +55,7 @@ class ContentModerationPersistenceService
             return ['finding' => null, 'created' => false, 'updated' => false];
         }
 
-        $finding = $existing ?? new ContentModerationFinding();
+        $finding = $existing ?? new ContentModerationFinding;
         $isNew = ! $finding->exists;
 
         $finding->fill([
@@ -148,6 +147,12 @@ class ContentModerationPersistenceService
      */
     public function applyAutomatedActionIfNeeded(ContentModerationFinding $finding, ModerationResultData $result, array $context): bool
     {
+        if (($context['comment_spam_mode'] ?? null) === 'observe') {
+            $finding->forceFill(['auto_action_taken' => 'observe_only'])->save();
+
+            return false;
+        }
+
         if (! $result->autoHideRecommended) {
             return false;
         }

app/Services/Moderation/TogetherCommentSpamClassifier.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Services\Moderation;
+
+use App\Contracts\Moderation\CommentSpamClassifier;
+use App\Data\Moderation\CommentSpamClassification;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+final class TogetherCommentSpamClassifier implements CommentSpamClassifier
+{
+    public function classify(string $content): CommentSpamClassification
+    {
+        $config = (array) config('comment_spam.ai', []);
+        $key = (string) ($config['api_key'] ?? '');
+        $model = (string) ($config['model'] ?? '');
+        if ($key === '' || $model === '') {
+            throw new RuntimeException('Together AI is not configured.');
+        }
+        if (! in_array($model, (array) ($config['allowed_models'] ?? []), true)) {
+            throw new RuntimeException('Unsupported Together AI comment spam model.');
+        }
+
+        $started = microtime(true);
+        $response = Http::timeout(min(5, max(1, (int) ($config['timeout'] ?? 5))))
+            ->withToken($key)
+            ->post(rtrim((string) ($config['base_url'] ?? 'https://api.together.xyz/v1'), '/').'/chat/completions', [
+                'model' => $model,
+                'temperature' => 0,
+                'response_format' => ['type' => 'json_object'],
+                'messages' => [
+                    ['role' => 'system', 'content' => 'Classify the comment as spam or not spam. Return only JSON: {"spam":true|false,"confidence":0.0,"reason":"short explanation"}. Confidence must be a number from 0 to 1. Spam includes advertising, SEO promotion, unsolicited links, scams, and bot-like promotional repetition.'],
+                    ['role' => 'user', 'content' => mb_substr($content, 0, (int) ($config['max_input_chars'] ?? 2500))],
+                ],
+            ]);
+
+        if ($response->failed()) {
+            throw new RuntimeException('Together AI request failed with status '.$response->status().'.');
+        }
+
+        $message = Arr::get($response->json(), 'choices.0.message.content');
+        $decoded = is_string($message) ? json_decode($message, true) : null;
+        if (! is_array($decoded) || ! is_bool($decoded['spam'] ?? null)
+            || ! is_numeric($decoded['confidence'] ?? null)
+            || $decoded['confidence'] < 0 || $decoded['confidence'] > 1
+            || ! is_string($decoded['reason'] ?? null)) {
+            throw new RuntimeException('Together AI returned invalid moderation JSON.');
+        }
+
+        return new CommentSpamClassification(
+            $decoded['spam'],
+            (float) $decoded['confidence'],
+            mb_substr(trim($decoded['reason']), 0, 500),
+            'together',
+            $model,
+            (int) round((microtime(true) - $started) * 1000),
+        );
+    }
+}

