diff --git a/CLAUDE.md b/CLAUDE.md
index a020d81..7f9a7ad 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -103,6 +103,7 @@ internal/catalog/     libraries, access grants, books, FTS search, listening sta
 internal/library/     filesystem view (fsview.go) + background scanner (scanner.go)
 internal/metadata/    dhowden/tag + ffprobe extraction; DeriveFromPath (structural path parsing)
 internal/media/       Range streaming, download, embedded cover extraction
+internal/meta/        Phase 1.5 community metadata lookup: HTTP client + Service (asin/isbn -> composed enrichment envelope) with a bounded TTL cache
 internal/toolfetch/   on-demand ffmpeg/ffprobe download+cache (<data>/tools) when none is local
 internal/api/         HTTP transport: routing (api.go), middleware, rate limiting, handlers_*.go
 internal/server/      HTTP(S) server, TLS modes (off/selfsigned/autocert), graceful shutdown
@@ -242,6 +243,24 @@ future metadata site can attach enrichment without reshaping the schema.
   react-native-web's runtime styles). Admin/connect pages keep the stricter
   site-wide CSP. Compatibility is by construction (the image pins a matching web
   build); native apps negotiate via `GET /server` capability flags.
+- **Community metadata lookup (Phase 1.5, `internal/meta`)**: `GET
+  /api/v1/libraries/{id}/meta?path=` (authed, scope-checked via `authorizedPath`
+  + `bookForPath`, exactly like `item`) resolves the book's `asin`/`isbn`
+  (backfilled via `book_enrichment`) against the community metadata API
+  (`metaserve`, meta.audiosilo.app) and returns a composed enrichment envelope
+  (work + matched recording + series rails, each carrying its own `web_url`).
+  Config is `metadata.{enabled,base_url}` (env `AUDIOSILO_METADATA_ENABLED` /
+  `AUDIOSILO_METADATA_BASE_URL`; `base_url` must be an absolute http(s) URL when
+  enabled) - one key disables ALL outbound calls. `meta.Service` (constructed in
+  `api.New` only when configured; `a.meta == nil` = off) owns the compose logic
+  (lookup -> works/{id} -> pick the recording by `recording_id`, first as
+  fallback -> up to 3 series rails) behind a bounded in-memory TTL cache (24h
+  positive / 1h not-found / 2min transport-error, ~2048-entry cap) so a hot path
+  or a down upstream isn't hammered; the api handler (`handlers_meta.go`) is
+  transport-only. Degradation: disabled -> 404 (and the `metadata` capability is
+  false, so clients hide the UI); no asin/isbn or no upstream match -> `200
+  {"matched": false}`; upstream unreachable -> 502. Out of scope for now: no cover
+  remote-fallback, no persisting meta into the DB, no tag-based ASIN extraction.
 - **Native deep-link association**: `GET /.well-known/apple-app-site-association`
   and `/assetlinks.json` are served from `config.AppLinkConfig` (`app_links` in
   YAML) and 404 when unset. They only enable auto-app-launch for domains the
@@ -375,13 +394,17 @@ future metadata site can attach enrichment without reshaping the schema.
   See the plan file.
 
 `GET /api/v1/server` advertises capability flags (`admin_ui`, `web_player`,
-`upload`, `transcode`, `websocket`, `api_keys`); flip them on as phases land.
-`transcode` already reflects whether ffmpeg is configured; `api_keys` is true
-(user-minted personal access tokens are supported).
+`upload`, `transcode`, `websocket`, `api_keys`, `metadata`); flip them on as
+phases land. `transcode` already reflects whether ffmpeg is configured;
+`api_keys` is true (user-minted personal access tokens are supported);
+`metadata` reflects whether the Phase 1.5 metadata lookup is configured
+(`metadata.enabled && metadata.base_url != ""`).
 
 ## API surface
 
 See `internal/api/api.go` for the full route table. Public: `/server`,
 `/auth/redeem`, `/auth/exchange`, `/auth/login`, the well-known association files,
 and the static UI (`/`, `/connect`, `/admin`, `/web/...`). Everything else needs a
-session bearer token; `/admin/*` additionally requires the admin role.
+session bearer token; `/admin/*` additionally requires the admin role. The
+metadata lookup is `GET /libraries/{id}/meta?path=` (authed, scope-checked like
+the other `?path=` content endpoints; 404 when metadata is disabled).
diff --git a/config.example.yaml b/config.example.yaml
index 5511225..9d267a0 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -71,3 +71,13 @@ demo:
   library: ""          # name of a library above to grant demo users [AUDIOSILO_DEMO_LIBRARY]
   # max_users: 200     # cap on live demo users; omit for the safe default of 200, explicit 0 = unlimited (opt-in risk) [AUDIOSILO_DEMO_MAX_USERS]
   idle_ttl: "24h"      # reap demo users idle longer than this [AUDIOSILO_DEMO_IDLE_TTL]
+
+# Community metadata lookup (Phase 1.5). When enabled, the server resolves a
+# book's ASIN/ISBN against the community metadata API and exposes a composed
+# enrichment envelope at GET /libraries/{id}/meta (author/narrator, description,
+# series rail); results are cached in memory. Disabling it stops all outbound
+# calls with one key, and the `metadata` capability then reports false so clients
+# hide the UI. base_url must be an absolute http(s) URL when enabled.
+metadata:
+  enabled: true                          # [AUDIOSILO_METADATA_ENABLED]
+  base_url: "https://meta.audiosilo.app" # metaserve base URL [AUDIOSILO_METADATA_BASE_URL]
diff --git a/internal/api/api.go b/internal/api/api.go
index 1318927..df55eed 100644
--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -13,6 +13,7 @@ import (
 	"github.com/kodestar/audiosilo-server/internal/catalog"
 	"github.com/kodestar/audiosilo-server/internal/config"
 	"github.com/kodestar/audiosilo-server/internal/library"
+	"github.com/kodestar/audiosilo-server/internal/meta"
 	"github.com/kodestar/audiosilo-server/internal/web"
 )
 
@@ -35,7 +36,11 @@ type API struct {
 	cat     *catalog.Catalog
 	scanner *library.Scanner
 	ffmpeg  string // path to ffmpeg for on-the-fly transcoding; "" disables it
-	log     *slog.Logger
+	// meta resolves book asin/isbn against the community metadata API (Phase 1.5).
+	// nil when metadata lookup is disabled/unconfigured; the handler and the
+	// `metadata` capability flag both gate on it being non-nil.
+	meta *meta.Service
+	log  *slog.Logger
 
 	// baseCtx is the server lifecycle context; background work detached from a
 	// request (e.g. backgroundScan) derives from it so it's cancelled on shutdown
@@ -74,12 +79,20 @@ func New(cfg *config.Config, authSvc *auth.Service, cat *catalog.Catalog, scanne
 	if log == nil {
 		log = slog.Default()
 	}
+	// Construct the metadata lookup service from config; nil when disabled or
+	// unconfigured so the feature (endpoint + capability) is off. The config is
+	// validated upstream (base_url is an absolute http(s) URL when enabled).
+	var metaSvc *meta.Service
+	if cfg.Metadata.Enabled && cfg.Metadata.BaseURL != "" {
+		metaSvc = meta.NewService(cfg.Metadata.BaseURL, nil)
+	}
 	return &API{
 		cfg:            cfg,
 		auth:           authSvc,
 		cat:            cat,
 		scanner:        scanner,
 		ffmpeg:         ffmpeg,
+		meta:           metaSvc,
 		log:            log,
 		baseCtx:        context.Background(),
 		timeoutDur:     requestTimeout,
@@ -150,6 +163,7 @@ func (a *API) Handler() http.Handler {
 	mux.Handle("GET /api/v1/libraries/{id}/books", a.requireAuth(http.HandlerFunc(a.handleListBooks)))
 	mux.Handle("GET /api/v1/libraries/{id}/item", a.requireAuth(http.HandlerFunc(a.handleItem)))
 	mux.Handle("GET /api/v1/libraries/{id}/chapters", a.requireAuth(http.HandlerFunc(a.handleChapters)))
+	mux.Handle("GET /api/v1/libraries/{id}/meta", a.requireAuth(http.HandlerFunc(a.handleMeta)))
 	// Media GETs accept the session token as a ?token= query param (browser
 	// <img>/<audio> can't set headers); other routes do not (see requireMediaAuth).
 	mux.Handle("GET /api/v1/libraries/{id}/cover", a.requireMediaAuth(http.HandlerFunc(a.handleCover)))
diff --git a/internal/api/handlers_auth.go b/internal/api/handlers_auth.go
index 8dde776..9306474 100644
--- a/internal/api/handlers_auth.go
+++ b/internal/api/handlers_auth.go
@@ -35,6 +35,7 @@ func (a *API) handleServerInfo(w http.ResponseWriter, r *http.Request) {
 			"upload":     false,                       // Phase B
 			"websocket":  false,                       // Phase C
 			"api_keys":   true,                        // user-minted personal access tokens (POST /auth/tokens)
+			"metadata":   a.meta != nil,               // community metadata lookup (GET /libraries/{id}/meta)
 		},
 		"auth": map[string]any{
 			"methods": []string{"auth_code", "password"},
diff --git a/internal/api/handlers_meta.go b/internal/api/handlers_meta.go
new file mode 100644
index 0000000..272d3b4
--- /dev/null
+++ b/internal/api/handlers_meta.go
@@ -0,0 +1,56 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/kodestar/audiosilo-server/internal/library"
+	"github.com/kodestar/audiosilo-server/internal/meta"
+)
+
+// handleMeta resolves a book's asin/isbn against the community metadata API and
+// returns a composed enrichment envelope. Transport-only: scope + path resolution
+// reuse authorizedPath/bookForPath (exactly like item), the composition and cache
+// live in internal/meta.
