diff --git a/PATCHES.md b/PATCHES.md
index d44f909..2f048fe 100644
--- a/PATCHES.md
+++ b/PATCHES.md
@@ -500,6 +500,26 @@ Studio e guarda l'errore reale. Tipicamente:
 
 ## Cronologia delle patch
 
+- **2026-08-16** — v2.9.0: Sync upstream `41d3b9c` (249 commit dopo `abbc2a6`).
+  Upstream ha riscritto lo stack di riproduzione ("unified API": query TIDAL
+  native via `HiFiClient` + `music-api.geeked.wtf` con Turnstile + fallback
+  Deezer; account con better-auth, `@capacitor/browser` per l'OAuth nativo).
+  Patch rimosse: **#53** `storage.js` fallback istanze streaming (upstream ha
+  tolto la lista hardcoded, `INSTANCES_URLS` è vuoto e i vecchi proxy HiFi
+  sono tutti 503/irraggiungibili) e **#56** `HiFi.ts` `tracks.albums.coverArt`
+  (merged upstream). Le altre 12/12 patch matchano. Aggiunto al manifest del
+  wrapper l'intent-filter `monochrome://auth-callback` (login nativo).
+  `build-web.sh`: `rm -f dist-web.zip` prima dello zip (`zip -r` aggiornava
+  l'archivio vecchio) e prune di `assets/` sul server dopo il deploy.
+  **Nota importante**: sul dominio `music.fabiodalez.it` la riproduzione NON
+  funziona più — le API upstream (Turnstile sitekey, CORS del fallback Deezer)
+  sono bloccate ai soli domini ufficiali (issue #725, risposta del maintainer:
+  "self-hosted instances won't be able to use the API"). Servono un App API
+  Key personale, oppure dev-mode + estensione con account TIDAL. L'APK usa
+  `hostname: monochrome.tf` come origin del WebView e resta nel perimetro:
+  **verificato su emulatore** (Pixel 6 / API 35, via CDP sul WebView) — ricerca
+  100 brani, play di "Creep" e brano successivo con MediaSession `PLAYING` e
+  notifica del foreground service.
 - **2026-04-10** — Initial release: 50 + 1 ottimizzazioni implementate
   (escluso #31 battery opt su richiesta esplicita dell'utente). Aggiunti
   `fm-build.sh`, `verify-patches.sh`, `PATCHES.md`. Rimosso il sed obsoleto
diff --git a/android/app/build.gradle b/android/app/build.gradle
index c212f23..1a810d9 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -7,8 +7,8 @@ android {
         applicationId "com.monochrome.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 12
-        versionName "2.6.1"
+        versionCode 13
+        versionName "2.9.0"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 0f006e0..93835ab 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -25,6 +25,14 @@
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
 
+            <!-- Native OAuth return (js/accounts/auth.js: monochrome://auth-callback via @capacitor/browser + App.appUrlOpen) -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="monochrome" android:host="auth-callback" />
+            </intent-filter>
+
         </activity>
 
         <service
diff --git a/build-android.sh b/build-android.sh
index 1682ca9..1919c15 100755
--- a/build-android.sh
+++ b/build-android.sh
@@ -193,22 +193,11 @@ def patch(path, before, after, label):
     print("  + " + label)
     return True
 
-# ── #53: Add live streaming instances to hardcoded fallback list ──
-# The uptime worker returns streaming:[] so the default list is the only fallback
-# when the network fetch fails on a fresh install. We add the same 3 live instances
-# used in the web app (index.html) and android-service.js localStorage bootstrap.
-# frankfurt-2 was previously here but is now DOWN (504).
-patch(
-    "js/storage.js",
-    """                    streaming: [
-                        { url: 'https://hifi.geeked.wtf', version: '2.7' },""",
-    """                    streaming: [
-                        { url: 'https://eu-central.monochrome.tf', version: '2.10' },
-                        { url: 'https://us-west.monochrome.tf', version: '2.10' },
-                        { url: 'https://hifi-api.kennyy.com.br', version: '2.10' },
-                        { url: 'https://hifi.geeked.wtf', version: '2.7' },""",
-    "storage.js: add live streaming instances to fallback",
-)
+# ── #53: storage.js streaming fallback — REMOVED 2026-08-16 ──
+# Upstream (41d3b9c) dropped the hardcoded instance list: INSTANCES_URLS is
+# empty, the offline fallback is `api: [lol.samidy.workers.dev], streaming: []`
+# and playback goes through the "unified playback" API (music-api.geeked.wtf)
+# plus native TIDAL queries (HiFiClient). The old HiFi proxies are all 503/down.
 
