diff --git a/CLAUDE.md b/CLAUDE.md
index 19428d4..b5f2055 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -42,6 +42,7 @@ CI runs the full suite only on Linux (service container); the Windows leg is a c
 - **Tenancy is enforced at the storage layer.** Server handlers under `/api/v1/*` extract `UserId` from the `middleware::authenticate` middleware and call `*_for_user` methods only — never the single-tenant trait surface. `PostgresProfileRepository` deliberately does NOT implement `ProfileRepository`, so the compiler stops a careless `list_all()` from leaking another tenant's rows. Apply the same pattern when adding library / track / playlist repositories.
 - **Auth: JWT-only (Phase 1.d.2).** `middleware::authenticate` requires a Bearer JWT signed by the upstream Better Auth issuer. The middleware verifies the token via [`AppState::jwt_verifier`], then `db::users::find_or_provision_by_external_id(state.db, &sub, now_ms)` lazy-onboards the user on first request — a valid signature is the authoritative onboarding signal, so no separate `POST /api/v1/users` exists. Boot requires the full `WAVEFLOW_JWT_*` triple (`_JWKS_URL` / `_ISSUER` / `_AUDIENCE`); the legacy `X-User-Id` dev shim retired alongside `WAVEFLOW_DEV_AUTH`.
 - **Streaming (Phase 1.e).** Two endpoints: `POST /api/v1/profiles/{p}/libraries/{l}/tracks/{t}/stream-url` (JWT-authed) verifies tenant ownership and signs a short-lived (≤ 60 s) URL via [`stream_token::mint`]; `GET /api/v1/stream/{token}` is mounted OUTSIDE the JWT layer because browsers can't attach a Bearer to `<audio src>` — the HMAC in the token IS the auth. The stream handler canonicalises `<music_root>/<file_path>` and refuses anything resolving outside `WAVEFLOW_MUSIC_ROOT` (path-traversal guard via `std::fs::canonicalize` + prefix check). Range requests handled in-process: `Accept-Ranges: bytes`, 206 + `Content-Range` on partial, 416 on unsatisfiable. Both endpoints answer 503 when streaming is disabled at boot (`WAVEFLOW_MUSIC_ROOT` + `WAVEFLOW_STREAM_SECRET` unset). Until 1.f's sync ships, files must be placed manually under the music root.
+- **playlist_track materialisation (Phase 1.j.a).** Apply pipeline writes `playlist + field: "tracks"` ops into a dedicated `playlist_track` table that mirrors the desktop SQLite shape at [`profile/20260411120000_initial.sql:236`](https://github.com/InstaZDLL/WaveFlow/blob/main/src-tauri/migrations/profile/20260411120000_initial.sql) — `(playlist_id, track_id)` PK + position index, BIGINT epoch-millis for `added_at`. The `track_id` column is the source desktop's local-i64 id (no FK because the server has no `track` table yet — Phase 1.k territory); per-row snapshot columns (`snapshot_title`, `snapshot_artist`, `snapshot_duration_ms`) carry the displayable values cross-device so the public share preview can render the tracks. Wire shape:`payload.track_ids: [N, …]` for insert + delete (required); optional `payload.snapshots: { "<id_str>": { title, artist?, duration_ms? } }` for the 1.j.b wire bump that desktops gain in a follow-up release. Pre-1.j.b desktops emit ops without `snapshots` — rows land with NULL snapshot fields and stay invisible in the public preview (`fetch_for_share` filters `snapshot_title IS NOT NULL`). `set tracks` carries `{ track_id, position }` for single-row reorder. `insert_tracks` UPSERTs with `COALESCE`-merged snapshots so a future re-emit with richer metadata enriches the existing row instead of clobbering it. Parent-playlist lookup misses surface as `Skipped` (not `Applied`) so the durable log keeps the op for replay once the playlist insert lands.
 - **Artwork background scanner (Phase 1.i.1).** Tokio task spawned at boot when both the artwork backend AND the scanner are configured (`WAVEFLOW_ARTWORK_SCANNER_DISABLED` to opt out; defaults: 5-minute cadence, 50 parents per cycle). Lives in [`src/artwork_jobs.rs`](src/artwork_jobs.rs); same shape as the sync compaction loop (`SyncHub::spawn`'s nightly task). Each cycle calls `db::artwork::list_partial_parents` (`COUNT(metadata_artwork_variant) < EXPECTED_VARIANT_COUNT`, oldest-first), pulls the source bytes from object_store, re-runs the resize pipeline, and inserts only the variants still missing — race-safe via `ON CONFLICT (parent_hash, variant) DO NOTHING`, so a concurrent upload-side repair (or a peer scanner instance in a multi-replica deploy) collapses cleanly. Per-parent failures are logged + skipped; the cycle only errors on a top-level DB failure. **We deliberately picked a tokio polling loop over `apalis` for 1.i.1** — the workload is "periodic catch-up" rather than "queue-driven retries with priorities", and the surrounding infra already has a compaction loop to generalise from. `apalis` lands when a job type genuinely needs persistent queues + priorities (e.g. RFC-004 community moderation).