+//
+// Responses:
+//   - metadata disabled: 404 (clients gate on the `metadata` capability, so they
+//     never request this).
+//   - book has neither asin nor isbn, or the lookup found no match: 200 {"matched": false}.
+//   - upstream unreachable/error: 502.
+//   - match: 200 {"matched": true, ...} (see internal/meta.Enrichment).
+func (a *API) handleMeta(w http.ResponseWriter, r *http.Request) {
+	if a.meta == nil {
+		writeError(w, http.StatusNotFound, "metadata lookup not enabled")
+		return
+	}
+	lib, path, status, msg := a.authorizedPath(r)
+	if status != 0 {
+		writeError(w, status, msg)
+		return
+	}
+	book, err := a.bookForPath(r.Context(), lib, path)
+	switch {
+	case errors.Is(err, library.ErrNotIndexable):
+		writeError(w, http.StatusNotFound, "no book at that path")
+		return
+	case err != nil:
+		a.writeCatalogError(w, err, "load book for meta failed", "could not load book", "library", lib.ID, "path", path)
+		return
+	}
+	if book.ASIN == "" && book.ISBN == "" {
+		writeJSON(w, http.StatusOK, map[string]bool{"matched": false})
+		return
+	}
+
+	env, err := a.meta.Enrich(r.Context(), book.ASIN, book.ISBN)
+	switch {
+	case errors.Is(err, meta.ErrNotFound):
+		writeJSON(w, http.StatusOK, map[string]bool{"matched": false})
+	case err != nil:
+		a.log.Warn("meta lookup failed", "err", err, "library", lib.ID, "path", path)
+		writeError(w, http.StatusBadGateway, "metadata service unavailable")
+	default:
+		writeJSON(w, http.StatusOK, env)
+	}
+}
diff --git a/internal/api/meta_test.go b/internal/api/meta_test.go
new file mode 100644
index 0000000..37af437
--- /dev/null
+++ b/internal/api/meta_test.go
@@ -0,0 +1,181 @@
+package api
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/kodestar/audiosilo-server/internal/auth"
+	"github.com/kodestar/audiosilo-server/internal/catalog"
+	"github.com/kodestar/audiosilo-server/internal/config"
+)
+
+// escape url-escapes a ?path= value (a query param, matching the other tests).
+func escape(s string) string { return url.QueryEscape(s) }
+
+// mockMetaserve is a minimal metaserve stand-in for the /meta handler tests.
+type mockMetaserve struct {
+	lookupCode int // non-zero overrides the lookup response status
+}
+
+func (m *mockMetaserve) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, _ *http.Request) {
+		if m.lookupCode != 0 {
+			w.WriteHeader(m.lookupCode)
+			return
+		}
+		_, _ = w.Write([]byte(`{"work":{"id":"the-martian","title":"The Martian","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":null,"added_at":null},"recording_id":"rec1"}`))
+	})
+	mux.HandleFunc("GET /api/v1/works/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"id":"the-martian","title":"The Martian","subtitle":"","authors":[{"id":"andy-weir","name":"Andy Weir"}],"language":"en","first_published":"2011","description":"Stranded.","series":[{"id":"mars","name":"Mars","position":"1"}],"recordings":[{"id":"rec1","narrators":[{"id":"r-c-bray","name":"R. C. Bray"}],"abridged":false,"runtime_min":634,"release_date":"2013-03-22","publisher":"Podium Audio","cover_url":"https://c/1.jpg","chapter_count":12}]}`))
+	})
+	mux.HandleFunc("GET /api/v1/series/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"id":"mars","name":"Mars","authors":[{"id":"andy-weir","name":"Andy Weir"}],"works":[{"position":"1","work":{"id":"the-martian","title":"The Martian","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":null,"added_at":null}},{"position":"2","work":{"id":"artemis","title":"Artemis","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":null,"added_at":null}}]}`))
+	})
+	return mux
+}
+
+// newMetaEnv builds a test env whose metadata service points at a fresh mock
+// metaserve (torn down with the test). enabled=false disables the feature.
+func newMetaEnv(t *testing.T, enabled bool, lookupCode int) *testEnv {
+	t.Helper()
+	mock := httptest.NewServer((&mockMetaserve{lookupCode: lookupCode}).handler())
+	t.Cleanup(mock.Close)
+	return newTestEnvWith(t, func(c *config.Config) {
+		c.Metadata.Enabled = enabled
+		c.Metadata.BaseURL = mock.URL
+	})
+}
+
+// seedBook upserts a book at path with the given asin, returning the library id.
+func seedBook(t *testing.T, e *testEnv, path, asin string) int64 {
+	t.Helper()
+	lib, err := e.cat.CreateLibrary(context.Background(), catalog.Library{Name: "Main", Root: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	book := &catalog.Book{LibraryID: lib.ID, RelPath: path, Title: "Book", Author: "Author", ASIN: asin, AddedAt: "2020-01-01"}
+	if _, err := e.cat.UpsertBook(context.Background(), book); err != nil {
+		t.Fatal(err)
+	}
+	return lib.ID
+}
+
+func TestMetaMatch(t *testing.T) {
+	e := newMetaEnv(t, true, 0)
+	libID := seedBook(t, e, "Andy Weir/The Martian", "B00FLIJJSY")
+	adminTok, _ := e.auth.IssueToken(context.Background(), e.adminID, auth.KindSession, "t", 0)
+
+	path := "/api/v1/libraries/" + strconv.FormatInt(libID, 10) + "/meta?path=" + escape("Andy Weir/The Martian")
+	resp, body := e.do(t, "GET", path, adminTok, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("meta match = %d %s, want 200", resp.StatusCode, body)
+	}
+	for _, want := range []string{`"matched":true`, `"the-martian"`, `"R. C. Bray"`, `"Podium Audio"`, `/work?id=the-martian`, `"artemis"`} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("meta envelope missing %q: %s", want, body)
+		}
+	}
+
+	// The capability is advertised when the service is configured.