app/Services/NotificationService.php

@@ -359,6 +359,60 @@ final class NotificationService
         ]);
     }
 
+    public function notifyArtworkApproved(User $recipient, User $actor, \App\Models\Artwork $artwork): ?Notification
+    {
+        if ($recipient->id === $actor->id) {
+            return null;
+        }
+
+        $title = (string) ($artwork->title ?: 'Untitled artwork');
+
+        return Notification::query()->create([
+            'user_id' => (int) $recipient->id,
+            'type' => 'artwork_approved',
+            'data' => [
+                'type' => 'artwork_approved',
+                'actor_id' => (int) $actor->id,
+                'actor_name' => $actor->name,
+                'actor_username' => $actor->username,
+                'message' => 'Your artwork "'.$title.'" was approved and is now live.',
+                'url' => route('art.show', ['id' => $artwork->id, 'slug' => $artwork->slug ?: $artwork->id]),
+                'artwork_id' => (int) $artwork->id,
+                'artwork_title' => $title,
+            ],
+        ]);
+    }
+
+    public function notifyArtworkRejected(User $recipient, User $actor, \App\Models\Artwork $artwork, ?string $note = null): ?Notification
+    {
+        if ($recipient->id === $actor->id) {
+            return null;
+        }
+
+        $title = (string) ($artwork->title ?: 'Untitled artwork');
+        $message = 'Your artwork "'.$title.'" was not approved.';
+        $note = trim((string) $note);
+        if ($note !== '') {
+            $message .= ' Reason: '.$note;
+        }
+
+        return Notification::query()->create([
+            'user_id' => (int) $recipient->id,
+            'type' => 'artwork_rejected',
+            'data' => [
+                'type' => 'artwork_rejected',
+                'actor_id' => (int) $actor->id,
+                'actor_name' => $actor->name,
+                'actor_username' => $actor->username,
+                'message' => $message,
+                'url' => route('studio.artworks.edit', ['id' => $artwork->id]),
+                'artwork_id' => (int) $artwork->id,
+                'artwork_title' => $title,
+                'note' => $note !== '' ? $note : null,
+            ],
+        ]);
+    }
+
     public function notifyGroupPostPublished(User $recipient, User $actor, \App\Models\Group $group, \App\Models\GroupPost $post): ?Notification
     {
         if ($recipient->id === $actor->id) {

app/Services/RSS/RSSFeedBuilder.php

@@ -87,7 +87,7 @@ final class RSSFeedBuilder
 
         // Primary category from eagerly loaded relation (avoid N+1)
         $primaryCategory = ($artwork->relationLoaded('categories'))
-            ? $artwork->categories->first()
+            ? $artwork->resolvedPrimaryCategory()
             : null;
 
         // Build HTML description embedded in CDATA

app/Services/Studio/Providers/ArtworkStudioProvider.php

@@ -201,7 +201,7 @@ final class ArtworkStudioProvider implements CreatorStudioProvider
                 ? 'scheduled'
                 : ((bool) $artwork->is_public ? 'published' : 'draft'));
 
-        $category = $artwork->categories->first();
+        $category = $artwork->resolvedPrimaryCategory();
         $visibility = $artwork->visibility ?: ((bool) $artwork->is_public ? Artwork::VISIBILITY_PUBLIC : Artwork::VISIBILITY_PRIVATE);
 
         return [

app/Services/Studio/StudioAiAssistService.php

@@ -211,9 +211,13 @@ final class StudioAiAssistService
             }
 
             $categoryId = $this->resolveCategoryId($payload);
+            $secondaryCategoryIds = array_key_exists('secondary_category_ids', $payload)
+                ? array_values(array_map('intval', (array) $payload['secondary_category_ids']))
+                : null;
 
             if ($categoryId !== null) {
-                $artwork->categories()->sync([$categoryId]);
+                app(\App\Services\Artworks\ArtworkCategoryService::class)
+                    ->sync($artwork, $categoryId, $secondaryCategoryIds, 'ai_applied', false);
                 $artwork->category_source = 'ai_applied';
                 $updated = true;
                 $applied[] = 'category';
@@ -294,10 +298,10 @@ final class StudioAiAssistService
      */
     public function payloadFor(Artwork $artwork): array
     {
-        $artwork->loadMissing(['artworkAiAssist', 'tags', 'categories.contentType']);
+        $artwork->loadMissing(['artworkAiAssist', 'tags', 'categories.contentType', 'primaryCategory.contentType']);
         $assist = $artwork->artworkAiAssist;
 
-        $primaryCategory = $artwork->categories->first();
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
 
         if (! $assist) {
             return [
@@ -515,6 +519,13 @@ final class StudioAiAssistService
             'description' => (string) ($artwork->description ?? ''),
             'tags' => $artwork->tags->pluck('slug')->values()->all(),
             'category_id' => $primaryCategory?->id,
+            'primary_category_id' => $primaryCategory?->id,
+            'secondary_category_ids' => $artwork->categories
+                ->reject(fn ($category): bool => (int) $category->id === (int) ($primaryCategory?->id ?? 0))
+                ->pluck('id')
+                ->map(fn ($id): int => (int) $id)
+                ->values()
+                ->all(),
             'content_type_id' => $primaryCategory?->contentType?->id,
             'sources' => [
                 'title' => $artwork->title_source ?: 'manual',
@@ -530,6 +541,10 @@ final class StudioAiAssistService
      */
     private function resolveCategoryId(array $payload): ?int
     {
+        if (isset($payload['primary_category_id']) && $payload['primary_category_id'] !== null) {
+            return (int) $payload['primary_category_id'];
+        }
+
         if (isset($payload['category_id']) && $payload['category_id'] !== null) {
             return (int) $payload['category_id'];
         }