 - **Artwork cache (Phase 1.h.1 + 1.h.2 + 1.h.3).** Shared dedup-by-content store keyed on the BLAKE3 hex digest of the bytes. Three endpoints: `POST /api/v1/artwork` (JWT-authed, raw image bytes, `Content-Type` ∈ {`image/jpeg`, `image/png`, `image/webp`}, 4 MiB cap enforced by the handler + a matching `DefaultBodyLimit::max(MAX_UPLOAD_BYTES + 1024)` so the handler is the authoritative gatekeeper rather than axum's default 2 MiB) hashes server-side, runs the byte stream through [`artwork_pipeline::generate_variants`](src/artwork_pipeline.rs) (decode → fit-into-box resize → JPEG q85 encode per bucket; long-edge clamp prevents upscaling for sources already below the target) to produce `thumb` (≤ 128px) + `preview` (≤ 480px), and returns `{ hash, byte_size, mime, url, variants[] }` — idempotent, a re-upload of the same bytes skips both the storage write AND the pipeline run and echoes the stored row's `mime` + `byte_size` + the cached variant set; `GET /api/v1/artwork/{hash}` is public (the 64-hex hash IS the credential, same model as `share` tokens) and serves the bytes with the recorded Content-Type, `Cache-Control: public, max-age=31536000, immutable` + ETag = `"<hash>"` — the handler falls back to `metadata_artwork_variant` so a client that cached just the variant hash can hit the same route directly; `GET /api/v1/artwork/{hash}/{variant}` (variant ∈ {thumb, preview}) serves the resized JPEG with the same cache posture. Pipeline runs synchronously on the upload thread in 1.h.3 (apalis async lands in 1.i.1). Storage lives in [`src/storage.rs`](src/storage.rs) over Apache's `object_store` trait — `ArtworkBackend::{Local, S3}` enum picks the backend at boot via [`ArtworkBackend::from_env`](src/storage.rs); `Local` writes under `WAVEFLOW_ARTWORK_LOCAL_DIR` (created on the fly), `S3` uses `AmazonS3Builder` + an optional `WAVEFLOW_ARTWORK_S3_ENDPOINT` override to reach MinIO / Cloudflare R2 / Backblaze B2 (`with_allow_http(true)` flips on for the endpoint-override branch so an `http://minio:9000` deploy doesn't get refused; AWS itself ignores the flag). The two backends are mutually exclusive — setting both `WAVEFLOW_ARTWORK_LOCAL_DIR` + `WAVEFLOW_ARTWORK_S3_BUCKET` fails boot loudly. An optional `WAVEFLOW_ARTWORK_S3_PREFIX` wraps the inner store in `object_store::prefix::PrefixStore` so the shared `artwork/<hash>` key shape stays a single source of truth. Metadata persists in `metadata_artwork` (`hash` PK, `mime`, `byte_size`, `created_at`) + `metadata_artwork_variant` (`(parent_hash, variant)` PK, `hash`, `mime`, `byte_size`, `width`, `height`; `ON DELETE CASCADE` so a future GC of the parent reclaims the variants in the same tx), both written via `INSERT … ON CONFLICT DO NOTHING` for race-safe concurrent uploads; SQL helpers in [`db::artwork`](src/db.rs). All routes answer 503 when storage is disabled at boot (no backend env set). Async pipeline + on-demand re-generation land in 1.i.1.
 - **Sync (Phase 1.f).** Append-only `sync_op` log keyed on `BIGSERIAL id`; per-`(user, device)` UNIQUEs on `operation_id` (idempotency) and `lamport_ts` (monotonicity). Three REST routes + one WebSocket under `/api/v1/sync/*`: `POST /ops` push (idempotent replay via `ON CONFLICT operation_id DO NOTHING`, 409 + `stored_max` on lamport regression), `GET /ops?since=N` pull (410 + `compacted_up_to` when `0 < since < watermark`; `since=0` is the bootstrap path and always skips the guard so fresh devices can converge from an empty cursor — read-only, never advances the cursor), `POST /ack` (the **only** path that writes `device_sync_cursor`, buffered in memory + flushed every 5 s), `GET /ws?device_id=…` WebSocket fan-out (one broadcast channel, per-frame `user_id` filter so cross-tenant ops never leak). Live state in `sync::SyncHub`: tokio `broadcast::Sender` + `DashMap<(user_id, device_id), AckEntry>` + daily compaction task that flushes ACKs first then collapses superseded ops in the same Postgres transaction as the watermark UPSERT. Watermark monotonic by UPSERT `WHERE` clause. Stale devices (`last_seen_at < now - 90 d`) skipped from the compaction MIN. Tests drive `SyncHub::for_tests` (no background tasks) and call `flush_acks` / `compact_once` directly for determinism.
diff --git a/migrations/20260609000000_playlist_track.sql b/migrations/20260609000000_playlist_track.sql
new file mode 100644
index 0000000..2e4f1b5
--- /dev/null
+++ b/migrations/20260609000000_playlist_track.sql
@@ -0,0 +1,62 @@
+-- =============================================================================
+-- Phase 1.j.a — server-side `playlist_track` materialisation.
+--
+-- The desktop already emits sync ops on the wire shape
+-- `entity: "playlist", field: "tracks", op: ("insert" | "delete" | "set")`
+-- with a payload of `{ "track_ids": [N, …] }` (insert/delete) or
+-- `{ "track_id": N, "position": M }` (set/reorder). Before this
+-- migration the server accepted those ops into `sync_op` but had no
+-- entity table to materialise them into, so `/api/v1/share/playlists/{token}`
+-- always returned `tracks: []` regardless of the playlist's actual
+-- content.
+--
+-- Shape mirrors the desktop SQLite mirror at
+-- `src-tauri/migrations/profile/20260411120000_initial.sql:236` —
+-- `(playlist_id, track_id)` PK + position index — so a future
+-- `waveflow-core::repository::playlist_track` trait satisfies the
+-- same shape against either backend (Postgres BIGINT ↔ SQLite
+-- INTEGER, epoch-millis BIGINT for timestamps).
+--
+-- The `track_id` column carries the source desktop's local-i64
+-- track id. The server can't resolve it cross-device (a track with
+-- id=42 on device A is unrelated to id=42 on device B), so the
+-- snapshot columns below carry the displayable values cross-device
+-- — desktops on the 1.j.b wire bump populate them. A row with NULL
+-- snapshot is still indexable + visible to the owner's other
+-- devices on next sync, but is filtered out of the public share
+-- preview (the public read has nothing displayable for it).
+--
+-- A future track-canonical migration can replace `track_id` with a
+-- server-resolved foreign key once Phase 1.k plumbs the `track`
+-- entity through the apply pipeline.
+-- =============================================================================
+
+CREATE TABLE playlist_track (
+    playlist_id     BIGINT NOT NULL REFERENCES playlist(id) ON DELETE CASCADE,
+
+    -- Track id AS EMITTED BY THE SOURCE DESKTOP. Local-to-device
+    -- BIGINT, NOT a server canonical reference. No FK because the
+    -- server has no `track` table yet — see the migration header
+    -- for the migration path to a real FK.