+	_, si := e.do(t, "GET", "/api/v1/server", "", "")
+	if !strings.Contains(si, `"metadata":true`) {
+		t.Fatalf("expected metadata capability true: %s", si)
+	}
+}
+
+func TestMetaNoIDs(t *testing.T) {
+	e := newMetaEnv(t, true, 0)
+	libID := seedBook(t, e, "Author/No IDs", "") // neither asin nor isbn
+	adminTok, _ := e.auth.IssueToken(context.Background(), e.adminID, auth.KindSession, "t", 0)
+
+	path := "/api/v1/libraries/" + strconv.FormatInt(libID, 10) + "/meta?path=" + escape("Author/No IDs")
+	resp, body := e.do(t, "GET", path, adminTok, "")
+	if resp.StatusCode != http.StatusOK || !strings.Contains(body, `"matched":false`) {
+		t.Fatalf("no-ids meta = %d %s, want 200 matched:false", resp.StatusCode, body)
+	}
+}
+
+func TestMetaUpstreamNotFound(t *testing.T) {
+	e := newMetaEnv(t, true, http.StatusNotFound)
+	libID := seedBook(t, e, "Author/Unknown", "B0UNKNOWN")
+	adminTok, _ := e.auth.IssueToken(context.Background(), e.adminID, auth.KindSession, "t", 0)
+
+	path := "/api/v1/libraries/" + strconv.FormatInt(libID, 10) + "/meta?path=" + escape("Author/Unknown")
+	resp, body := e.do(t, "GET", path, adminTok, "")
+	if resp.StatusCode != http.StatusOK || !strings.Contains(body, `"matched":false`) {
+		t.Fatalf("upstream 404 meta = %d %s, want 200 matched:false", resp.StatusCode, body)
+	}
+}
+
+func TestMetaUpstreamDown(t *testing.T) {
+	e := newMetaEnv(t, true, http.StatusInternalServerError)
+	libID := seedBook(t, e, "Author/Book", "B0DOWN")
+	adminTok, _ := e.auth.IssueToken(context.Background(), e.adminID, auth.KindSession, "t", 0)
+
+	path := "/api/v1/libraries/" + strconv.FormatInt(libID, 10) + "/meta?path=" + escape("Author/Book")
+	resp, body := e.do(t, "GET", path, adminTok, "")
+	if resp.StatusCode != http.StatusBadGateway {
+		t.Fatalf("upstream down meta = %d %s, want 502", resp.StatusCode, body)
+	}
+}
+
+func TestMetaDisabled(t *testing.T) {
+	e := newMetaEnv(t, false, 0)
+	libID := seedBook(t, e, "Author/Book", "B0OFF")
+	adminTok, _ := e.auth.IssueToken(context.Background(), e.adminID, auth.KindSession, "t", 0)
+
+	path := "/api/v1/libraries/" + strconv.FormatInt(libID, 10) + "/meta?path=" + escape("Author/Book")
+	if resp, body := e.do(t, "GET", path, adminTok, ""); resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("disabled meta = %d %s, want 404", resp.StatusCode, body)
+	}
+	// The capability reflects the disabled service.
+	if _, si := e.do(t, "GET", "/api/v1/server", "", ""); !strings.Contains(si, `"metadata":false`) {
+		t.Fatalf("expected metadata capability false: %s", si)
+	}
+}
+
+// TestMetaScopeSecurity is the required allowed+denied pair: a scoped non-admin
+// may probe a book inside their grant but must be refused (403) for a path
+// outside it, exactly like the other content handlers.
+func TestMetaScopeSecurity(t *testing.T) {
+	e := newMetaEnv(t, true, 0)
+	// Two books under distinct top-level folders in one library.
+	lib, err := e.cat.CreateLibrary(context.Background(), catalog.Library{Name: "Main", Root: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, b := range []*catalog.Book{
+		{LibraryID: lib.ID, RelPath: "Andy Weir/The Martian", Title: "Book", Author: "Author", ASIN: "B00FLIJJSY", AddedAt: "2020-01-01"},
+		{LibraryID: lib.ID, RelPath: "Other Author/Secret", Title: "Secret", Author: "Other", ASIN: "B0SECRET", AddedAt: "2020-01-01"},
+	} {
+		if _, err := e.cat.UpsertBook(context.Background(), b); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// A non-admin granted only the "Andy Weir" subtree.
+	kid, _ := e.auth.CreateUser(context.Background(), "kid", "kid-password", auth.RoleUser)
+	share, _ := e.cat.CreateShare(context.Background(), catalog.Share{Name: "Weir only"})
+	e.cat.AddSharePath(context.Background(), share.ID, catalog.PathRule{LibraryID: lib.ID, Path: "Andy Weir"})
+	e.cat.GrantShare(context.Background(), kid.ID, share.ID)
+	token, _ := e.auth.IssueToken(context.Background(), kid.ID, auth.KindSession, "t", 0)
+	libPath := "/api/v1/libraries/" + strconv.FormatInt(lib.ID, 10)
+
+	// Allowed: a book inside the grant resolves against the mock.
+	in := libPath + "/meta?path=" + escape("Andy Weir/The Martian")
+	if resp, body := e.do(t, "GET", in, token, ""); resp.StatusCode != http.StatusOK || !strings.Contains(body, `"matched":true`) {
+		t.Fatalf("in-scope meta = %d %s, want 200 matched", resp.StatusCode, body)
+	}
+
+	// Denied: a path outside the grant must be refused (403), never probed.
+	out := libPath + "/meta?path=" + escape("Other Author/Secret")
+	if resp, body := e.do(t, "GET", out, token, ""); resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("out-of-scope meta = %d %s, want 403", resp.StatusCode, body)
+	}
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index baaceaa..e78a468 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -102,6 +103,16 @@ func (d DemoConfig) IdleTTLDuration() time.Duration {
 	return 24 * time.Hour
 }
 
+// MetadataConfig configures the community metadata lookup (Phase 1.5): when
+// enabled, the server resolves a book's asin/isbn against the metadata API
+// (metaserve, meta.audiosilo.app) and exposes a composed enrichment envelope at
+// GET /libraries/{id}/meta. Disabling it stops all outbound calls with one key,
+// and the `metadata` capability flag then reports false so clients hide the UI.
+type MetadataConfig struct {
+	Enabled bool   `yaml:"enabled"`  // activate the meta lookup (default true)
+	BaseURL string `yaml:"base_url"` // metaserve base URL; site at / and API at /api/v1
+}
+
 // Config is the full server configuration.
 type Config struct {
 	// DataDir is where the database, config and generated certs live. It is not
@@ -114,18 +125,23 @@ type Config struct {
 	// on it, so it must never change for the life of the install.
 	ServerID string `yaml:"server_id"`
 
-	Bind           string        `yaml:"bind"`       // host:port to listen on
-	PublicURL      string        `yaml:"public_url"` // externally reachable base URL, used in QR payloads
-	TLS            TLSConfig     `yaml:"tls"`
-	TrustedProxies []string      `yaml:"trusted_proxies"`  // CIDRs whose X-Forwarded-For is trusted
-	CORSOrigins    []string      `yaml:"cors_origins"`     // allowed web origins ("*" to disable check)
-	MaxUploadBytes int64         `yaml:"max_upload_bytes"` // reserved for Phase B uploads; not yet enforced (JSON bodies use a fixed 1 MiB cap)
-	WebDir         string        `yaml:"web_dir"`          // directory of the prebuilt web player served at /web; empty disables it
-	AppLinks       AppLinkConfig `yaml:"app_links"`        // optional native deep-link association (well-known files)
-	Libraries      []Library     `yaml:"libraries"`
-	Demo           DemoConfig    `yaml:"demo"` // public demo mode (throwaway accounts)
+	Bind           string         `yaml:"bind"`       // host:port to listen on
+	PublicURL      string         `yaml:"public_url"` // externally reachable base URL, used in QR payloads
+	TLS            TLSConfig      `yaml:"tls"`
+	TrustedProxies []string       `yaml:"trusted_proxies"`  // CIDRs whose X-Forwarded-For is trusted
+	CORSOrigins    []string       `yaml:"cors_origins"`     // allowed web origins ("*" to disable check)
+	MaxUploadBytes int64          `yaml:"max_upload_bytes"` // reserved for Phase B uploads; not yet enforced (JSON bodies use a fixed 1 MiB cap)
+	WebDir         string         `yaml:"web_dir"`          // directory of the prebuilt web player served at /web; empty disables it
+	AppLinks       AppLinkConfig  `yaml:"app_links"`        // optional native deep-link association (well-known files)
+	Libraries      []Library      `yaml:"libraries"`
+	Demo           DemoConfig     `yaml:"demo"`     // public demo mode (throwaway accounts)
+	Metadata       MetadataConfig `yaml:"metadata"` // community metadata lookup (Phase 1.5)
 }
 
+// DefaultMetadataBaseURL is the community metadata API used when metadata lookup
+// is enabled and no base_url is configured.