app/Services/Studio/StudioAiCategoryMapper.php

@@ -49,8 +49,9 @@ final class StudioAiCategoryMapper
                 $selectedCategory,
                 $this->confidenceForModel($categoryScores, $selectedCategory->id),
                 $categoryScores
-                    ->reject(fn (array $row): bool => (int) $row['model']->id === (int) $selectedCategory->id)
-                    ->take(3)
+                    ->reject(fn (array $row): bool => (int) $row['model']->id === (int) $selectedCategory->id
+                        || (int) $row['model']->content_type_id !== (int) $selectedCategory->content_type_id)
+                    ->take(max(0, (int) config('categories.max_secondary_categories', 5)))
                     ->map(fn (array $row): array => $this->serializeCategory($row['model'], $row['confidence']))
                     ->all()
             ) : null,
@@ -245,6 +246,7 @@ final class StudioAiCategoryMapper
             'root_category_id' => (int) $rootCategory->id,
             'sub_category_id' => $category->parent_id ? (int) $category->id : null,
             'alternatives' => array_values($alternatives),
+            'secondary_categories' => array_values($alternatives),
         ];
     }
 }

app/Services/Studio/StudioBulkActionService.php

@@ -117,7 +117,8 @@ final class StudioBulkActionService
             throw new \InvalidArgumentException('category_id required for change_category');
         }
 
-        $artwork->categories()->sync([(int) $params['category_id']]);
+        app(\App\Services\Artworks\ArtworkCategoryService::class)
+            ->sync($artwork, (int) $params['category_id'], [], 'moderator');
     }
 
     private function addTags(Artwork $artwork, array $params): void

app/Services/ThumbnailService.php

@@ -59,7 +59,7 @@ class ThumbnailService
             try {
                 $artClass = '\\App\\Models\\Artwork';
                 if (class_exists($artClass)) {
-                    $art = $artClass::where('id', $id)->orWhere('legacy_id', $id)->first();
+                    $art = $artClass::query()->find($id);
                     if ($art) {
                         $hash = $art->hash ?? null;
                         $extToUse = $ext ?? ($art->thumb_ext ?? null);

app/Services/Uploads/UploadQueueService.php

@@ -9,6 +9,7 @@ use App\Jobs\AutoTagArtworkJob;
 use App\Jobs\DetectArtworkMaturityJob;
 use App\Jobs\GenerateArtworkEmbeddingJob;
 use App\Models\Artwork;
+use App\Services\Moderation\ArtworkUploadPolicy;
 use App\Models\UploadBatch;
 use App\Models\UploadBatchItem;
 use App\Models\User;
@@ -392,8 +393,24 @@ final class UploadQueueService
         }
 
         $artwork = $item->artwork;
+        $policy = app(ArtworkUploadPolicy::class)->assess($item->user ?? $artwork->user, $artwork);
+        if ($policy['requires_review']) {
+            $artwork->forceFill([
+                'is_public' => false,
+                'is_approved' => false,
+                'artwork_status' => 'review',
+                'approval_source' => null,
+                'moderation_note' => implode(', ', $policy['reasons']),
+            ])->saveQuietly();
+            $item->forceFill([
+                'status' => UploadBatchItem::STATUS_NEEDS_REVIEW,
+                'is_ready_to_publish' => false,
+            ])->save();
+            return;
+        }
         $artwork->forceFill([
             'is_approved' => true,
+            'approval_source' => 'trusted_auto',
             'visibility' => $artwork->visibility ?: Artwork::VISIBILITY_PUBLIC,
         ])->saveQuietly();
 