+    track_id        BIGINT NOT NULL,
+
+    position        INTEGER NOT NULL CHECK (position >= 0),
+
+    added_at        BIGINT NOT NULL,
+
+    -- Snapshot fields populated by desktops that emit the 1.j.b
+    -- wire bump (a future PR). Older desktops continue to emit ops
+    -- without these; the row is still tracked but invisible from
+    -- the public share preview, which filters on
+    -- `snapshot_title IS NOT NULL`.
+    snapshot_title          TEXT,
+    snapshot_artist         TEXT,
+    snapshot_duration_ms    BIGINT CHECK (snapshot_duration_ms IS NULL OR snapshot_duration_ms > 0),
+
+    PRIMARY KEY (playlist_id, track_id)
+);
+
+-- Mirrors the SQLite index: ordered scans for the share preview
+-- and for the owner's listing of a playlist's tracks.
+CREATE INDEX idx_playlist_track_position
+    ON playlist_track(playlist_id, position);
diff --git a/src/api/share.rs b/src/api/share.rs
index fb7916f..64fd3f8 100644
--- a/src/api/share.rs
+++ b/src/api/share.rs
@@ -287,21 +287,51 @@ async fn get_public_playlist(
             cover_hash,
             created_at,
             updated_at,
-        ))) => (
-            StatusCode::OK,
-            Json(PublicPlaylistResponse {
-                id,
-                name,
-                description,
-                color_id,
-                icon_id,
-                cover_hash,
-                created_at,
-                updated_at,
-                tracks: Vec::new(),
-            }),
-        )
-            .into_response(),
+        ))) => {
+            // Phase 1.j.a — populate the track list from
+            // `playlist_track`, filtered to rows that carry a
+            // snapshot title (the only ones we can display in the
+            // public preview). Pre-1.j.b desktops emit tracks ops
+            // without snapshots; their rows are still tracked but
+            // the public read skips them until the desktop ships
+            // the wire bump.
+            //
+            // Track-list lookup failure logs + falls back to empty
+            // rather than bubbling up — the playlist itself
+            // resolved cleanly, so a downstream tracks query hiccup
+            // shouldn't take the whole preview down. Worst case the
+            // crawler sees an empty list, same shape as a brand-
+            // new playlist.
+            let tracks = match crate::db::playlist_track::fetch_for_share(&state.db, id).await {
+                Ok(rows) => rows
+                    .into_iter()
+                    .map(|r| PublicTrack {
+                        title: r.title,
+                        artist: r.artist,
+                        duration_ms: r.duration_ms,
+                    })
+                    .collect(),
+                Err(err) => {
+                    tracing::warn!(error = %err, playlist_id = id, "share public tracks lookup failed, falling back to empty");
+                    Vec::new()
+                }
+            };
+            (
+                StatusCode::OK,
+                Json(PublicPlaylistResponse {
+                    id,
+                    name,
+                    description,
+                    color_id,
+                    icon_id,
+                    cover_hash,
+                    created_at,
+                    updated_at,
+                    tracks,
+                }),
+            )
+                .into_response()
+        }
         Ok(None) => StatusCode::NOT_FOUND.into_response(),
         Err(err) => {
             tracing::error!(error = %err, "share public lookup failed");
diff --git a/src/apply.rs b/src/apply.rs
index b5b373d..8c5798f 100644
--- a/src/apply.rs
+++ b/src/apply.rs
@@ -273,8 +273,10 @@ fn payload_i64(
 // ---------------------------------------------------------------
 
 mod playlist {
+    use serde_json::Value;
     use sqlx::PgConnection;
 
+    use crate::db::playlist_track::TrackSnapshot;
     use crate::sync::SyncOpIn;
 
     use super::{payload_optional_string, payload_string, ApplyError, ApplyOutcome};
@@ -298,10 +300,23 @@ mod playlist {
             ("set", Some(field @ ("name" | "description" | "color_id" | "icon_id"))) => {
                 set_field(conn, profile_id, canonical_id, field, op, now).await
             }
-            // `tracks` ops are recognised but unsupported until
-            // desktop emits file_hash references instead of local
-            // BIGINT track ids. See migration doc.
-            (_, Some("tracks")) => Ok(ApplyOutcome::Skipped),
+            // Track-list mutations (Phase 1.j.a). Desktop emits:
+            // - `insert tracks` with `payload.track_ids: [N, …]`
+            //   (optionally `payload.snapshots: { "<id_str>": { title, artist?, duration_ms? } }`
+            //   from 1.j.b onward).
+            // - `delete tracks` with `payload.track_ids: [N, …]`.
+            // - `set tracks` with `payload: { track_id: N, position: M }`
+            //   for a single reorder.
+            //
+            // `track_id` is the source desktop's local-i64 id, NOT a
+            // server canonical reference. Snapshots are what makes a
+            // row visible in the public share preview; ops without
+            // them are stored but filtered out of the public read.
+            ("insert", Some("tracks")) => {
+                insert_tracks(conn, profile_id, canonical_id, op, now).await
+            }
+            ("delete", Some("tracks")) => delete_tracks(conn, profile_id, canonical_id, op).await,
+            ("set", Some("tracks")) => reorder_track(conn, profile_id, canonical_id, op).await,
             // Anything else with a `field` we don't know about
             // surfaces as Unknown so telemetry can spot a missed
             // protocol extension.
@@ -359,6 +374,229 @@ mod playlist {
         Ok(ApplyOutcome::Applied)
     }
 
+    /// Resolve a playlist canonical id to its server `playlist.id`.
+    /// Returns `None` when the parent playlist hasn't been
+    /// materialised yet — caller treats that as `Skipped` so the
+    /// tracks op stays in the durable log for replay once the
+    /// playlist's own insert lands. Tenant scoping is the
+    /// `profile_id` already resolved by `apply_op`.