+const DefaultMetadataBaseURL = "https://meta.audiosilo.app"
+
 // ConfigFileName is the config file stored inside the data directory.
 const ConfigFileName = "config.yaml"
 
@@ -140,6 +156,7 @@ func Default(dataDir string) *Config {
 		CORSOrigins:    nil,
 		MaxUploadBytes: 2 << 30, // 2 GiB
 		Libraries:      nil,
+		Metadata:       MetadataConfig{Enabled: true, BaseURL: DefaultMetadataBaseURL},
 	}
 }
 
@@ -230,6 +247,14 @@ func applyEnv(c *Config) {
 	if v := os.Getenv("AUDIOSILO_DEMO_IDLE_TTL"); v != "" {
 		c.Demo.IdleTTL = v
 	}
+	if v := os.Getenv("AUDIOSILO_METADATA_ENABLED"); v != "" {
+		if b, err := strconv.ParseBool(v); err == nil {
+			c.Metadata.Enabled = b
+		}
+	}
+	if v := os.Getenv("AUDIOSILO_METADATA_BASE_URL"); v != "" {
+		c.Metadata.BaseURL = v
+	}
 }
 
 func splitList(v string) []string {
@@ -294,5 +319,17 @@ func (c *Config) Validate() error {
 			}
 		}
 	}
+	if c.Metadata.Enabled {
+		if c.Metadata.BaseURL == "" {
+			return errors.New("metadata lookup requires metadata.base_url")
+		}
+		u, err := url.Parse(c.Metadata.BaseURL)
+		if err != nil {
+			return fmt.Errorf("invalid metadata.base_url %q: %w", c.Metadata.BaseURL, err)
+		}
+		if u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+			return fmt.Errorf("metadata.base_url must be an absolute http(s) URL, got %q", c.Metadata.BaseURL)
+		}
+	}
 	return nil
 }
diff --git a/internal/meta/cache.go b/internal/meta/cache.go
new file mode 100644
index 0000000..bd78e98
--- /dev/null
+++ b/internal/meta/cache.go
@@ -0,0 +1,100 @@
+package meta
+
+import (
+	"sync"
+	"time"
+)
+
+// Cache TTLs for a composed lookup result, keyed on the book's asin/isbn. The
+// key point is that a down or empty upstream is not hammered: a positive match
+// is held a day, a "no match" an hour, and a transport error only a couple of
+// minutes (long enough to shield a burst, short enough to recover quickly).
+const (
+	positiveTTL = 24 * time.Hour
+	notFoundTTL = 1 * time.Hour
+	errorTTL    = 2 * time.Minute
+)
+
+// cacheCap bounds the number of live cache entries. A modest cap keeps memory
+// flat on a large library; eviction is best-effort (expired-first, then
+// arbitrary) since the cache is a latency optimisation, not a store of record.
+const cacheCap = 2048
+
+// cacheEntry is one memoised composition outcome. Exactly one of result/err is
+// meaningful: a non-nil err marks a cached transport error, a nil result with
+// nil err marks a cached "no match" (ErrNotFound), and a non-nil result marks a
+// cached positive match.
+type cacheEntry struct {
+	result *Enrichment
+	err    error
+	expiry time.Time
+}
+
+// cache is a bounded in-memory TTL cache. The clock is injectable so tests can
+// drive TTL expiry deterministically.
+type cache struct {
+	mu  sync.Mutex
+	m   map[string]cacheEntry
+	now func() time.Time
+}
+
+func newCache(now func() time.Time) *cache {
+	if now == nil {
+		now = time.Now
+	}
+	return &cache{m: make(map[string]cacheEntry), now: now}
+}
+
+// get returns the live entry for key, or ok=false when it is absent or expired
+// (an expired entry is dropped on read).
+func (c *cache) get(key string) (cacheEntry, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e, ok := c.m[key]
+	if !ok {
+		return cacheEntry{}, false
+	}
+	if !c.now().Before(e.expiry) {
+		delete(c.m, key)
+		return cacheEntry{}, false
+	}
+	return e, true
+}
+
+// putResult caches a positive match (24h) or a "no match" (1h, result nil).
+func (c *cache) putResult(key string, result *Enrichment, ttl time.Duration) {
+	c.store(key, cacheEntry{result: result, expiry: c.now().Add(ttl)})
+}
+
+// putError caches a transport error marker (2min) so a down upstream isn't
+// re-hit on every request.
+func (c *cache) putError(key string, err error) {
+	c.store(key, cacheEntry{err: err, expiry: c.now().Add(errorTTL)})
+}
+
+func (c *cache) store(key string, e cacheEntry) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if _, exists := c.m[key]; !exists && len(c.m) >= cacheCap {
+		c.evictLocked()
+	}
+	c.m[key] = e
+}
+
+// evictLocked frees room: it first drops every expired entry, and if the map is
+// still at capacity, deletes arbitrary entries until it is under the cap. Callers
+// hold c.mu.
+func (c *cache) evictLocked() {
+	now := c.now()
+	for k, e := range c.m {
+		if !now.Before(e.expiry) {
+			delete(c.m, k)
+		}
+	}
+	for k := range c.m {
+		if len(c.m) < cacheCap {
+			break
+		}
+		delete(c.m, k)
+	}
+}
diff --git a/internal/meta/cache_test.go b/internal/meta/cache_test.go
new file mode 100644
index 0000000..54b1d6b
--- /dev/null
+++ b/internal/meta/cache_test.go
@@ -0,0 +1,68 @@
+package meta
+
+import (
+	"strconv"
+	"testing"
+	"time"
+)
+
+func TestCacheGetMissAndExpiry(t *testing.T) {
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	c := newCache(clk.now)
+
+	if _, ok := c.get("absent"); ok {
+		t.Fatal("expected a miss for an absent key")
+	}
+	c.putResult("k", &Enrichment{Matched: true}, positiveTTL)
+	if _, ok := c.get("k"); !ok {
+		t.Fatal("expected a hit right after put")
+	}
+	clk.advance(positiveTTL + time.Second)
+	if _, ok := c.get("k"); ok {
+		t.Fatal("expected an expired entry to miss")
+	}
+}
+
+func TestCacheEvictsUnderCap(t *testing.T) {
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	c := newCache(clk.now)
+
+	// Fill past the cap; the map must never exceed it.
+	for i := 0; i < cacheCap+500; i++ {
+		c.putResult("k"+strconv.Itoa(i), &Enrichment{Matched: true}, positiveTTL)
+	}
+	c.mu.Lock()
+	n := len(c.m)
+	c.mu.Unlock()
+	if n > cacheCap {
+		t.Fatalf("cache exceeded its cap: %d > %d", n, cacheCap)
+	}
+}
+
+func TestCacheEvictsExpiredFirst(t *testing.T) {
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	c := newCache(clk.now)
+
+	// Fill to capacity with short-lived (error-TTL) entries, then expire them.
+	for i := 0; i < cacheCap; i++ {
+		c.putError("old"+strconv.Itoa(i), errTest)
+	}
+	clk.advance(errorTTL + time.Second)
+	// A fresh insert triggers eviction, which drops the expired entries first.
+	c.putResult("fresh", &Enrichment{Matched: true}, positiveTTL)
+	if _, ok := c.get("fresh"); !ok {
+		t.Fatal("fresh entry should be retained")
+	}
+	c.mu.Lock()
+	n := len(c.m)
+	c.mu.Unlock()
+	if n > cacheCap {
+		t.Fatalf("cache exceeded its cap after eviction: %d", n)
+	}
+}
+
+var errTest = errTestType("boom")
+
+type errTestType string
+
+func (e errTestType) Error() string { return string(e) }
diff --git a/internal/meta/client.go b/internal/meta/client.go
new file mode 100644
index 0000000..090adb1
--- /dev/null
+++ b/internal/meta/client.go
@@ -0,0 +1,168 @@
+// Package meta resolves a book's asin/isbn against the community metadata API
+// (metaserve, meta.audiosilo.app) and composes a server-side enrichment envelope
+// for the player. The lookup is server-side by design: one cached seam, and a
+// self-hosted admin can disable all outbound calls with a single config key
+// (internal/config.MetadataConfig). This package holds the business logic; the
+// api package stays transport-only.
+package meta
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// ErrNotFound is returned when the upstream lookup has no match for the given
+// asin/isbn (a 404 from metaserve's /lookup). The api handler maps it to a
+// 200 {"matched": false} response.
+var ErrNotFound = errors.New("meta: not found")
+
+// clientTimeout bounds a single upstream HTTP request. Kept short so a slow or
+// unreachable metadata service degrades to a fast 502 rather than tying up the
+// per-request timeout budget.
+const clientTimeout = 5 * time.Second
+
+// client is a thin read-only HTTP client for the metaserve JSON API. It GETs and
+// decodes the small set of endpoints the enrichment composition needs.
+type client struct {
+	baseURL string // no trailing slash; API is served under <baseURL>/api/v1
+	http    *http.Client
+}
+
+// newClient builds a client for the given metaserve base URL. baseURL is
+// expected already trimmed of a trailing slash (NewService does the trim).
+func newClient(baseURL string) *client {
+	return &client{
+		baseURL: baseURL,
+		http:    &http.Client{Timeout: clientTimeout},
+	}
+}
+
+// getJSON fetches path (relative to the API root) and decodes the JSON body into
+// out. A 404 becomes ErrNotFound; any other non-2xx (or transport failure) is a
+// plain error the caller treats as an upstream outage.
+func (c *client) getJSON(ctx context.Context, path string, out any) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode == http.StatusNotFound {
+		// Drain a little so the connection can be reused.