@@ -428,7 +445,8 @@ final class UploadQueueService
             ]);
         }
 
-        $item->artwork->categories()->sync([$categoryId]);
+        app(\App\Services\Artworks\ArtworkCategoryService::class)
+            ->sync($item->artwork, $categoryId, [], 'user');
         $this->refreshItem((int) $item->id);
     }
 

app/Services/Vision/AiArtworkVectorSearchService.php

@@ -95,13 +95,34 @@ final class AiArtworkVectorSearchService
      */
     private function searchMatchesForArtwork(Artwork $artwork, int $limit): array
     {
+        $this->client->assertCircuitClosed();
+
+        /*
+         * Reuse the artwork's already-indexed Qdrant vector when available.
+         * A missing point is expected for older/rebuilt indexes, so retain the
+         * existing image/CLIP fallback below.
+         */
+        try {
+            $pointMatches = $this->client->searchByPointId((int) $artwork->id, $limit);
+
+            if ($pointMatches !== null) {
+                return $pointMatches;
+            }
+        } catch (VectorGatewayException $pointFailure) {
+            $this->client->tripIfCircuitWorthy(
+                [$pointFailure],
+                'similar_ai_point',
+                ['artwork_id' => (int) $artwork->id],
+            );
+
+            throw $pointFailure;
+        }
+
         $url = $this->imageUrl->fromArtwork($artwork);
         if ($url === null || $url === '') {
             return [];
         }
 
-        $this->client->assertCircuitClosed();
-
         $fileFailure = null;
         $fileGatewayAttempted = false;
 

app/Services/Vision/ArtworkEmbeddingClient.php

@@ -26,14 +26,19 @@ final class ArtworkEmbeddingClient
         $retries = (int) config('recommendations.embedding.retries', 1);
         $delay = (int) config('recommendations.embedding.retry_delay_ms', 200);
 
+        $apiKey = trim(
+            (string) config('vision.clip.api_key', '')
+        );
+
         $response = Http::acceptJson()
+            ->withHeaders([
+                'X-API-Key' => $apiKey,
+            ])
             ->connectTimeout(max(1, $connectTimeout))
             ->timeout(max(1, $timeout))
             ->retry(max(0, $retries), max(0, $delay), throw: false)
             ->post($url, [
-                'image_url' => $imageUrl,
-                'artwork_id' => $artworkId,
-                'hash' => $sourceHash,
+                'url' => $imageUrl,
             ]);
 
         if (! $response->ok()) {
@@ -53,6 +58,8 @@ final class ArtworkEmbeddingClient
 
         if (is_array($json) && $this->isNumericVector($json)) {
             $candidate = $json;
+        } elseif (is_array($json) && isset($json['vector']) && is_array($json['vector'])) {
+            $candidate = $json['vector'];
         } elseif (is_array($json) && isset($json['embedding']) && is_array($json['embedding'])) {
             $candidate = $json['embedding'];
         } elseif (is_array($json) && isset($json['data']['embedding']) && is_array($json['data']['embedding'])) {

app/Services/Vision/ArtworkVectorIndexService.php

@@ -59,6 +59,31 @@ final class ArtworkVectorIndexService
         return $payload;
     }
 
+    /**
+     * Store a vector that has already been generated for this artwork.
+     *
+     * This avoids downloading and embedding the artwork a second time.
+     *
+     * @param  array<int, float>  $vector
+     * @return array{url: string, metadata: array<string, mixed>}
+     */
+    public function upsertArtworkVector(Artwork $artwork, array $vector): array
+    {
+        $payload = $this->payloadForArtwork($artwork);
+
+        $this->client->upsertByVector(
+            $vector,
+            (int) $artwork->id,
+            $payload['metadata']
+        );
+
+        $artwork->forceFill([
+            'last_vector_indexed_at' => now(),
+        ])->save();
+
+        return $payload;
+    }
+
     /**
      * @return array{contents: string, filename: string}|null
      */

app/Services/Vision/VectorGatewayClient.php

@@ -74,6 +74,43 @@ final class VectorGatewayClient
         return is_array($json) ? $json : [];
     }
 
+    /**
+     * Store an already-computed vector directly in Qdrant.
+     *
+     * @param  array<int, float>  $vector
+     * @param  array<string, mixed>  $metadata
+     */
+    public function upsertByVector(array $vector, int|string $id, array $metadata = []): array
+    {
+        $response = $this->postJson(
+            $this->request(),
+            $this->url(
+                (string) config(
+                    'vision.vector_gateway.upsert_vector_endpoint',
+                    '/vectors/upsert/vector'
+                )
+            ),
+            [
+                'vector' => array_values($vector),
+                'id' => (string) $id,
+                'metadata' => $metadata,
+            ]
+        );
+
+        if ($response->failed()) {
+            throw new RuntimeException(
+                $this->failureMessage(
+                    'Vector upsert',
+                    $response
+                )
+            );
+        }
+
+        $json = $response->json();
+
+        return is_array($json) ? $json : [];
+    }
+
     public function upsertByFileContents(string $contents, string $filename, int|string $id, array $metadata = []): array
     {
         $response = $this->request()
@@ -224,6 +261,46 @@ final class VectorGatewayClient
         return is_array($json) ? $json : [];
     }
 