+    async fn lookup_playlist_id(
+        conn: &mut PgConnection,
+        profile_id: i64,
+        canonical_id: &str,
+    ) -> Result<Option<i64>, ApplyError> {
+        sqlx::query_scalar::<_, i64>(
+            "SELECT id FROM playlist
+              WHERE profile_id = $1 AND canonical_id = $2",
+        )
+        .bind(profile_id)
+        .bind(canonical_id)
+        .fetch_optional(&mut *conn)
+        .await
+        .map_err(Into::into)
+    }
+
+    async fn insert_tracks(
+        conn: &mut PgConnection,
+        profile_id: i64,
+        canonical_id: &str,
+        op: &SyncOpIn,
+        now: i64,
+    ) -> Result<ApplyOutcome, ApplyError> {
+        let Some(playlist_id) = lookup_playlist_id(conn, profile_id, canonical_id).await? else {
+            // Parent playlist not materialised yet — keep the op in
+            // the log. The desktop only emits tracks ops after the
+            // playlist's own insert, but a server-side ordering
+            // hiccup or out-of-order pull could surface this.
+            return Ok(ApplyOutcome::Skipped);
+        };
+
+        let track_ids = track_ids_from_payload(op)?;
+        if track_ids.is_empty() {
+            return Ok(ApplyOutcome::Applied);
+        }
+
+        let snapshots = snapshots_from_payload(op)?;
+        let rows: Vec<(i64, Option<TrackSnapshot>)> = track_ids
+            .iter()
+            .map(|id| {
+                let snapshot = snapshots.as_ref().and_then(|map| map.get(id).cloned());
+                (*id, snapshot)
+            })
+            .collect();
+
+        crate::db::playlist_track::append_tracks(conn, playlist_id, &rows, now).await?;
+        Ok(ApplyOutcome::Applied)
+    }
+
+    async fn delete_tracks(
+        conn: &mut PgConnection,
+        profile_id: i64,
+        canonical_id: &str,
+        op: &SyncOpIn,
+    ) -> Result<ApplyOutcome, ApplyError> {
+        let Some(playlist_id) = lookup_playlist_id(conn, profile_id, canonical_id).await? else {
+            return Ok(ApplyOutcome::Skipped);
+        };
+        let track_ids = track_ids_from_payload(op)?;
+        if track_ids.is_empty() {
+            return Ok(ApplyOutcome::Applied);
+        }
+        crate::db::playlist_track::remove_tracks(conn, playlist_id, &track_ids).await?;
+        Ok(ApplyOutcome::Applied)
+    }
+
+    async fn reorder_track(
+        conn: &mut PgConnection,
+        profile_id: i64,
+        canonical_id: &str,
+        op: &SyncOpIn,
+    ) -> Result<ApplyOutcome, ApplyError> {
+        let Some(playlist_id) = lookup_playlist_id(conn, profile_id, canonical_id).await? else {
+            return Ok(ApplyOutcome::Skipped);
+        };
+        let payload = op
+            .payload
+            .as_ref()
+            .ok_or_else(|| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "set",
+                reason: "tracks reorder payload missing (expected {track_id, position})".into(),
+            })?;
+        let track_id = payload
+            .get("track_id")
+            .and_then(Value::as_i64)
+            .ok_or_else(|| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "set",
+                reason: "payload.track_id missing or not an integer".into(),
+            })?;
+        let position = payload
+            .get("position")
+            .and_then(Value::as_i64)
+            .ok_or_else(|| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "set",
+                reason: "payload.position missing or not an integer".into(),
+            })?;
+        let position_i32: i32 =
+            i32::try_from(position).map_err(|_| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "set",
+                reason: format!("payload.position {position} out of i32 range"),
+            })?;
+        if position_i32 < 0 {
+            return Err(ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "set",
+                reason: format!("payload.position must be >= 0, got {position_i32}"),
+            });
+        }
+        crate::db::playlist_track::set_position(conn, playlist_id, track_id, position_i32).await?;
+        Ok(ApplyOutcome::Applied)
+    }
+
+    /// Extract `payload.track_ids: [N, …]` — required for both
+    /// insert and delete. Same accept-only-integers shape the
+    /// desktop's inbound parser uses (see desktop crate's apply.rs).
+    fn track_ids_from_payload(op: &SyncOpIn) -> Result<Vec<i64>, ApplyError> {
+        let payload = op
+            .payload
+            .as_ref()
+            .ok_or_else(|| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "tracks",
+                reason: "payload missing (expected {track_ids: [...]})".into(),
+            })?;
+        let arr = payload
+            .get("track_ids")
+            .and_then(Value::as_array)
+            .ok_or_else(|| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "tracks",
+                reason: "payload.track_ids missing or not an array".into(),
+            })?;
+        arr.iter()
+            .map(|v| {
+                v.as_i64().ok_or_else(|| ApplyError::InvalidPayload {
+                    entity: ENTITY,
+                    op: "tracks",
+                    reason: "payload.track_ids must contain only integers".into(),
+                })
+            })
+            .collect()
+    }
+
+    /// Optionally extract `payload.snapshots: { "<id_str>": { title, artist?, duration_ms? } }`.
+    /// Returns `Ok(None)` when the field is absent (pre-1.j.b
+    /// desktop) — the apply path then stores the rows with NULL
+    /// snapshot fields, which keeps them out of the public share
+    /// preview until a future desktop re-emits with the snapshot.
+    ///
+    /// Returns an error when the field is present but malformed —
+    /// we prefer to reject a corrupt batch up front rather than
+    /// store a mix of populated + NULL rows that would be hard to
+    /// audit later.