+		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<10))
+		return ErrNotFound
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("meta: upstream status %d for %s", resp.StatusCode, path)
+	}
+	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		return fmt.Errorf("meta: decode %s: %w", path, err)
+	}
+	return nil
+}
+
+// lookup resolves an asin (preferred) or isbn to a work id + recording id via
+// GET /api/v1/lookup. Returns ErrNotFound when there is no match.
+func (c *client) lookup(ctx context.Context, asin, isbn string) (*upstreamLookup, error) {
+	q := url.Values{}
+	switch {
+	case asin != "":
+		q.Set("asin", asin)
+	case isbn != "":
+		q.Set("isbn", isbn)
+	default:
+		return nil, ErrNotFound
+	}
+	var out upstreamLookup
+	if err := c.getJSON(ctx, "/api/v1/lookup?"+q.Encode(), &out); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// work fetches the full work document via GET /api/v1/works/{id}.
+func (c *client) work(ctx context.Context, id string) (*upstreamWorkDetail, error) {
+	var out upstreamWorkDetail
+	if err := c.getJSON(ctx, "/api/v1/works/"+url.PathEscape(id), &out); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// series fetches an ordered series rail via GET /api/v1/series/{id}.
+func (c *client) series(ctx context.Context, id string) (*upstreamSeriesDetail, error) {
+	var out upstreamSeriesDetail
+	if err := c.getJSON(ctx, "/api/v1/series/"+url.PathEscape(id), &out); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// ---- upstream shapes (mirror metaserve's internal/serve JSON exactly) --------
+
+type upstreamPersonRef struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type upstreamSeriesRef struct {
+	ID       string `json:"id"`
+	Name     string `json:"name"`
+	Position string `json:"position"`
+}
+
+type upstreamWorkCard struct {
+	ID       string              `json:"id"`
+	Title    string              `json:"title"`
+	Authors  []upstreamPersonRef `json:"authors"`
+	CoverURL *string             `json:"cover_url"`
+}
+
+type upstreamLookup struct {
+	Work        *upstreamWorkCard `json:"work"`
+	RecordingID string            `json:"recording_id"`
+}
+
+type upstreamRecording struct {
+	ID          string              `json:"id"`
+	Narrators   []upstreamPersonRef `json:"narrators"`
+	Abridged    bool                `json:"abridged"`
+	RuntimeMin  int                 `json:"runtime_min"`
+	ReleaseDate string              `json:"release_date"`
+	Publisher   string              `json:"publisher"`
+	CoverURL    string              `json:"cover_url"`
+}
+
+type upstreamWorkDetail struct {
+	ID             string              `json:"id"`
+	Title          string              `json:"title"`
+	Subtitle       string              `json:"subtitle"`
+	Authors        []upstreamPersonRef `json:"authors"`
+	Language       string              `json:"language"`
+	FirstPublished string              `json:"first_published"`
+	Description    string              `json:"description"`
+	Series         []upstreamSeriesRef `json:"series"`
+	Recordings     []upstreamRecording `json:"recordings"`
+}
+
+type upstreamSeriesEntry struct {
+	Position string            `json:"position"`
+	Work     *upstreamWorkCard `json:"work"`
+}
+
+type upstreamSeriesDetail struct {
+	ID      string                `json:"id"`
+	Name    string                `json:"name"`
+	Authors []upstreamPersonRef   `json:"authors"`
+	Works   []upstreamSeriesEntry `json:"works"`
+}
diff --git a/internal/meta/service.go b/internal/meta/service.go
new file mode 100644
index 0000000..2c110ac
--- /dev/null
+++ b/internal/meta/service.go
@@ -0,0 +1,323 @@
+package meta
+
+import (
+	"context"
+	"errors"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// maxSeriesRails caps how many series a work's enrichment fetches. A work is
+// rarely in more than one or two series; the cap bounds the fan-out to metaserve
+// per lookup regardless of odd data. It bounds ATTEMPTS, not successes, so
+// hostile upstream data (a work carrying dozens of series refs) with a failing
+// series endpoint can never issue more than this many series requests.
+const maxSeriesRails = 3
+
+// composeTimeout bounds one full compose fan-out (lookup + work + up to
+// maxSeriesRails series calls). Each call already has the client's 5s timeout,
+// but sequentially those could sum to ~25s against the API's 30s request budget;
+// this keeps the whole composition comfortably under it. When THIS deadline
+// fires while the caller is still live, the parent ctx.Err() stays nil, so the
+// failure IS cached as a transport error for errorTTL - exactly the protective
+// behavior we want against a degraded-but-alive upstream (it is not re-hammered
+// on every cold book).
+const composeTimeout = 15 * time.Second
+
+// MetaPersonRef is the {id,name} shape for an author or narrator.
+type MetaPersonRef struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+// MetaWork is the abstract book in an enrichment envelope.
+type MetaWork struct {
+	ID             string          `json:"id"`
+	Title          string          `json:"title"`
+	Subtitle       string          `json:"subtitle,omitempty"`
+	Authors        []MetaPersonRef `json:"authors"`
+	Language       string          `json:"language"`
+	FirstPublished string          `json:"first_published,omitempty"`
+	Description    string          `json:"description,omitempty"`
+}
+
+// MetaRecording is the specific narration/production matched by the lookup.
+type MetaRecording struct {
+	ID          string          `json:"id"`
+	Narrators   []MetaPersonRef `json:"narrators"`
+	Abridged    bool            `json:"abridged,omitempty"`
+	RuntimeMin  int             `json:"runtime_min,omitempty"`
+	ReleaseDate string          `json:"release_date,omitempty"`
+	Publisher   string          `json:"publisher,omitempty"`
+	CoverURL    string          `json:"cover_url,omitempty"`
+}
+
+// MetaSeriesWork is one entry of a series rail. It carries its own web_url so the
+// client never constructs metadata site URLs itself.
+type MetaSeriesWork struct {
+	ID       string          `json:"id"`
+	Title    string          `json:"title"`
+	Position string          `json:"position"`
+	Authors  []MetaPersonRef `json:"authors"`
+	CoverURL string          `json:"cover_url,omitempty"`
+	WebURL   string          `json:"web_url"`
+}
+
+// MetaSeries is a full ordered series rail, including the current work.
+type MetaSeries struct {
+	ID       string           `json:"id"`
+	Name     string           `json:"name"`
+	Position string           `json:"position"` // the current work's position in this series
+	Works    []MetaSeriesWork `json:"works"`
+}
+
+// Enrichment is the composed envelope returned on a match. Matched is always true
+// here; the api handler emits {"matched": false} for the no-match / no-ids cases.
+type Enrichment struct {
+	Matched   bool           `json:"matched"`
+	Work      *MetaWork      `json:"work,omitempty"`
+	Recording *MetaRecording `json:"recording,omitempty"`
+	Series    []MetaSeries   `json:"series,omitempty"`
+	WebURL    string         `json:"web_url"`
+}
+
+// Service composes book enrichments from the metadata API, with a bounded TTL
+// cache in front so a repeated lookup (and a down upstream) is cheap. A nil
+// *Service means the feature is off; callers must guard on that.
+type Service struct {
+	client  *client
+	baseURL string // metaserve base URL (no trailing slash) for building web_url
+	cache   *cache
+	// composeBudget bounds one full compose fan-out. Defaults to composeTimeout;
+	// a field only so tests can shrink it.
+	composeBudget time.Duration
+}
+
+// NewService builds a Service for the given metaserve base URL. now may be nil
+// (defaults to time.Now); it is injectable so tests can drive cache TTLs.
+func NewService(baseURL string, now func() time.Time) *Service {
+	if now == nil {
+		now = time.Now
+	}
+	base := strings.TrimRight(baseURL, "/")
+	return &Service{
+		client:        newClient(base),
+		baseURL:       base,
+		cache:         newCache(now),
+		composeBudget: composeTimeout,
+	}
+}
+
+// Enrich resolves a book's asin (preferred) or isbn to a composed enrichment.
+// It returns ErrNotFound when there is no match, and a non-nil, non-ErrNotFound
+// error when the upstream is unreachable. Results (including "not found" and
+// transport errors) are cached so a hot path or a down upstream is not re-hit.
+//
+// The returned *Enrichment is shared with the cache and other callers - treat
+// it as immutable; never modify it (or anything it points to) after the call.