+    /**
+     * Search using an artwork vector that is already stored in Qdrant.
+     *
+     * Returns null when the source point does not exist so the caller may fall
+     * back to the existing image/CLIP search path.
+     *
+     * @return list<array{id: int|string, score: float, metadata: array<string, mixed>}>|null
+     */
+    public function searchByPointId(int $artworkId, int $limit = 5): ?array
+    {
+        try {
+            $response = $this->postJson(
+                $this->searchRequest(),
+                $this->url(
+                    (string) config(
+                        'vision.vector_gateway.search_point_endpoint',
+                        '/vectors/search/point'
+                    )
+                ),
+                [
+                    'id' => $artworkId,
+                    'limit' => $this->clampSearchLimit($limit),
+                ]
+            );
+        } catch (Throwable $e) {
+            throw $this->classifyThrowable('search_point', $e);
+        }
+
+        // Missing indexed vector is expected and is not a gateway failure.
+        if ($response->status() === 404) {
+            return null;
+        }
+
+        if ($response->failed()) {
+            throw $this->classifyHttpFailure('search_point', $response);
+        }
+
+        return $this->extractMatches($response->json());
+    }
+
     /**
      * Used by upsert/delete — only ever called from queued/console indexing
      * jobs, so a more generous budget is fine.

app/Services/Worlds/WorldSubmissionService.php

@@ -608,7 +608,7 @@ final class WorldSubmissionService
                 'thumbnail_url' => $artwork->thumbUrl('md'),
                 'creator_name' => (string) ($artwork->user?->name ?: $artwork->user?->username ?: ''),
                 'meta' => array_values(array_filter([
-                    $artwork->categories->first()?->name,
+                    $artwork->resolvedPrimaryCategory()?->name,
                     $views > 0 ? number_format($views) . ' views' : null,
                     $artwork->visibility ? Str::headline((string) $artwork->visibility) : null,
                 ])),

app/Support/Http/HttpPerformanceLogAnalyzer.php

@@ -10,16 +10,23 @@ namespace App\Support\Http;
  * Multi-value upstream timings (retries): use the **sum** of numeric parts
  * as the upstream total for that request. "-" and empty → null.
  * Percentiles use nearest-rank (ceil(p * n), 1-indexed).
+ *
+ * Exact --status=404 means HTTP 404 only (not 4xx). Classes are 4xx/5xx.
  */
 final class HttpPerformanceLogAnalyzer
 {
+    /** Ignore gaps shorter than this when judging 24h source coverage. */
+    public const COVERAGE_TOLERANCE_SECONDS = 900;
+
     public function __construct(private readonly HttpUriNormalizer $uris)
     {
     }
 
     /**
+     * @param  string|list<string>  $input
      * @param  array{
      *     since?: ?string,
+     *     until?: ?string,
      *     min_requests?: int,
      *     top?: int,
      *     status?: ?string,
@@ -30,28 +37,54 @@ final class HttpPerformanceLogAnalyzer
      * }  $options
      * @return array<string, mixed>
      */
-    public function analyze(string $file, array $options = []): array
+    public function analyze(string|array $input, array $options = []): array
     {
-        $since = $this->sinceCutoff($options['since'] ?? null, $options['now'] ?? new \DateTimeImmutable('now'));
+        $files = $this->normalizeInputList($input);
+        $now = $options['now'] ?? new \DateTimeImmutable('now');
+        $requestedStart = $this->sinceCutoff($options['since'] ?? null, $now);
+        $requestedEnd = $this->untilInstant($options['until'] ?? null, $now);
         $minRequests = max(1, (int) ($options['min_requests'] ?? 1));
         $top = max(1, (int) ($options['top'] ?? 20));
-        $statusFilter = isset($options['status']) ? strtolower((string) $options['status']) : null;
+        $statusFilter = $this->parseStatusFilter($options['status'] ?? null);
         $uriFilter = $options['uri'] ?? null;
         $hostFilter = isset($options['host']) ? (string) $options['host'] : '';
-        $slowMs = isset($options['slow_ms']) ? (float) $options['slow_ms'] / 1000 : null;
+        $slowMs = isset($options['slow_ms']) && $options['slow_ms'] !== null
+            ? (float) $options['slow_ms'] / 1000
+            : null;
 