+    fn snapshots_from_payload(
+        op: &SyncOpIn,
+    ) -> Result<Option<std::collections::HashMap<i64, TrackSnapshot>>, ApplyError> {
+        let Some(payload) = op.payload.as_ref() else {
+            return Ok(None);
+        };
+        let Some(map) = payload.get("snapshots") else {
+            return Ok(None);
+        };
+        if matches!(map, Value::Null) {
+            return Ok(None);
+        }
+        let obj = map.as_object().ok_or_else(|| ApplyError::InvalidPayload {
+            entity: ENTITY,
+            op: "tracks",
+            reason: "payload.snapshots must be an object keyed by track_id".into(),
+        })?;
+        let mut out = std::collections::HashMap::with_capacity(obj.len());
+        for (key, value) in obj {
+            let track_id: i64 = key.parse().map_err(|_| ApplyError::InvalidPayload {
+                entity: ENTITY,
+                op: "tracks",
+                reason: format!("payload.snapshots key {key:?} is not an integer"),
+            })?;
+            let inner = value
+                .as_object()
+                .ok_or_else(|| ApplyError::InvalidPayload {
+                    entity: ENTITY,
+                    op: "tracks",
+                    reason: format!("payload.snapshots[{key}] must be an object"),
+                })?;
+            let title = inner
+                .get("title")
+                .and_then(Value::as_str)
+                .ok_or_else(|| ApplyError::InvalidPayload {
+                    entity: ENTITY,
+                    op: "tracks",
+                    reason: format!("payload.snapshots[{key}].title missing or not a string"),
+                })?
+                .to_owned();
+            let artist = inner
+                .get("artist")
+                .and_then(Value::as_str)
+                .map(str::to_owned);
+            let duration_ms = inner
+                .get("duration_ms")
+                .and_then(Value::as_i64)
+                .unwrap_or(0);
+            out.insert(
+                track_id,
+                TrackSnapshot {
+                    title,
+                    artist,
+                    duration_ms,
+                },
+            );
+        }
+        Ok(Some(out))
+    }
+
     async fn set_field(
         conn: &mut PgConnection,
         profile_id: i64,
diff --git a/src/db.rs b/src/db.rs
index 6178aba..198878c 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -445,6 +445,173 @@ pub mod share {
     }
 }
 
+/// `playlist_track` materialisation helpers (Phase 1.j.a). Reads +
+/// writes against the join table populated by the apply pipeline
+/// when desktops emit `entity: "playlist", field: "tracks"` ops.
+/// SQL stays here, the apply handlers + the share preview SELECT
+/// only call into these functions.
+pub mod playlist_track {
+    use sqlx::PgConnection;
+
+    /// One row's projection for the public share preview. `snapshot_*`
+    /// fields carry the displayable values cross-device — rows whose
+    /// `snapshot_title IS NULL` (older desktop emitter pre-1.j.b)
+    /// are excluded by the public SELECT so the preview only ever
+    /// surfaces displayable rows.
+    #[derive(Debug, Clone, PartialEq, Eq)]
+    pub struct PublicTrackRow {
+        pub title: String,
+        pub artist: Option<String>,
+        pub duration_ms: i64,
+    }
+
+    /// Insert / upsert a batch of `(track_id, snapshot?)` pairs into a
+    /// playlist. Position assignment is "append at the end" — we
+    /// SELECT the current MAX(position) once and add 1 per inserted
+    /// row, mirroring the desktop `append_tracks_conn` behaviour.
+    /// `ON CONFLICT (playlist_id, track_id) DO UPDATE` lets a
+    /// re-emit of the same op carry an updated snapshot without
+    /// disturbing the position (the desktop never reorders + inserts
+    /// in the same op, so position writes only come from the
+    /// `set` / reorder path).
+    pub async fn append_tracks(
+        conn: &mut PgConnection,
+        playlist_id: i64,
+        rows: &[(i64, Option<TrackSnapshot>)],
+        now_ms: i64,
+    ) -> Result<(), sqlx::Error> {
+        if rows.is_empty() {
+            return Ok(());
+        }
+
+        // Read MAX(position) once so we don't pay a round-trip per
+        // row. NULL → -1 so the first inserted lands at position 0.
+        let max_position: Option<i32> =
+            sqlx::query_scalar("SELECT MAX(position) FROM playlist_track WHERE playlist_id = $1")
+                .bind(playlist_id)
+                .fetch_one(&mut *conn)
+                .await?;
+        let mut next_position = max_position.unwrap_or(-1).saturating_add(1);
+
+        for (track_id, snapshot) in rows {
+            let (title, artist, duration_ms) = match snapshot {
+                Some(s) => (Some(s.title.clone()), s.artist.clone(), Some(s.duration_ms)),
+                None => (None, None, None),
+            };
+            sqlx::query(
+                "INSERT INTO playlist_track
+                      (playlist_id, track_id, position, added_at,
+                       snapshot_title, snapshot_artist, snapshot_duration_ms)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7)
+                 ON CONFLICT (playlist_id, track_id) DO UPDATE
+                      SET snapshot_title = COALESCE(EXCLUDED.snapshot_title, playlist_track.snapshot_title),
+                          snapshot_artist = COALESCE(EXCLUDED.snapshot_artist, playlist_track.snapshot_artist),
+                          snapshot_duration_ms = COALESCE(EXCLUDED.snapshot_duration_ms, playlist_track.snapshot_duration_ms)",
+            )
+            .bind(playlist_id)
+            .bind(track_id)
+            .bind(next_position)
+            .bind(now_ms)
+            .bind(title)
+            .bind(artist)
+            .bind(duration_ms)
+            .execute(&mut *conn)
+            .await?;
+            next_position = next_position.saturating_add(1);
+        }
+        Ok(())
+    }
+
+    /// Drop tracks from a playlist. The desktop's outbound op is
+    /// "DELETE the set of these track_ids", same shape we model
+    /// here. Unknown ids are silently filtered by the WHERE so a
+    /// replay against a divergent server cache is a no-op rather
+    /// than an error.
+    pub async fn remove_tracks(
+        conn: &mut PgConnection,
+        playlist_id: i64,
+        track_ids: &[i64],
+    ) -> Result<u64, sqlx::Error> {
+        if track_ids.is_empty() {
+            return Ok(0);
+        }
+        let res = sqlx::query(
+            "DELETE FROM playlist_track
+              WHERE playlist_id = $1 AND track_id = ANY($2)",
+        )
+        .bind(playlist_id)
+        .bind(track_ids)
+        .execute(&mut *conn)
+        .await?;
+        Ok(res.rows_affected())
+    }
+
+    /// Reorder a single track. The desktop emits one of these per
+    /// drag-and-drop; bulk reorders fan out into N separate ops.