+func (s *Service) Enrich(ctx context.Context, asin, isbn string) (*Enrichment, error) {
+	asin = strings.TrimSpace(asin)
+	isbn = strings.TrimSpace(isbn)
+	key := cacheKey(asin, isbn)
+	if key == "" {
+		return nil, ErrNotFound
+	}
+	if e, ok := s.cache.get(key); ok {
+		switch {
+		case e.err != nil:
+			return nil, e.err
+		case e.result == nil:
+			return nil, ErrNotFound
+		default:
+			return e.result, nil
+		}
+	}
+
+	// Run the whole fan-out under its own deadline (see composeTimeout): a
+	// slow-but-alive upstream must not eat the API's whole request budget, and
+	// hitting THIS deadline (parent still live) is cached like any upstream
+	// failure below, so a degraded upstream is not re-hammered per cold book.
+	cctx, cancel := context.WithTimeout(ctx, s.composeBudget)
+	defer cancel()
+	result, complete, err := s.compose(cctx, asin, isbn)
+	switch {
+	case errors.Is(err, ErrNotFound):
+		s.cache.putResult(key, nil, notFoundTTL)
+		return nil, ErrNotFound
+	case err != nil:
+		// Only cache failures the UPSTREAM caused. When the caller's own context
+		// is done (the client aborted the request or its deadline passed -
+		// routine: the player cancels in-flight fetches on navigation), caching
+		// the resulting error would poison this book's enrichment with 502s for
+		// the whole error TTL while upstream is perfectly healthy. The PARENT
+		// ctx.Err() cleanly discriminates the two: it is nil for a genuine
+		// upstream failure, including the client's per-call 5s timeout or the
+		// compose deadline firing under a live caller.
+		if ctx.Err() == nil {
+			s.cache.putError(key, err)
+		}
+		return nil, err
+	case !complete:
+		// A usable envelope, but at least one series rail failed transiently.
+		// Caching it for the full positive TTL would hide "more in this series"
+		// for a day on a blip, so hold it only briefly (errorTTL) and retry
+		// soon. And if the caller's context is done, the missing rails were
+		// caused by the CALLER's cancellation mid-fan-out - cache nothing at
+		// all, same reasoning as the error branch above.
+		if ctx.Err() == nil {
+			s.cache.putResult(key, result, errorTTL)
+		}
+		return result, nil
+	default:
+		s.cache.putResult(key, result, positiveTTL)
+		return result, nil
+	}
+}
+
+// cacheKey is "a:"+asin when an asin is present (asin is preferred for the
+// lookup), else "i:"+isbn, else "" (nothing to look up).
+func cacheKey(asin, isbn string) string {
+	switch {
+	case asin != "":
+		return "a:" + asin
+	case isbn != "":
+		return "i:" + isbn
+	default:
+		return ""
+	}
+}
+
+// compose runs the uncached lookup -> work -> series fan-out. complete is false
+// when the envelope is usable but a series rail fetch failed (the caller caches
+// such a partial result only briefly).
+func (s *Service) compose(ctx context.Context, asin, isbn string) (*Enrichment, bool, error) {
+	lookup, err := s.client.lookup(ctx, asin, isbn)
+	if err != nil {
+		return nil, false, err
+	}
+	if lookup.Work == nil {
+		return nil, false, ErrNotFound
+	}
+	detail, err := s.client.work(ctx, lookup.Work.ID)
+	if err != nil {
+		// A work id handed back by lookup that then 404s is an upstream
+		// inconsistency, not a clean "no match"; treat it as an error.
+		if errors.Is(err, ErrNotFound) {
+			return nil, false, errors.New("meta: lookup returned an unknown work id")
+		}
+		return nil, false, err
+	}
+
+	rails, complete := s.seriesRails(ctx, detail)
+	env := &Enrichment{
+		Matched: true,
+		Work: &MetaWork{
+			ID:             detail.ID,
+			Title:          detail.Title,
+			Subtitle:       detail.Subtitle,
+			Authors:        toPersonRefs(detail.Authors),
+			Language:       detail.Language,
+			FirstPublished: detail.FirstPublished,
+			Description:    detail.Description,
+		},
+		Recording: pickRecording(detail.Recordings, lookup.RecordingID),
+		Series:    rails,
+		WebURL:    s.workURL(detail.ID),
+	}
+	return env, complete, nil
+}
+
+// pickRecording returns the recording matching recordingID, falling back to the
+// first recording when there is no match (or no id). Returns nil when the work
+// has no recordings.
+func pickRecording(recs []upstreamRecording, recordingID string) *MetaRecording {
+	if len(recs) == 0 {
+		return nil
+	}
+	chosen := &recs[0]
+	if recordingID != "" {
+		for i := range recs {
+			if recs[i].ID == recordingID {
+				chosen = &recs[i]
+				break
+			}
+		}
+	}
+	return &MetaRecording{
+		ID:          chosen.ID,
+		Narrators:   toPersonRefs(chosen.Narrators),
+		Abridged:    chosen.Abridged,
+		RuntimeMin:  chosen.RuntimeMin,
+		ReleaseDate: chosen.ReleaseDate,
+		Publisher:   chosen.Publisher,
+		CoverURL:    chosen.CoverURL,
+	}
+}
+
+// seriesRails fetches each series the work belongs to (capped) and builds the
+// full ordered rail for each. A per-series fetch failure is non-fatal: that rail
+// is skipped so the rest of the enrichment (progressive enhancement) still
+// returns - but it is reported via complete=false so the caller caches the
+// partial envelope only briefly instead of hiding the rail for the whole
+// positive TTL. The work's own position in the series comes from the work
+// detail.
+func (s *Service) seriesRails(ctx context.Context, detail *upstreamWorkDetail) (rails []MetaSeries, complete bool) {
+	// Bound ATTEMPTS up front, not successes: with a failing series endpoint and
+	// odd/hostile data (dozens of series refs on one work), a success-counted
+	// loop would issue one 5s-timeout GET per ref.
+	refs := detail.Series
+	if len(refs) > maxSeriesRails {
+		refs = refs[:maxSeriesRails]
+	}
+	complete = true
+	var out []MetaSeries
+	for _, ref := range refs {
+		sd, err := s.client.series(ctx, ref.ID)
+		if err != nil || sd == nil {
+			complete = false
+			continue
+		}
+		works := make([]MetaSeriesWork, 0, len(sd.Works))
+		for _, entry := range sd.Works {
+			if entry.Work == nil {
+				continue
+			}
+			works = append(works, MetaSeriesWork{
+				ID:       entry.Work.ID,
+				Title:    entry.Work.Title,
+				Position: entry.Position,
+				Authors:  toPersonRefs(entry.Work.Authors),
+				CoverURL: deref(entry.Work.CoverURL),
+				WebURL:   s.workURL(entry.Work.ID),
+			})
+		}
+		out = append(out, MetaSeries{
+			ID:       ref.ID,
+			Name:     ref.Name,
+			Position: ref.Position,
+			Works:    works,
+		})
+	}
+	return out, complete
+}
+
+// workURL builds the metadata site URL for a work id.
+func (s *Service) workURL(id string) string {
+	return s.baseURL + "/work?id=" + url.QueryEscape(id)
+}
+
+func toPersonRefs(in []upstreamPersonRef) []MetaPersonRef {
+	out := make([]MetaPersonRef, 0, len(in))
+	for _, p := range in {
+		out = append(out, MetaPersonRef(p))
+	}
+	return out
+}
+
+func deref(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
diff --git a/internal/meta/service_test.go b/internal/meta/service_test.go
new file mode 100644
index 0000000..16c3e27
--- /dev/null
+++ b/internal/meta/service_test.go
@@ -0,0 +1,534 @@
+package meta
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// mockMeta is a configurable metaserve stand-in. Each endpoint counts its hits
+// so tests can assert caching, and lookup/work/series responses are overridable.