         $skipped = 0;
+        $linesScanned = 0;
+        $parseable = 0;
         $families = [];
         $slowest = [];
         $statusCounts = ['4xx' => 0, '5xx' => 0, '499' => 0, 'total' => 0];
+        $sources = [];
+        $earliestParseable = null;
+        $latestParseable = null;
+        $earliestMatching = null;
+        $latestMatching = null;
 
-        $handle = fopen($file, 'r');
+        foreach ($files as $file) {
+            $source = [
+                'path' => $file,
+                'gzip' => str_ends_with(strtolower($file), '.gz'),
+                'lines_scanned' => 0,
+                'parseable' => 0,
+                'in_window' => 0,
+                'error' => null,
+            ];
+
+            $handle = $this->openStream($file);
             if ($handle === false) {
-            throw new \RuntimeException('Unable to open performance log: '.$file);
+                $source['error'] = 'unreadable';
+                $sources[] = $source;
+                continue;
             }
 
             try {
                 while (($line = fgets($handle)) !== false) {
+                    $linesScanned++;
+                    $source['lines_scanned']++;
                     $line = trim($line);
                     if ($line === '') {
                         continue;
@@ -64,24 +97,28 @@ final class HttpPerformanceLogAnalyzer
                     }
 
                     $time = $this->parseTime((string) ($row['time'] ?? ''));
-                if ($since !== null && ($time === null || $time < $since)) {
-                    continue;
-                }
-
                     $requestTime = $this->parseFloat($row['request_time'] ?? null);
                     if ($requestTime === null) {
                         $skipped++;
                         continue;
                     }
 
+                    $parseable++;
+                    $source['parseable']++;
+                    if ($time instanceof \DateTimeImmutable) {
+                        $earliestParseable = $this->minTime($earliestParseable, $time);
+                        $latestParseable = $this->maxTime($latestParseable, $time);
+                    }
+
+                    if ($requestedStart !== null && ($time === null || $time < $requestedStart)) {
+                        continue;
+                    }
+                    if ($requestedEnd !== null && ($time === null || $time > $requestedEnd)) {
+                        continue;
+                    }
+
                     $status = (int) ($row['status'] ?? 0);
-                if ($statusFilter === '5xx' && ($status < 500 || $status > 599)) {
-                    continue;
-                }
-                if ($statusFilter === '4xx' && ($status < 400 || $status > 499)) {
-                    continue;
-                }
-                if ($statusFilter === '499' && $status !== 499) {
+                    if (! $this->statusMatches($status, $statusFilter)) {
                         continue;
                     }
 
@@ -99,6 +136,12 @@ final class HttpPerformanceLogAnalyzer
                         continue;
                     }
 
+                    $source['in_window']++;
+                    if ($time instanceof \DateTimeImmutable) {
+                        $earliestMatching = $this->minTime($earliestMatching, $time);
+                        $latestMatching = $this->maxTime($latestMatching, $time);
+                    }
+
                     $upstreamResponse = $this->parseUpstream($row['upstream_response_time'] ?? null);
                     $upstreamHeader = $this->parseUpstream($row['upstream_header_time'] ?? null);
                     $bytes = (int) ($row['bytes'] ?? 0);
@@ -158,13 +201,16 @@ final class HttpPerformanceLogAnalyzer
                         'method' => $method,
                         'status' => $status,
                         'request_time' => $requestTime,
-                    'upstream_response_time' => $upstreamResponse,
                     ];
+                    $slowest[array_key_last($slowest)]['upstream_response_time'] = $upstreamResponse;
                 }
             } finally {
                 fclose($handle);
             }
 
+            $sources[] = $source;
+        }
+
         usort($slowest, static fn (array $a, array $b): int => $b['request_time'] <=> $a['request_time']);
         $slowest = array_slice($slowest, 0, $top);
 
@@ -213,8 +259,24 @@ final class HttpPerformanceLogAnalyzer
         $by404 = array_values(array_filter($summaries, static fn (array $row): bool => ($row['404'] ?? 0) > 0));
         usort($by404, static fn (array $a, array $b): int => $b['404'] <=> $a['404']);
 
+        $coverage = $this->coverageReport(
+            $requestedStart,
+            $requestedEnd,
+            $earliestParseable,
+            $latestParseable,
+            $earliestMatching,
+            $latestMatching,
+        );
+
         return [
             'skipped' => $skipped,
+            'lines_scanned' => $linesScanned,
+            'parseable' => $parseable,
+            'source_files' => count($files),
+            'sources' => $sources,
+            'coverage' => $coverage,
+            'warnings' => $coverage['warnings'],
+            'sample_empty' => $statusCounts['total'] === 0,
             'totals' => $statusCounts,
             'by_p95' => array_slice($byP95, 0, $top),
             'by_p99' => array_slice($byP99, 0, $top),
@@ -229,6 +291,48 @@ final class HttpPerformanceLogAnalyzer
         ];
     }
 