+    /// We UPDATE the target's position; the implicit gap left by
+    /// the old position resolves the next time the desktop replays
+    /// a full snapshot — the public preview reads ORDER BY position
+    /// so gaps just produce the same visible ordering.
+    pub async fn set_position(
+        conn: &mut PgConnection,
+        playlist_id: i64,
+        track_id: i64,
+        new_position: i32,
+    ) -> Result<u64, sqlx::Error> {
+        let res = sqlx::query(
+            "UPDATE playlist_track
+                SET position = $3
+              WHERE playlist_id = $1 AND track_id = $2",
+        )
+        .bind(playlist_id)
+        .bind(track_id)
+        .bind(new_position)
+        .execute(&mut *conn)
+        .await?;
+        Ok(res.rows_affected())
+    }
+
+    /// Snapshot accepted from the `payload.snapshots` map. Title is
+    /// the only required field; artist + duration are present in
+    /// the common case but tolerated absent so a desktop with a
+    /// partial tag library still ships useful previews.
+    #[derive(Debug, Clone)]
+    pub struct TrackSnapshot {
+        pub title: String,
+        pub artist: Option<String>,
+        pub duration_ms: i64,
+    }
+
+    /// Public share preview: list the tracks belonging to a
+    /// playlist, in position order, filtered to rows with a non-
+    /// NULL snapshot title (the only ones we can display in the
+    /// public preview). Desktops still on the pre-1.j.b wire emit
+    /// without snapshots; their rows stay invisible until they
+    /// re-sync on a newer client.
+    pub async fn fetch_for_share(
+        pool: &sqlx::PgPool,
+        playlist_id: i64,
+    ) -> Result<Vec<PublicTrackRow>, sqlx::Error> {
+        let rows = sqlx::query_as::<_, (String, Option<String>, i64)>(
+            "SELECT snapshot_title, snapshot_artist, COALESCE(snapshot_duration_ms, 0)
+               FROM playlist_track
+              WHERE playlist_id = $1 AND snapshot_title IS NOT NULL
+              ORDER BY position ASC",
+        )
+        .bind(playlist_id)
+        .fetch_all(pool)
+        .await?;
+        Ok(rows
+            .into_iter()
+            .map(|(title, artist, duration_ms)| PublicTrackRow {
+                title,
+                artist,
+                duration_ms,
+            })
+            .collect())
+    }
+}
+
 /// Shared artwork cache helpers (Phase 1.h.1). Reads + writes against
 /// the [`metadata_artwork`] table. The bytes themselves live in
 /// `object_store` at `artwork/<hash>`; this module is the metadata
diff --git a/tests/apply.rs b/tests/apply.rs
index 83209eb..42e29f0 100644
--- a/tests/apply.rs
+++ b/tests/apply.rs
@@ -218,6 +218,280 @@ async fn playlist_delete_removes_row(pool: PgPool) {
     assert_eq!(count.0, 0);
 }
 
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn playlist_insert_tracks_materialises_rows_without_snapshot(pool: PgPool) {
+    // Pre-1.j.b desktop wire — emits `payload.track_ids` only,
+    // no `payload.snapshots`. Rows must land in `playlist_track`
+    // with NULL snapshot fields. Position is auto-assigned starting
+    // at 0.
+    let auth = spawn_authenticated(pool.clone(), "apply-pl-tracks-ins").await;
+    let playlist_cid = "pl-tracks-bare";
+
+    let insert_playlist = op(
+        Uuid::new_v4(),
+        1,
+        "playlist",
+        playlist_cid,
+        None,
+        "insert",
+        json!({ "name": "Mix" }),
+        Some(PROFILE_CID),
+    );
+    let insert_tracks = op(
+        Uuid::new_v4(),
+        2,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "insert",
+        json!({ "track_ids": [101, 102, 103] }),
+        Some(PROFILE_CID),
+    );
+
+    assert!(
+        push(&auth.base, &auth.token, &[insert_playlist, insert_tracks])
+            .await
+            .is_success()
+    );
+
+    let rows: Vec<(i64, i32, Option<String>)> = sqlx::query_as(
+        "SELECT pt.track_id, pt.position, pt.snapshot_title
+           FROM playlist_track pt
+           JOIN playlist p ON p.id = pt.playlist_id
+          WHERE p.canonical_id = $1
+          ORDER BY pt.position ASC",
+    )
+    .bind(playlist_cid)
+    .fetch_all(&pool)
+    .await
+    .unwrap();
+    assert_eq!(rows.len(), 3);
+    assert_eq!(rows[0], (101, 0, None));
+    assert_eq!(rows[1], (102, 1, None));
+    assert_eq!(rows[2], (103, 2, None));
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn playlist_insert_tracks_carries_snapshot(pool: PgPool) {
+    // Post-1.j.b desktop wire — payload now ships `snapshots` keyed
+    // by track id (as string). Snapshot fields must land on the row
+    // so the public share preview can render the title + artist.
+    let auth = spawn_authenticated(pool.clone(), "apply-pl-tracks-snap").await;
+    let playlist_cid = "pl-tracks-snap";
+
+    let insert_playlist = op(
+        Uuid::new_v4(),
+        1,
+        "playlist",
+        playlist_cid,
+        None,
+        "insert",
+        json!({ "name": "Soirée" }),
+        Some(PROFILE_CID),
+    );
+    let insert_tracks = op(
+        Uuid::new_v4(),
+        2,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "insert",
+        json!({
+            "track_ids": [201, 202],
+            "snapshots": {
+                "201": { "title": "Daft", "artist": "Punk", "duration_ms": 222000 },
+                "202": { "title": "Around the World", "duration_ms": 280000 }
+            }
+        }),
+        Some(PROFILE_CID),
+    );
+
+    assert!(
+        push(&auth.base, &auth.token, &[insert_playlist, insert_tracks])
+            .await
+            .is_success()
+    );
+
+    // Tuple type alias keeps clippy's "very complex type" lint
+    // satisfied while still letting the test read like a wire dump.