+type mockMeta struct {
+	lookupJSON string
+	lookupCode int
+	workJSON   string
+	workCode   int
+	seriesJSON map[string]string // series id -> body
+	lookupHits atomic.Int32
+	workHits   atomic.Int32
+	seriesHits atomic.Int32
+}
+
+func (m *mockMeta) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, _ *http.Request) {
+		m.lookupHits.Add(1)
+		if m.lookupCode != 0 {
+			w.WriteHeader(m.lookupCode)
+			return
+		}
+		_, _ = w.Write([]byte(m.lookupJSON))
+	})
+	mux.HandleFunc("GET /api/v1/works/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		m.workHits.Add(1)
+		if m.workCode != 0 {
+			w.WriteHeader(m.workCode)
+			return
+		}
+		_, _ = w.Write([]byte(m.workJSON))
+	})
+	mux.HandleFunc("GET /api/v1/series/{id}", func(w http.ResponseWriter, r *http.Request) {
+		m.seriesHits.Add(1)
+		body, ok := m.seriesJSON[r.PathValue("id")]
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write([]byte(body))
+	})
+	return mux
+}
+
+const martianLookup = `{"work":{"id":"the-martian","title":"The Martian","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":null,"added_at":null},"recording_id":"rec2"}`
+
+const martianWork = `{
+  "id":"the-martian","title":"The Martian","subtitle":"A Novel",
+  "authors":[{"id":"andy-weir","name":"Andy Weir"}],
+  "language":"en","first_published":"2011","description":"Stranded on Mars.",
+  "series":[{"id":"mars","name":"Mars","position":"1"}],
+  "recordings":[
+    {"id":"rec1","narrators":[{"id":"nobody","name":"Nobody"}],"abridged":false,"runtime_min":600,"release_date":"2012-01-01","publisher":"Other","cover_url":"https://c/rec1.jpg","chapter_count":10},
+    {"id":"rec2","narrators":[{"id":"r-c-bray","name":"R. C. Bray"}],"abridged":false,"runtime_min":634,"release_date":"2013-03-22","publisher":"Podium Audio","cover_url":"https://c/rec2.jpg","chapter_count":12}
+  ]
+}`
+
+const marsSeries = `{
+  "id":"mars","name":"Mars","authors":[{"id":"andy-weir","name":"Andy Weir"}],
+  "works":[
+    {"position":"1","work":{"id":"the-martian","title":"The Martian","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":"https://c/tm.jpg","added_at":null}},
+    {"position":"2","work":{"id":"artemis","title":"Artemis","authors":[{"id":"andy-weir","name":"Andy Weir"}],"series":null,"cover_url":null,"added_at":null}}
+  ]
+}`
+
+func fullMock() *mockMeta {
+	return &mockMeta{
+		lookupJSON: martianLookup,
+		workJSON:   martianWork,
+		seriesJSON: map[string]string{"mars": marsSeries},
+	}
+}
+
+func TestEnrichComposition(t *testing.T) {
+	m := fullMock()
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	env, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatalf("Enrich: %v", err)
+	}
+	if !env.Matched || env.Work == nil {
+		t.Fatalf("expected matched work, got %+v", env)
+	}
+	if env.Work.ID != "the-martian" || env.Work.Title != "The Martian" || env.Work.Subtitle != "A Novel" {
+		t.Fatalf("work fields wrong: %+v", env.Work)
+	}
+	if env.Work.Description != "Stranded on Mars." || env.Work.FirstPublished != "2011" || env.Work.Language != "en" {
+		t.Fatalf("work detail fields wrong: %+v", env.Work)
+	}
+	if len(env.Work.Authors) != 1 || env.Work.Authors[0].Name != "Andy Weir" {
+		t.Fatalf("authors wrong: %+v", env.Work.Authors)
+	}
+	// Recording is chosen by lookup's recording_id (rec2), not the first (rec1).
+	if env.Recording == nil || env.Recording.ID != "rec2" || env.Recording.Publisher != "Podium Audio" {
+		t.Fatalf("recording pick wrong: %+v", env.Recording)
+	}
+	if env.Recording.RuntimeMin != 634 || env.Recording.Narrators[0].Name != "R. C. Bray" {
+		t.Fatalf("recording fields wrong: %+v", env.Recording)
+	}
+	// web_url built from base + escaped work id.
+	if env.WebURL != srv.URL+"/work?id=the-martian" {
+		t.Fatalf("work web_url = %q", env.WebURL)
+	}
+	// Series rail: full ordered list including the current work, per-entry web_url.
+	if len(env.Series) != 1 {
+		t.Fatalf("expected 1 series rail, got %d", len(env.Series))
+	}
+	rail := env.Series[0]
+	if rail.ID != "mars" || rail.Position != "1" || len(rail.Works) != 2 {
+		t.Fatalf("series rail wrong: %+v", rail)
+	}
+	if rail.Works[0].ID != "the-martian" || rail.Works[0].WebURL != srv.URL+"/work?id=the-martian" {
+		t.Fatalf("series work[0] wrong: %+v", rail.Works[0])
+	}
+	if rail.Works[0].CoverURL != "https://c/tm.jpg" {
+		t.Fatalf("series work[0] cover wrong: %+v", rail.Works[0])
+	}
+	if rail.Works[1].ID != "artemis" || rail.Works[1].Position != "2" || rail.Works[1].CoverURL != "" {
+		t.Fatalf("series work[1] wrong: %+v", rail.Works[1])
+	}
+	if rail.Works[1].WebURL != srv.URL+"/work?id=artemis" {
+		t.Fatalf("series work[1] web_url wrong: %+v", rail.Works[1])
+	}
+}
+
+func TestEnrichRecordingFallbackToFirst(t *testing.T) {
+	m := fullMock()
+	// lookup returns an unknown recording_id -> fall back to the first recording.
+	m.lookupJSON = `{"work":{"id":"the-martian","title":"The Martian","authors":[],"series":null,"cover_url":null,"added_at":null},"recording_id":"does-not-exist"}`
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	env, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatalf("Enrich: %v", err)
+	}
+	if env.Recording == nil || env.Recording.ID != "rec1" {
+		t.Fatalf("expected fallback to first recording rec1, got %+v", env.Recording)
+	}
+}
+
+func TestEnrichISBNPreferredAfterASIN(t *testing.T) {
+	m := fullMock()
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	// Only an isbn present: lookup should still resolve (query carries isbn).
+	env, err := svc.Enrich(context.Background(), "", "9780804139021")
+	if err != nil {
+		t.Fatalf("Enrich by isbn: %v", err)
+	}
+	if !env.Matched {
+		t.Fatalf("expected match by isbn")
+	}
+}
+
+func TestEnrichNotFound(t *testing.T) {
+	m := fullMock()
+	m.lookupCode = http.StatusNotFound
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	_, err := svc.Enrich(context.Background(), "B0MISSING", "")
+	if !errors.Is(err, ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestEnrichNoIDs(t *testing.T) {
+	svc := NewService("https://meta.example", nil)
+	if _, err := svc.Enrich(context.Background(), "  ", ""); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("expected ErrNotFound for empty ids, got %v", err)
+	}
+}
+
+func TestEnrichTransportError(t *testing.T) {
+	m := fullMock()
+	m.lookupCode = http.StatusInternalServerError
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	_, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err == nil || errors.Is(err, ErrNotFound) {
+		t.Fatalf("expected a transport error distinct from ErrNotFound, got %v", err)
+	}
+}
+
+func TestEnrichWorkInconsistencyIsError(t *testing.T) {
+	m := fullMock()
+	m.workCode = http.StatusNotFound // lookup found a work id the works endpoint 404s
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	_, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err == nil || errors.Is(err, ErrNotFound) {
+		t.Fatalf("an unknown work id should surface as an error, not a clean not-found: %v", err)
+	}
+}
+
+func TestEnrichSeriesFailureNonFatal(t *testing.T) {
+	m := fullMock()
+	delete(m.seriesJSON, "mars") // series fetch 404s
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	env, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatalf("a failed series rail must not fail the whole enrichment: %v", err)
+	}
+	if len(env.Series) != 0 {
+		t.Fatalf("expected the failed rail to be skipped, got %+v", env.Series)
+	}
+	if env.Work == nil {
+		t.Fatalf("core enrichment should still be present")
+	}
+}
+
+// TestEnrichPartialSeriesShortCached: a transient series-rail failure must not
+// be cached positive for the full 24h - the partial envelope is held only for
+// the short errorTTL, so "more in this series" reappears within minutes of the
+// blip clearing rather than a day later.
+func TestEnrichPartialSeriesShortCached(t *testing.T) {
+	var seriesFail atomic.Bool
+	seriesFail.Store(true)
+	var lookupHits atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, _ *http.Request) {
+		lookupHits.Add(1)
+		_, _ = w.Write([]byte(martianLookup))
+	})
+	mux.HandleFunc("GET /api/v1/works/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(martianWork))
+	})
+	mux.HandleFunc("GET /api/v1/series/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		if seriesFail.Load() {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		_, _ = w.Write([]byte(marsSeries))
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	svc := NewService(srv.URL, clk.now)
+
+	// First call: the series endpoint is down, the envelope is usable but the
+	// rail is missing.
+	env, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatalf("partial Enrich should still succeed: %v", err)
+	}
+	if len(env.Series) != 0 {
+		t.Fatalf("expected the failed rail to be missing, got %+v", env.Series)
+	}
+	// The partial result IS cached (briefly): an immediate retry is a hit.