+    /**
+     * @param  list<string>  $paths
+     * @return list<string>
+     */
+    public function deduplicatePaths(array $paths): array
+    {
+        $seen = [];
+        $out = [];
+        foreach ($paths as $path) {
+            $path = str_replace('\\', '/', (string) $path);
+            if ($path === '') {
+                continue;
+            }
+            $resolved = realpath($path) ?: $path;
+            $key = strtolower($resolved);
+            if (isset($seen[$key])) {
+                continue;
+            }
+            $seen[$key] = true;
+            $out[] = $path;
+        }
+
+        return array_values($out);
+    }
+
+    /**
+     * @return list<string>
+     */
+    public function expandGlob(string $pattern): array
+    {
+        $matches = glob($pattern, GLOB_NOSORT) ?: [];
+        $files = [];
+        foreach ($matches as $match) {
+            if (is_file($match)) {
+                $files[] = $match;
+            }
+        }
+        natsort($files);
+
+        return array_values($files);
+    }
+
     /**
      * Nearest-rank: rank = ceil(p * n), 1-indexed.
      *
@@ -274,6 +378,135 @@ final class HttpPerformanceLogAnalyzer
         return $found ? $sum : null;
     }
 
+    /**
+     * @param  string|list<string>  $input
+     * @return list<string>
+     */
+    private function normalizeInputList(string|array $input): array
+    {
+        $files = is_array($input) ? $input : [$input];
+        $files = $this->deduplicatePaths(array_map('strval', $files));
+        if ($files === []) {
+            throw new \InvalidArgumentException('No performance log files were provided.');
+        }
+
+        return $files;
+    }
+
+    /**
+     * @return resource|false
+     */
+    private function openStream(string $file)
+    {
+        if (str_ends_with(strtolower($file), '.gz')) {
+            return @gzopen($file, 'rb');
+        }
+
+        return @fopen($file, 'r');
+    }
+
+    /**
+     * @return array{type: string, code?: int, class?: string}
+     */
+    public function parseStatusFilter(?string $raw): array
+    {
+        if ($raw === null || $raw === '') {
+            return ['type' => 'none'];
+        }
+
+        $value = strtolower(trim($raw));
+        if ($value === '4xx') {
+            return ['type' => 'class', 'class' => '4xx'];
+        }
+        if ($value === '5xx') {
+            return ['type' => 'class', 'class' => '5xx'];
+        }
+        if (preg_match('/^[1-5][0-9]{2}$/', $value) === 1) {
+            return ['type' => 'exact', 'code' => (int) $value];
+        }
+
+        throw new \InvalidArgumentException('Invalid --status value: '.$raw);
+    }
+
+    /**
+     * @param  array{type: string, code?: int, class?: string}  $filter
+     */
+    private function statusMatches(int $status, array $filter): bool
+    {
+        return match ($filter['type']) {
+            'none' => true,
+            'exact' => $status === (int) ($filter['code'] ?? 0),
+            'class' => ($filter['class'] ?? '') === '5xx'
+                ? ($status >= 500 && $status <= 599)
+                : ($status >= 400 && $status <= 499),
+            default => true,
+        };
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function coverageReport(
+        ?\DateTimeImmutable $requestedStart,
+        ?\DateTimeImmutable $requestedEnd,
+        ?\DateTimeImmutable $earliestParseable,
+        ?\DateTimeImmutable $latestParseable,
+        ?\DateTimeImmutable $earliestMatching,
+        ?\DateTimeImmutable $latestMatching,
+    ): array {
+        $warnings = [];
+        $complete = true;
+        if ($requestedStart instanceof \DateTimeImmutable && $requestedEnd instanceof \DateTimeImmutable) {
+            if (! $earliestParseable instanceof \DateTimeImmutable || ! $latestParseable instanceof \DateTimeImmutable) {
+                $complete = false;
+                $warnings[] = 'Observed records do not demonstrate full requested coverage.';
+            } else {
+                $startGap = $earliestParseable->getTimestamp() - $requestedStart->getTimestamp();
+                $endGap = $requestedEnd->getTimestamp() - $latestParseable->getTimestamp();
+                if ($startGap > self::COVERAGE_TOLERANCE_SECONDS || $endGap > self::COVERAGE_TOLERANCE_SECONDS) {
+                    $complete = false;
+                    $warnings[] = sprintf(
+                        'WARNING: Requested window is not fully covered by supplied logs. Requested: %s → %s Observed: %s → %s',
+                        $requestedStart->format(\DateTimeInterface::ATOM),
+                        $requestedEnd->format(\DateTimeInterface::ATOM),
+                        $earliestParseable->format(\DateTimeInterface::ATOM),
+                        $latestParseable->format(\DateTimeInterface::ATOM),
+                    );
+                }
+            }
+        }
+
+        return [
+            'requested_start' => $requestedStart?->format(\DateTimeInterface::ATOM),
+            'requested_end' => $requestedEnd?->format(\DateTimeInterface::ATOM),
+            'observed_earliest_parseable' => $earliestParseable?->format(\DateTimeInterface::ATOM),
+            'observed_latest_parseable' => $latestParseable?->format(\DateTimeInterface::ATOM),
+            'observed_earliest_matching' => $earliestMatching?->format(\DateTimeInterface::ATOM),
+            'observed_latest_matching' => $latestMatching?->format(\DateTimeInterface::ATOM),
+            'tolerance_seconds' => self::COVERAGE_TOLERANCE_SECONDS,
+            'complete' => $complete,
+            'warnings' => $warnings,
+        ];
+    }
+
+    private function minTime(?\DateTimeImmutable $current, \DateTimeImmutable $candidate): \DateTimeImmutable
+    {
+        if ($current === null || $candidate < $current) {
+            return $candidate;
+        }
+
+        return $current;
+    }
+
+    private function maxTime(?\DateTimeImmutable $current, \DateTimeImmutable $candidate): \DateTimeImmutable
+    {
+        if ($current === null || $candidate > $current) {
+            return $candidate;
+        }
+
+        return $current;
+    }
+
     private function parseFloat(mixed $value): ?float
     {
         if ($value === null || $value === '' || $value === '-') {
@@ -306,7 +539,7 @@ final class HttpPerformanceLogAnalyzer
         }
 