+    type SnapshotRow = (i64, Option<String>, Option<String>, Option<i64>);
+    let rows: Vec<SnapshotRow> = sqlx::query_as(
+        "SELECT pt.track_id, pt.snapshot_title, pt.snapshot_artist, pt.snapshot_duration_ms
+           FROM playlist_track pt
+           JOIN playlist p ON p.id = pt.playlist_id
+          WHERE p.canonical_id = $1
+          ORDER BY pt.position ASC",
+    )
+    .bind(playlist_cid)
+    .fetch_all(&pool)
+    .await
+    .unwrap();
+    assert_eq!(rows.len(), 2);
+    assert_eq!(
+        rows[0],
+        (201, Some("Daft".into()), Some("Punk".into()), Some(222000))
+    );
+    assert_eq!(
+        rows[1],
+        (202, Some("Around the World".into()), None, Some(280000))
+    );
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn playlist_delete_tracks_drops_rows(pool: PgPool) {
+    let auth = spawn_authenticated(pool.clone(), "apply-pl-tracks-del").await;
+    let playlist_cid = "pl-tracks-del";
+
+    let insert_playlist = op(
+        Uuid::new_v4(),
+        1,
+        "playlist",
+        playlist_cid,
+        None,
+        "insert",
+        json!({ "name": "Doomed" }),
+        Some(PROFILE_CID),
+    );
+    let insert_tracks = op(
+        Uuid::new_v4(),
+        2,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "insert",
+        json!({ "track_ids": [301, 302, 303] }),
+        Some(PROFILE_CID),
+    );
+    let delete_tracks = op(
+        Uuid::new_v4(),
+        3,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "delete",
+        json!({ "track_ids": [302] }),
+        Some(PROFILE_CID),
+    );
+
+    assert!(push(
+        &auth.base,
+        &auth.token,
+        &[insert_playlist, insert_tracks, delete_tracks]
+    )
+    .await
+    .is_success());
+
+    let remaining: Vec<(i64,)> = sqlx::query_as(
+        "SELECT pt.track_id FROM playlist_track pt
+           JOIN playlist p ON p.id = pt.playlist_id
+          WHERE p.canonical_id = $1
+          ORDER BY pt.position ASC",
+    )
+    .bind(playlist_cid)
+    .fetch_all(&pool)
+    .await
+    .unwrap();
+    assert_eq!(
+        remaining.iter().map(|(t,)| *t).collect::<Vec<_>>(),
+        vec![301, 303],
+    );
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn playlist_set_tracks_reorders_position(pool: PgPool) {
+    let auth = spawn_authenticated(pool.clone(), "apply-pl-tracks-reorder").await;
+    let playlist_cid = "pl-tracks-reorder";
+
+    let insert_playlist = op(
+        Uuid::new_v4(),
+        1,
+        "playlist",
+        playlist_cid,
+        None,
+        "insert",
+        json!({ "name": "Reorderable" }),
+        Some(PROFILE_CID),
+    );
+    let insert_tracks = op(
+        Uuid::new_v4(),
+        2,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "insert",
+        json!({ "track_ids": [401, 402, 403] }),
+        Some(PROFILE_CID),
+    );
+    // Move track 403 from position 2 to position 0.
+    let reorder = op(
+        Uuid::new_v4(),
+        3,
+        "playlist",
+        playlist_cid,
+        Some("tracks"),
+        "set",
+        json!({ "track_id": 403, "position": 0 }),
+        Some(PROFILE_CID),
+    );
+
+    assert!(push(
+        &auth.base,
+        &auth.token,
+        &[insert_playlist, insert_tracks, reorder]
+    )
+    .await
+    .is_success());
+
+    let pos_403: i32 = sqlx::query_scalar(
+        "SELECT pt.position FROM playlist_track pt
+           JOIN playlist p ON p.id = pt.playlist_id
+          WHERE p.canonical_id = $1 AND pt.track_id = $2",
+    )
+    .bind(playlist_cid)
+    .bind(403i64)
+    .fetch_one(&pool)
+    .await
+    .unwrap();
+    assert_eq!(
+        pos_403, 0,
+        "reorder must move the row to the target position"
+    );
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn playlist_insert_tracks_without_parent_is_skipped(pool: PgPool) {
+    // Tracks op for a playlist whose `insert` op didn't land first
+    // (or got dropped). The apply pipeline should `Skipped` rather
+    // than error so the durable log keeps the op for a future
+    // replay. Push still returns success (apply outcome is
+    // telemetry-only).
+    let auth = spawn_authenticated(pool.clone(), "apply-pl-tracks-orphan").await;
+
+    let orphan_tracks = op(
+        Uuid::new_v4(),
+        1,
+        "playlist",
+        "pl-orphan",
+        Some("tracks"),
+        "insert",
+        json!({ "track_ids": [501, 502] }),
+        Some(PROFILE_CID),
+    );
+
+    let status = push(&auth.base, &auth.token, &[orphan_tracks]).await;
+    assert!(
+        status.is_success(),
+        "skipped apply should still 2xx the push: {status}",
+    );
+
+    let count: (i64,) =
+        sqlx::query_as("SELECT COUNT(*) FROM playlist_track WHERE track_id IN (501, 502)")
+            .fetch_one(&pool)
+            .await
+            .unwrap();
+    assert_eq!(count.0, 0, "no rows when the parent playlist is missing");
+}
+
 #[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
 async fn library_insert_materialises_row(pool: PgPool) {
     let auth = spawn_authenticated(pool.clone(), "apply-lib-ins").await;
diff --git a/tests/share.rs b/tests/share.rs
index b0ac6e9..549934c 100644
--- a/tests/share.rs
+++ b/tests/share.rs
@@ -358,6 +358,180 @@ async fn by_canonical_mint_resolves_via_public_get(pool: PgPool) {
     assert_eq!(public["name"].as_str(), Some("Soirée canon"));
 }
 
+/// Push a `playlist + field: tracks, insert` op carrying the
+/// 1.j.b-style `snapshots` map so the share preview can render
+/// the tracks. Returns once the apply pipeline has materialised
+/// the rows (the push response is the contract).