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err != nil {
+		t.Fatal(err)
+	}
+	if got := lookupHits.Load(); got != 1 {
+		t.Fatalf("partial result should be short-cached, expected 1 lookup, got %d", got)
+	}
+
+	// Past the SHORT (error) TTL - far inside the 24h positive TTL - the blip
+	// has cleared and a re-fetch restores the full rails.
+	seriesFail.Store(false)
+	clk.advance(errorTTL + time.Second)
+	env, err = svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := lookupHits.Load(); got != 2 {
+		t.Fatalf("expected a re-fetch past the short partial TTL, got %d lookups", got)
+	}
+	if len(env.Series) != 1 || len(env.Series[0].Works) != 2 {
+		t.Fatalf("expected the full series rail after recovery, got %+v", env.Series)
+	}
+}
+
+// TestEnrichSeriesAttemptsBounded: the series fan-out is bounded by ATTEMPTS,
+// not successes - a work carrying more series refs than maxSeriesRails with a
+// failing series endpoint issues exactly maxSeriesRails series requests, never
+// one per ref.
+func TestEnrichSeriesAttemptsBounded(t *testing.T) {
+	manySeriesWork := `{
+	  "id":"odd","title":"Odd","subtitle":"",
+	  "authors":[{"id":"a","name":"A"}],
+	  "language":"en","first_published":"","description":"",
+	  "series":[
+	    {"id":"s1","name":"S1","position":"1"},
+	    {"id":"s2","name":"S2","position":"1"},
+	    {"id":"s3","name":"S3","position":"1"},
+	    {"id":"s4","name":"S4","position":"1"},
+	    {"id":"s5","name":"S5","position":"1"},
+	    {"id":"s6","name":"S6","position":"1"}
+	  ],
+	  "recordings":[]
+	}`
+	var seriesHits atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"work":{"id":"odd","title":"Odd","authors":[],"cover_url":null},"recording_id":""}`))
+	})
+	mux.HandleFunc("GET /api/v1/works/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(manySeriesWork))
+	})
+	mux.HandleFunc("GET /api/v1/series/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		seriesHits.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	if _, err := svc.Enrich(context.Background(), "B0ODD", ""); err != nil {
+		t.Fatalf("series failures are non-fatal: %v", err)
+	}
+	if got := seriesHits.Load(); got != maxSeriesRails {
+		t.Fatalf("series attempts = %d, want exactly %d (bounded by attempts, not successes)", got, maxSeriesRails)
+	}
+}
+
+// TestEnrichComposeDeadlineCached: the compose fan-out has its own deadline, and
+// hitting it while the CALLER is still live is a genuine upstream-degradation
+// signal - the failure must be cached (for errorTTL) so a slow-but-alive
+// upstream is not re-hammered on every cold book.
+func TestEnrichComposeDeadlineCached(t *testing.T) {
+	var lookupHits atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, r *http.Request) {
+		lookupHits.Add(1)
+		// Block past the (shrunk) compose budget; released when the client's
+		// derived deadline cancels the request.
+		<-r.Context().Done()
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+	svc.composeBudget = 50 * time.Millisecond // test-scoped; production default is composeTimeout
+
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected the compose deadline to surface as an error")
+	}
+	// The parent context was live, so the deadline failure WAS cached: a second
+	// call within errorTTL never reaches upstream.
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected the cached deadline error")
+	}
+	if got := lookupHits.Load(); got != 1 {
+		t.Fatalf("deadline failure should be cached, expected 1 lookup, got %d", got)
+	}
+}
+
+// clock is a test-controllable time source.
+type clock struct {
+	mu sync.Mutex
+	t  time.Time
+}
+
+func (c *clock) now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.t
+}
+
+func (c *clock) advance(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.t = c.t.Add(d)
+}
+
+func TestEnrichPositiveCacheHit(t *testing.T) {
+	m := fullMock()
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	svc := NewService(srv.URL, clk.now)
+
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err != nil {
+		t.Fatal(err)
+	}
+	// The second call is a cache hit: no additional upstream traffic.
+	if got := m.lookupHits.Load(); got != 1 {
+		t.Fatalf("expected 1 upstream lookup (cached), got %d", got)
+	}
+
+	// Just before the positive TTL expires it is still cached.
+	clk.advance(positiveTTL - time.Minute)
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err != nil {
+		t.Fatal(err)
+	}
+	if got := m.lookupHits.Load(); got != 1 {
+		t.Fatalf("expected still-cached before TTL, got %d lookups", got)
+	}
+
+	// Past the TTL it re-fetches.
+	clk.advance(2 * time.Minute)
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err != nil {
+		t.Fatal(err)
+	}
+	if got := m.lookupHits.Load(); got != 2 {
+		t.Fatalf("expected a re-fetch past the positive TTL, got %d lookups", got)
+	}
+}
+
+func TestEnrichNotFoundCached(t *testing.T) {
+	m := fullMock()
+	m.lookupCode = http.StatusNotFound
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	svc := NewService(srv.URL, clk.now)
+
+	for i := 0; i < 3; i++ {
+		if _, err := svc.Enrich(context.Background(), "B0MISSING", ""); !errors.Is(err, ErrNotFound) {
+			t.Fatalf("call %d: expected ErrNotFound, got %v", i, err)
+		}
+	}
+	if got := m.lookupHits.Load(); got != 1 {
+		t.Fatalf("not-found should be cached, expected 1 lookup, got %d", got)
+	}
+	// Past the (shorter) not-found TTL it re-checks.
+	clk.advance(notFoundTTL + time.Minute)
+	if _, err := svc.Enrich(context.Background(), "B0MISSING", ""); !errors.Is(err, ErrNotFound) {
+		t.Fatal(err)
+	}
+	if got := m.lookupHits.Load(); got != 2 {
+		t.Fatalf("expected a re-check past the not-found TTL, got %d", got)
+	}
+}
+
+// TestEnrichCallerCancelNotCached is the cache-poisoning regression: the api
+// handler passes the request context, and players abort in-flight requests
+// routinely (navigation cancels fetches). A failure caused by the CALLER's own
+// cancelled context must NOT be cached as a transport error - otherwise one
+// tap-and-back poisons that book's enrichment with 502s for the whole error TTL
+// while upstream is healthy. A subsequent request with a live context must reach
+// upstream again and compose normally.
+func TestEnrichCallerCancelNotCached(t *testing.T) {
+	started := make(chan struct{})
+	var calls atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/v1/lookup", func(w http.ResponseWriter, r *http.Request) {
+		if calls.Add(1) == 1 {
+			// First call: hold the request open until the caller cancels.
+			close(started)
+			<-r.Context().Done()
+			return
+		}
+		_, _ = w.Write([]byte(martianLookup))
+	})
+	mux.HandleFunc("GET /api/v1/works/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(martianWork))
+	})
+	mux.HandleFunc("GET /api/v1/series/{id}", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(marsSeries))
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+	svc := NewService(srv.URL, nil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() {
+		<-started
+		cancel()
+	}()
+	if _, err := svc.Enrich(ctx, "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected an error from the cancelled request")
+	}
+
+	// A fresh, live context must hit upstream again (nothing was cached) and
+	// compose the full envelope.
+	env, err := svc.Enrich(context.Background(), "B00FLIJJSY", "")
+	if err != nil {
+		t.Fatalf("post-cancel Enrich must not be poisoned by a cached error: %v", err)
+	}
+	if !env.Matched || env.Work == nil || env.Work.ID != "the-martian" {
+		t.Fatalf("expected a full match after the cancelled attempt, got %+v", env)
+	}
+	if got := calls.Load(); got != 2 {
+		t.Fatalf("expected the second Enrich to reach upstream (2 lookups), got %d", got)
+	}
+}
+
+func TestEnrichTransportErrorCachedBriefly(t *testing.T) {
+	m := fullMock()
+	m.lookupCode = http.StatusBadGateway
+	srv := httptest.NewServer(m.handler())
+	defer srv.Close()
+	clk := &clock{t: time.Unix(1_700_000_000, 0)}
+	svc := NewService(srv.URL, clk.now)
+
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected a transport error")
+	}
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected a cached transport error")
+	}
+	// A down upstream is not hammered: within the error TTL there is one hit.
+	if got := m.lookupHits.Load(); got != 1 {
+		t.Fatalf("transport error should be cached, expected 1 lookup, got %d", got)
+	}
+	clk.advance(errorTTL + time.Second)
+	if _, err := svc.Enrich(context.Background(), "B00FLIJJSY", ""); err == nil {
+		t.Fatal("expected error")
+	}
+	if got := m.lookupHits.Load(); got != 2 {
+		t.Fatalf("expected a retry past the error TTL, got %d", got)
+	}
+}