 # ── #54: REMOVED — was forcing native HiFiClient for streaming, which gives
 # only preview (1:40) because the browser client credentials aren't premium.
@@ -437,17 +426,8 @@ patch(
     "HiFi.ts: add artists.profileArt to unified search include (fixes Picsum artist covers)",
 )
 
-# ── #56: HiFi.ts artist page — add tracks.albums.coverArt to include ──
-# The artist endpoint includes tracks,tracks.albums (top tracks with album ref)
-# but NOT tracks.albums.coverArt. Album items land in includedMap without the
-# coverArt relationship, so resolveArtworkId(albumItem,'coverArt') returns null
-# → track.album.cover = null → Picsum on every track row in the artist page.
-patch(
-    "js/HiFi.ts",
-    "include: 'albums,albums.coverArt,tracks,tracks.albums,biography,profileArt',",
-    "include: 'albums,albums.coverArt,tracks,tracks.albums,tracks.albums.coverArt,biography,profileArt',",
-    "HiFi.ts: add tracks.albums.coverArt to artist page include (fixes Picsum track covers)",
-)
+# ── #56: HiFi.ts artist page tracks.albums.coverArt — UPSTREAM MERGED (2026-08-16) ──
+# Upstream now ships 'albums,albums.coverArt,tracks,tracks.albums,tracks.albums.coverArt,biography,profileArt'.
 
 print("  ✓ Upstream JS optimizations applied.")
 PYEOF
diff --git a/build-web.sh b/build-web.sh
index 664d84c..5c94cdf 100755
--- a/build-web.sh
+++ b/build-web.sh
@@ -134,18 +134,11 @@ def patch(path, before, after, label):
     print("  + " + label)
     return True
 
-# ── streaming instances in fallback ──
-patch(
-    "js/storage.js",
-    """                    streaming: [
-                        { url: 'https://hifi.geeked.wtf', version: '2.7' },""",
-    """                    streaming: [
-                        { url: 'https://eu-central.monochrome.tf', version: '2.10' },
-                        { url: 'https://us-west.monochrome.tf', version: '2.10' },
-                        { url: 'https://hifi-api.kennyy.com.br', version: '2.10' },
-                        { url: 'https://hifi.geeked.wtf', version: '2.7' },""",
-    "storage.js: add live streaming instances to fallback",
-)
+# ── storage.js streaming fallback: REMOVED 2026-08-16 ──
+# Upstream (41d3b9c) dropped the hardcoded instance list: INSTANCES_URLS is
+# empty, the offline fallback is `api: [lol.samidy.workers.dev], streaming: []`
+# and playback goes through the "unified playback" API (music-api.geeked.wtf)
+# plus native TIDAL queries (HiFiClient). The old HiFi proxies are all 503/down.
 
 # ── search debounce 3000ms → 800ms ──
 patch(
@@ -329,13 +322,8 @@ patch(
     "HiFi.ts: add artists.profileArt to unified search include (fixes Picsum artist covers)",
 )
 
-# ── HiFi.ts: add tracks.albums.coverArt to artist page include ──
-patch(
-    "js/HiFi.ts",
-    "include: 'albums,albums.coverArt,tracks,tracks.albums,biography,profileArt',",
-    "include: 'albums,albums.coverArt,tracks,tracks.albums,tracks.albums.coverArt,biography,profileArt',",
-    "HiFi.ts: add tracks.albums.coverArt to artist page include (fixes Picsum track covers)",
-)
+# ── HiFi.ts: tracks.albums.coverArt on artist page — UPSTREAM MERGED (2026-08-16) ──
+# Upstream now ships 'albums,albums.coverArt,tracks,tracks.albums,tracks.albums.coverArt,biography,profileArt'.
 
 # ── Workbox: CacheFirst → NetworkOnly for audio/video ──
 patch(
@@ -359,6 +347,8 @@ echo "  ✓ Build complete."
 # ── 6. Package for upload ──
 echo ""
 echo "▶ Packaging dist/ for upload..."
+# `zip -r` UPDATES an existing archive (stale entries from older builds survive) — start clean.
+rm -f dist-web.zip
 (cd dist && zip -r ../dist-web.zip . -x "*.map") 2>&1 | tail -3
 SIZE=$(du -h "$PROJECT_DIR/dist-web.zip" | awk '{print $1}')
 echo "  ✓ dist-web.zip (${SIZE}) ready."
@@ -370,6 +360,12 @@ if rsync -az --no-perms --omit-dir-times \
     -e "ssh -o ConnectTimeout=10 -o BatchMode=yes" \
     dist/ "${DEPLOY_HOST}:~/${DEPLOY_PATH}/" 2>&1; then
     echo "  ✓ Deployed to ${DEPLOY_HOST}:~/${DEPLOY_PATH}/"
+    # assets/ is 100% build output (hashed chunks + public/assets) → safe to prune
+    # stale files from previous builds there. Root is left untouched (.htaccess, cgi-bin, …).
+    rsync -az --delete --no-perms --omit-dir-times \
+        -e "ssh -o ConnectTimeout=10 -o BatchMode=yes" \
+        dist/assets/ "${DEPLOY_HOST}:~/${DEPLOY_PATH}/assets/" 2>&1 \
+        && echo "  ✓ Pruned stale files in assets/"
     echo ""
     echo "══════════════════════════════════════════"
     echo "  Live at: https://${DEPLOY_PATH}/"