         if (preg_match('/^(\d+)(h|d|m)$/', strtolower($since), $matches) !== 1) {
-            return null;
+            return $this->parseTime($since);
         }
 
         $n = (int) $matches[1];
@@ -319,4 +552,13 @@ final class HttpPerformanceLogAnalyzer
 
         return $now->sub($interval);
     }
+
+    private function untilInstant(?string $until, \DateTimeImmutable $now): \DateTimeImmutable
+    {
+        if ($until === null || $until === '') {
+            return $now;
+        }
+
+        return $this->parseTime($until) ?? $now;
+    }
 }

bootstrap/app.php

@@ -60,6 +60,7 @@ return Application::configure(basePath: dirname(__DIR__))
             'ensure.onboarding.complete'=> \App\Http\Middleware\EnsureOnboardingComplete::class,
             'forum.ai.moderation'       => \App\Http\Middleware\ForumAIModerationMiddleware::class,
             'forum.bot.protection'      => \App\Http\Middleware\ForumBotProtectionMiddleware::class,
+            'comment.captcha'           => \App\Http\Middleware\CommentCaptchaMiddleware::class,
             'forum.spam.detection'      => \App\Http\Middleware\ForumSpamDetectionMiddleware::class,
             'forum.security.firewall'   => \App\Http\Middleware\ForumSecurityFirewallMiddleware::class,
             'forum.rate_limit'          => \App\Http\Middleware\ForumRateLimitMiddleware::class,

bootstrap/providers.php

@@ -4,6 +4,7 @@ return [
     App\Providers\AppServiceProvider::class,
     App\Providers\AuthServiceProvider::class,
     App\Providers\HorizonServiceProvider::class,
+    App\Providers\LazyCarbonServiceProvider::class,
     Klevze\ControlPanel\ServiceProvider::class,
     cPad\Plugins\Artworks\ServiceProvider::class,
     cPad\Plugins\Forum\ServiceProvider::class,

bootstrap/ssr/assets/ArtworkShareModal-BI8kkaqs.js

@@ -18,7 +18,7 @@ import "./vendor-tooltip-CIQaDNlG.js";
 import "node:process";
 import "node:path";
 import "node:url";
-import "./vendor-realtime-Koiu-_pw.js";
+import "./vendor-realtime-DYEIbD6w.js";
 import "buffer";
 import "child_process";
 import "net";