+async fn materialise_playlist_tracks_via_sync(
+    base: &str,
+    token: &str,
+    profile_canonical: &str,
+    playlist_canonical: &str,
+    tracks: &[(i64, &str, Option<&str>, i64)],
+) {
+    let mut snapshots = serde_json::Map::new();
+    let mut track_ids = Vec::with_capacity(tracks.len());
+    for (id, title, artist, duration_ms) in tracks {
+        track_ids.push(*id);
+        let mut entry = serde_json::Map::new();
+        entry.insert("title".into(), json!(title));
+        if let Some(a) = artist {
+            entry.insert("artist".into(), json!(a));
+        }
+        entry.insert("duration_ms".into(), json!(*duration_ms));
+        snapshots.insert(id.to_string(), Value::Object(entry));
+    }
+    let resp = reqwest::Client::new()
+        .post(format!("{base}/api/v1/sync/ops"))
+        .bearer_auth(token)
+        .json(&json!({
+            "device_id": Uuid::new_v4().to_string(),
+            "ops": [{
+                "operation_id": Uuid::new_v4(),
+                "lamport_ts": 2,
+                "entity": "playlist",
+                "entity_id": playlist_canonical,
+                "field": "tracks",
+                "op": "insert",
+                "payload": {
+                    "track_ids": track_ids,
+                    "snapshots": Value::Object(snapshots),
+                },
+                "profile_canonical_id": profile_canonical,
+            }],
+        }))
+        .send()
+        .await
+        .expect("sync push (tracks) failed");
+    assert!(
+        resp.status().is_success(),
+        "sync push for tracks must succeed: {}",
+        resp.status()
+    );
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn public_get_lists_tracks_when_snapshots_present(pool: PgPool) {
+    // Phase 1.j.a end-to-end: desktop emits a playlist insert,
+    // then a tracks insert carrying snapshots. The share preview
+    // public GET must return those tracks in position order with
+    // their title + artist + duration_ms intact.
+    let h = spawn_authenticated(pool, "user-share-tracks").await;
+    let pl_canon = "pl-tracks-snap-share";
+    materialise_playlist_via_sync(&h.base, &h.token, PROF_CANON, pl_canon, "Soirée 1.j").await;
+    materialise_playlist_tracks_via_sync(
+        &h.base,
+        &h.token,
+        PROF_CANON,
+        pl_canon,
+        &[
+            (601, "One More Time", Some("Daft Punk"), 320000),
+            (602, "Around the World", Some("Daft Punk"), 280000),
+        ],
+    )
+    .await;
+
+    let mint: Value = reqwest::Client::new()
+        .post(format!(
+            "{}/api/v1/share/playlists/by-canonical/{PROF_CANON}/{pl_canon}",
+            h.base
+        ))
+        .bearer_auth(&h.token)
+        .send()
+        .await
+        .unwrap()
+        .error_for_status()
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let token = mint["token"].as_str().unwrap().to_string();
+
+    let public: Value = reqwest::Client::new()
+        .get(format!("{}/api/v1/share/playlists/{}", h.base, token))
+        .send()
+        .await
+        .unwrap()
+        .error_for_status()
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let tracks = public["tracks"].as_array().expect("tracks array");
+    assert_eq!(tracks.len(), 2, "both tracks must surface: {public}");
+    assert_eq!(tracks[0]["title"].as_str(), Some("One More Time"));
+    assert_eq!(tracks[0]["artist"].as_str(), Some("Daft Punk"));
+    assert_eq!(tracks[0]["duration_ms"].as_i64(), Some(320000));
+    assert_eq!(tracks[1]["title"].as_str(), Some("Around the World"));
+}
+
+#[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
+async fn public_get_hides_tracks_without_snapshots(pool: PgPool) {
+    // Pre-1.j.b desktop emits tracks ops WITHOUT a `snapshots`
+    // map. The rows still land in `playlist_track` (so a future
+    // re-sync from a snapshot-aware client can populate them
+    // without re-inserting), but the public share preview filters
+    // them out — nothing displayable means nothing to surface.
+    let h = spawn_authenticated(pool, "user-share-tracks-bare").await;
+    let pl_canon = "pl-tracks-no-snap";
+    materialise_playlist_via_sync(&h.base, &h.token, PROF_CANON, pl_canon, "Bare").await;
+
+    // Direct sync push, no snapshots in the payload.
+    let resp = reqwest::Client::new()
+        .post(format!("{}/api/v1/sync/ops", h.base))
+        .bearer_auth(&h.token)
+        .json(&json!({
+            "device_id": Uuid::new_v4().to_string(),
+            "ops": [{
+                "operation_id": Uuid::new_v4(),
+                "lamport_ts": 2,
+                "entity": "playlist",
+                "entity_id": pl_canon,
+                "field": "tracks",
+                "op": "insert",
+                "payload": { "track_ids": [701, 702] },
+                "profile_canonical_id": PROF_CANON,
+            }],
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert!(resp.status().is_success());
+
+    let mint: Value = reqwest::Client::new()
+        .post(format!(
+            "{}/api/v1/share/playlists/by-canonical/{PROF_CANON}/{pl_canon}",
+            h.base
+        ))
+        .bearer_auth(&h.token)
+        .send()
+        .await
+        .unwrap()
+        .error_for_status()
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let token = mint["token"].as_str().unwrap().to_string();
+
+    let public: Value = reqwest::Client::new()
+        .get(format!("{}/api/v1/share/playlists/{}", h.base, token))
+        .send()
+        .await
+        .unwrap()
+        .error_for_status()
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let tracks = public["tracks"].as_array().expect("tracks array");
+    assert_eq!(
+        tracks.len(),
+        0,
+        "snapshot-less rows must be hidden from the public preview: {public}",
+    );
+}
+
 #[sqlx::test(migrator = "waveflow_server::db::MIGRATOR")]
 async fn by_canonical_mint_is_idempotent(pool: PgPool) {
     let h = spawn_authenticated(pool, "user-share-canon-idem").await;